TalkTalk Fiber and IPv6 tunnel from HE

Here is short description how to setup Hurricane Electric IPv6 tunnel with:

  • TalkTalk Fiber
  • HG633 router
  • Raspberry Pi running Raspbian.
First enable ipv6 module loading. Then ensure that on your router:
  1. VPN pass-through is enabled (it will under the hood enable proto 41 that is necessary for 6in4 tunnel).
  2. disabled
  3. disabled
Then edit /etc/network/interfaces to get something similar to this:


auto lo
iface lo inet loopback

auto eth0
allow-hotplug eth0
iface eth0 inet manual

## Add HE tunnel
auto he-ipv6
iface he-ipv6 inet6 v4tunnel
  address 2001:470:6666:6666::2
  netmask 64
  endpoint 216.111.11.1 # Remote HE tunnel IP (POP)
  local 192.168.0.44 # Local RPi IPv4 address
  ttl 255
  gateway 2001:470:6666:6666::1 # Your tunnel remote end
  post-up ip -6 addr add 2001:470:7777:7777::1/64 dev eth0
  pre-down ip -6 addr del 2001:470:7777:7777::1/64 dev eth0

Last two lines adds/removes one of routed subnet IP addresses to eth0 interface. It will be useful for setting IPv6 router later on.

Here is what we gained so far:
pi@raspberrypi ~ $ ifconfig
eth0      Link encap:Ethernet  HWaddr b8:27:eb:1f:b9:21
          inet addr:192.168.147.76  Bcast:192.168.147.255  Mask:255.255.255.0
          inet6 addr: fe80::1234:1234:1234:1234/64 Scope:Link
          inet6 addr: fd48:1234:1234:1234:1234:1234:1234:123/64 Scope:Global
          inet6 addr: 2001:470:7777:7777::1/64 Scope:Global
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:9055 errors:62 dropped:31 overruns:0 frame:62
          TX packets:712 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:444686 (434.2 KiB)  TX bytes:106088 (103.6 KiB)

he-ipv6   Link encap:IPv6-in-IPv4
          inet6 addr: 2001:470:6666:6666::2/64 Scope:Global
          inet6 addr: fe80::c0a8:934c/64 Scope:Link
          UP POINTOPOINT RUNNING NOARP  MTU:1480  Metric:1
          RX packets:28 errors:0 dropped:0 overruns:0 frame:0
          TX packets:34 errors:1 dropped:0 overruns:0 carrier:1
          collisions:0 txqueuelen:0
          RX bytes:3657 (3.5 KiB)  TX bytes:3210 (3.1 KiB)

lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:73 errors:0 dropped:0 overruns:0 frame:0
          TX packets:73 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:6560 (6.4 KiB)  TX bytes:6560 (6.4 KiB)

sit0      Link encap:IPv6-in-IPv4
          inet6 addr: ::127.0.0.1/96 Scope:Unknown
          UP RUNNING NOARP  MTU:1480  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

It shall be able to ping google via IPv6 now:
pi@raspberrypi ~ $ ping6 google.com -c4
PING google.com(lhr26s01-in-x0e.1e100.net) 56 data bytes
64 bytes from lhr26s01-in-x0e.1e100.net: icmp_seq=1 ttl=54 time=85.3 ms
64 bytes from lhr26s01-in-x0e.1e100.net: icmp_seq=2 ttl=54 time=85.4 ms
64 bytes from lhr26s01-in-x0e.1e100.net: icmp_seq=3 ttl=54 time=85.4 ms
64 bytes from lhr26s01-in-x0e.1e100.net: icmp_seq=4 ttl=54 time=84.7 ms

--- google.com ping statistics ---
4 packets transmitted, 4 received, 0% packet loss, time 3004ms
rtt min/avg/max/mdev = 84.703/85.244/85.461/0.375 ms

Now we need to set up routing. For home network RADV is more than enough:

Comments

Post a Comment

Popular posts from this blog

Hardening OpenWRT - adding non-root user account

I have at home an OpenWRT on TP-Link 1043ND. As I'm most of the time out of my home, I use this for two functions:  - as reliable WiFi Access Point  - as last resort remote access device  - as a box used to wake up other Ethernet enabled devices @ home. As this box is exposed to Internet via IPv6 address, I decided to harden it a little. 1. Adding extra non privileged user account: root@OpenWrt:~# opkg update root@OpenWrt:~# opkg install shadow-useradd root@OpenWrt:~# mkdir /home root@OpenWrt:~# useradd -D GROUP=100 HOME=/home INACTIVE=-1 EXPIRE= SHELL= SKEL=/etc/skel CREATE_MAIL_SPOOL=no root@OpenWrt:~# useradd -m -s /bin/ash bart root@OpenWrt:~# cat /etc/passwd root:x:0:0:root:/root:/bin/ash daemon:*:1:1:daemon:/var:/bin/false ftp:*:55:55:ftp:/home/ftp:/bin/false network:*:101:101:network:/var:/bin/false nobody:*:65534:65534:nobody:/var:/bin/false bart:x:1000:1000::/home/bart:/bin/ash root@OpenWrt:~# passwd bart Changing password for bart New passw
Read more

Dropbear SSH keys and autossh on OpenWRT

Image
I have a box on Amazon EC2. And I want to have my OpenWRT that is behind IPv4 CGN and have public IPv6 to be reachable from IPv4 Internet. The best idea is to use ssh reverse tunnel connected with autossh to keep connection going. The very first think is to test if I can connect to my Amazon instance from my OpenWRT: root@OpenWrt:~# ssh 54.111.111.111 Host '54.111.111.111' is not in the trusted hosts file. (ssh-rsa fingerprint md5 0f:51:11:11:11:11:11:11:11:11:11:11:11:11:11:11) Do you want to continue connecting? (y/n) y root@54.111.111.111's password: At this point the public key of remote host will be added to .ssh/known_hosts. It is important as we can't have autossh to interact with console in future. root@OpenWrt:~# cat .ssh/known_hosts 2001:1111:1111:1111::1111:1111 ssh-rsa AAAAB3N....... 54.111.111.111 ssh-rsa AAAAB3N.......... Now we need to generate public/private key pair we will be using to connect to our Amazon instance. Invoke fol
Read more

SSH Tunel with OpenWRT

You need to install OpenSSH client: root@OpenWrt:~# opkg update root@OpenWrt:~# opkg install openssh-client Now OpenSSH client replaced DropBear client: root@OpenWrt:~# ls -l /usr/bin/ssh -rwxr-xr-x    1 root     root        590667 May 24 14:54 /usr/bin/ssh root@OpenWrt:~# ls -l /rom/usr/bin/ssh lrwxrwxrwx    1 root     root            16 Aug 19  2016 /rom/usr/bin/ssh -> ../sbin/dropbear root@OpenWrt:~# ls -l /overlay/upper/usr/bin/ssh -rwxr-xr-x    1 root     root        590667 May 24 14:54 /overlay/upper/usr/bin/ssh Can you spot a difference: root@OpenWrt:~# ssh usage: ssh [-1246AaCfGgKkMNnqsTtVvXxYy] [-b bind_address] [-c cipher_spec]            [-D [bind_address:]port] [-E log_file] [-e escape_char]            [-F configfile] [-I pkcs11] [-i identity_file]            [-J [user@]host[:port]] [-L address] [-l login_name] [-m mac_spec]            [-O ctl_cmd] [-o option] [-p port] [-Q query_option] [-R address]            [-S ctl_path] [-W ho
Read more