View source for Funtoo:User Services/IPv6 Tunnel

Some Funtoo Linux datacenters do not have native IPv6 support, so we rely on IPv6 tunnel services provided by he.net.

This page will document how to reliably set up an IPv6 tunnel under Funtoo Linux. This particular configuration is
focused on setting up a ''tunnel router'', which means that it's not just about providing IPv6 to a single server.
Instead, the server we will configure will provide IPv6 for an entire ''bridged network''.

To follow these exact steps, you will need to visit https://tunnelbroker.net and register for an account. This
process is free. You may be required to complete some IPv6 training first. Once you have done this, you should
be able to configure a tunnel, which will have settings similar to this one:

[[File:Tunnelbroker.png|thumb|tunnelbroker.net example tunnel]]

To make sense of the critical settings of this tunnel, let's talk a bit about how this IPv6 tunnel works. For those who are impatient, here is the actual file we will use to bring up the tunnel -- but please note that ''additional configuration is required'' to get the tunnel working properly!

{{file|lang=bash|name=/etc/netif.d/ipv6-tunnel-router|body=
#!/bin/sh

netif_pre_up() {
    try ip tunnel add $interface mode sit remote $endpoint_remote local $endpoint_local ttl 255
    try ip link set $interface up
    try ip addr add $tunnel_local_ipv6 dev $interface
}

netif_post_up() {
    # all IPv6 traffic should go out the tunnel:
    try ip route add ::/0 dev $interface
    # ...except traffic to our assigned IPv6 block, which all sits on $route_interface:
    try ip route add $route_assigned_block dev $route_interface
}

netif_pre_down() {
    ip route del $route_assigned_block dev $route_interface
    ip route del ::/0 dev $interface
}

netif_post_down() {
    ip tunnel del $interface
}
}}

Since we don't have IPv6, and are relying on IPv4 to create our tunnel, we need to
link both ends of the tunnel. The tunnelbroker.net end is the "Server IPv4 Address" ({{c|$endpoint_remote}}, above), and our end is the "Client IPv4 Address" {{c|$endpoint_local}}, above. The tunnel will be used to shuffle IPv6 traffic to and from our IPv6 router system. On our IPv6 router system, we will set up {{c|radvd}}, which is the IPv6 ''router advertisement daemon'', and is a key piece of IPv6 local daemon infrastructure to inform your network of what IPv6 addresses are available. It works similar to DHCP for IPv4 in that it allows all your local network devices to acquire an IPv6 addresses.

Tunnelbroker.net gives us a "slash 64" (/64), which is a block of 2^64 IPv6 addresses. All these addresses are expected to exist on "our side" of the tunnel. These are "our" IPv6 addresses, and radvd advertises them so that they are available to all your network devices.

On our Funtoo IPv6 tunnel router system, we are going to rely on a network interface. In our specific example, it is {{c|brwan}}, which is a network bridge, but it could also be a physical interface like {{c|eth0}}, which is plugged into a physical switch that has all your other LAN devices attached. We are going to configure our system to essentially be a gateway for this IPv6 network. Here is some ASCII art which may help you:

<pre>
[ tunnelbroker.net ]                                 [ our server ]

<-- remote endpoint ------Tunnel IPv6 Network------ local endpoint -->
                                                    <-- brwan ------------------Our Routed /64 network-----------------> our devices
</pre>

To make things even more confusing, please note there are ''two'' IPv6 networks. The ''second'' IPv6 network is used exclusively by the tunnel itself. Then we have our local IPv6 network we are setting up, which consists of {{c|brwan}}, {{c|radvd}}, and our connected devices. This is a frequent source of confusion. Often, the IPv6 addresses look very similar, so as we continue, be sure to understand the concepts well so you don't mix them
up!

{{file|name=/etc/radvd.conf|body=
interface brwan {
        AdvSendAdvert on;
        AdvHomeAgentFlag off;
        MinRtrAdvInterval 30;
        MaxRtrAdvInterval 100;
        prefix 2001:470:1f0f:24b::/64 { 
            AdvOnLink on; 
            AdvAutonomous on; 
            AdvRouterAddr on; 
        };
};
}}

Above, we configure {{f|/etc/radvd.conf}} to advertise our routed /64 to our LAN. Note that the address we use is the "Routed /64" from the tunnelbroker.net page.

Next, equally critical, we want to configure {{c|netif.brwan}} to use the '''first''' address of the Routed /64 range. Please note that this
address does '''not''' appear on the tunnelbroker.net page, even though one looks a lot like it. You construct this IPv6 address by taking the
"Routed /64" and adding a "::1" so that your local network device has the '''first''' address in your Routed /64 range.

{{file|lang=bash|name=/etc/conf.d/netif.brwan|body=
template=bridge
slaves=netif.eth0
# see https://ipv6.he.net/presentations/ra-radvd.pdf page 5 -- we want the first IP in our
# routed range to be on the LAN interface of the router. Please note that the IPv6 address
# we add here is NOT what you assume -- you take the **Routed /64** and add a {{c|::1}},
# so this is the FIRST address of your private routed /64. It is NOT the server IPv6 address,
# which is the tunnelbroker.net side of the tunnel. Instead, it is the FIRST address from
# the routed /64 that radvd is advertising for us. This is ESSENTIAL so that responses can
# be received by radvd to router advertisements. Otherwise, your devices will get IPv6 
# addresses but they will lose their address in a few minutes due to inability to communicate
# with radvd.
ipaddr="172.97.103.202/24 2001:470:1f0f:24b::1/64"
gateway=172.97.103.1
nameservers="1.1.1.1 1.0.0.1"
domain=funtoo.org
multicast=no
}}

If you were using {{c|eth0}} plugged into a shared switch, your configuration would look something like this instead:


{{file|lang=bash|name=/etc/conf.d/netif.eth0|body=
template=interface
# see https://ipv6.he.net/presentations/ra-radvd.pdf page 5 -- we want the first IP in our
# routed range to be on the LAN interface of the router. Please note that the IPv6 address
# we add here is NOT what you assume -- you take the **Routed /64** and add a {{c|::1}},
# so this is the FIRST address of your private routed /64. It is NOT the server IPv6 address,
# which is the tunnelbroker.net side of the tunnel. Instead, it is the FIRST address from
# the routed /64 that radvd is advertising for us. This is ESSENTIAL so that responses can
# be received by radvd to router advertisements. Otherwise, your devices will get IPv6 
# addresses but they will lose their address in a few minutes due to inability to communicate
# with radvd.
ipaddr="172.97.103.202/24 2001:470:1f0f:24b::1/64"
gateway=172.97.103.1
nameservers="1.1.1.1 1.0.0.1"
domain=funtoo.org
multicast=no
}}