Comments on: IPv6 – Proxy the neighbors (or come back ARP – we loved you really)

By: rene

rene — Mon, 23 Jan 2012 20:47:55 +0000

I used to route a PA (provider assigned) IPv4 range through a server of mine via openVPN to my home system where it was used on the internal lan. After initial setup it worked great. Systems in the home lan have public addresses from that range and it worked – after activating proxy_arp on the server.

Of course doing the same thing with IPv6 now fails – no more arp and proxy_ndp doesn’t really work satisfactorily. Luckily, I found this page, got npd6, activated it and bam, without any further change on my side everything works. Now I route an IPv6 range through my server into my lan and used radv successfully to configure windows machines.

The whole configuration of this not so common setup is pretty similar between IPv4 and IPv6, for the routing parts. The only difference, but a major one and absolutely unexpected, the problem with neighbor solicitation/proxying.

By: sgroarke

sgroarke — Fri, 05 Aug 2011 06:06:12 +0000

Right – well I guess the issues is less radvd, but the who auto-config mechanism itself which gets used by the clients. While I use radvd, I’ve pondered playing with DHCP6 but not been silly enough yet. Maybe.

By: sgroarke

sgroarke — Fri, 05 Aug 2011 06:05:00 +0000

Looking at this + your earlier comment that you didn’t have the proxy issue described here suggests your ISP is doing things differently – which is hugely possible!! What would be interesting is to tcpdump the WAN interface during your scenarios and understand what it’s up to. Plus also check the ipv6 neighbor associations which come and go dynamically during this.

By: sgroarke

sgroarke — Fri, 22 Jul 2011 14:19:15 +0000

EDIT: 22 July – The project has really taken shape. Version 0.3 is now useful enough to be considered a working beta version. Building is very simple – do please try it out and let me know of any issues, good or bad.

Check out the project via my article here: http://www.ipsidixit.net/2011/07/05/npd6-ipv6-neighbor-proxy-daemon-it-lives/

If you’ve had issues in the area described in the main article above and are using a Linux box as a gateway, hop over to the Google-code hosted project and help out by testing it.

By: Yingfei Zhang

Yingfei Zhang — Wed, 20 Jul 2011 13:04:31 +0000

This blog is really helpful to me, solved my problem. Thank you

By: sgroarke

sgroarke — Tue, 05 Jul 2011 21:44:57 +0000

** IMPORTANT UPDATE ** npd6 - Neighbor Proxy Daemon IPv6 lives! See article.

By: rufo

rufo — Thu, 30 Jun 2011 02:43:47 +0000

Here’s a perl script I wrote to automatically configure this for KVM guests, hopefully it will save somebody some time.

#!/usr/bin/perl

@l = `ps aux|grep kvm`;

for($i=0; $i {
system(sprintf("/sbin/ip -6 neigh add proxy your:prefix:goes:here:%02x%s:%sff:fe%s:%s%s dev br0 \n", hex($1)^2, $2, $3, $4, $5, $6))
if(@l[$i] =~ /mac=([0-9a-f]{2}):([0-9a-f]{2}):([0-9a-f]{2}):([0-9a-f]{2}):([0-9a-f]{2}):([0-9a-f]{2})/i);
}

By: Bill

Bill — Fri, 10 Jun 2011 12:22:22 +0000

Bridging seems to me to be the only solution, as my ISP won’t route upstream traffic or honor RA’s, so *something* has to respond to NDP queries on our port. Essentially, I’m trying to build a transparent firewall, so the bridge will firewall for the inside machines.

I feel like I’m tantalizingly close to getting this working. From the bridge machine, I can ping either inside or outside, both by LL and global addresses. Once I do this, the inside machines can ping at least the bridge, but no further, though once the bridge’s NDP info expires, the neighbors can’t ping anything. The bridge is learning MAC addresses from both sides, and when I configure an IPv4 address on it, it also responds to ARP queries, but no traffic passes across the bridge.

Virtually all of the examples of creating a bridge are for IPv4, and are usually in some way incomplete. For instance, nothing really worked at all until I set the MAC address of the bridge, which has the effect of also setting the MAC addresses of the interfaces to the same address. No examples are really clear about exactly which sysctl options are necessary.

I’m considering using shorewall6, as it claims to also support bridging, but I’m pretty comfortable using ip(6)tables, so don’t really need it, other than to the degree that it makes things magically work. I don’t like magic…

By: sgroarke

sgroarke — Wed, 08 Jun 2011 19:40:06 +0000

IPv6 bridging…. gadzooks. I’m still up to my neck with the routing side. Of course, bridging should, conceptually, be simple! But just as with IPv4, there’s a whole host of gotchas, I guess. I have to say that I’m keeping away from bridging in IPv6 for now – so can’t report any suggestions.

One question from my side that occurs is about security: if you bridge the ISP’s IPv6 into your private network(s) (you mentioned VLANs…) will you firewall each inside machine? Or do some sort of L2 firewall on the bridge (I guess raw ip6tables unless there’s some funky front-end?)? Or…? For me, one reason to avoid bridging the ISP’s IPv6 is so I can easily use something like shorewall6 to run my firewall. Interested to hear about security architecture with a bridged IPv6 WAN. Interesting stuff!!!

By: Bill

Bill — Tue, 07 Jun 2011 18:01:19 +0000

Interesting article. I’m having a very frustrating time getting an IPv6 bridge set up on Ubuntu (via bridge-utils), and am basically running into similar problems with NDP. I’m sure my issues are beyond the scope of what can be dealt with this way, but the general issues are:
1. Lack of knowledge on the part of ISP’s. My /64 is the first one our (hosting) ISP has doled-out.
2. Lack of thought as to how customers would use their /64′s by the ISP. From their standpoint, they give me my /64, and their job is done. For instance, what makes the most sense, a router or a bridge?
3. Equipment issues. Not everyone can afford to go out and buy new, IPv6-capable (Cisco) hardware. Hence why I’m trying to get an Ubuntu VM up to do bridging (via VLANs).
4. Most useful examples are either for tunneling setups (which are easy to get working – I’ve done it), or for single-host native setups. How about just one, useful example of getting a fully-functional, native IPv6 bridge working?

FWIW, I can ping from my bridge both outside (e.g. to ipv6.google.com) and to inside machines, but inside machines don’t see NDP queries, and the bridge can’t see NDP queries from the inside interface, so the outside world can be reached from inside. All ebtables/ip6tables rules are default, so all traffic should be accepted. tcpdump reports nothing working from the inside.

I may try to set up an IPv4 bridge first, make sure I have all of the VLAN/VM nonsense out of the way, and then try again with IPv6. (I’m pretty sure the VLANs are OK, and I can ping6 OK between VM’s OK on the inside segment).