Difference between revisions of "IPv6 tunnel broker setup"

From ArchWiki
Jump to: navigation, search
(Fixed the config. (Forgott a {)
m (sixxs has retired)
 
(29 intermediate revisions by 15 users not shown)
Line 1: Line 1:
 
[[Category:Networking]]
 
[[Category:Networking]]
 +
[[ja:IPv6 トンネルブローカー設定]]
 
Hurricane Electric offers a free [http://tunnelbroker.net/ tunnel broker] service that is relatively painless to use under Arch if you wish to add IPv6 connectivity to an IPv4-only host.
 
Hurricane Electric offers a free [http://tunnelbroker.net/ tunnel broker] service that is relatively painless to use under Arch if you wish to add IPv6 connectivity to an IPv4-only host.
 
These instructions work for [http://www.sixxs.net/ SixXS] tunnels as well.
 
  
 
== Registering for a tunnel ==
 
== Registering for a tunnel ==
Line 8: Line 7:
 
It is not that hard to do. Feel free to fill in the directions here if something seems tricky, but otherwise just go the tunnel broker site and complete the registration.
 
It is not that hard to do. Feel free to fill in the directions here if something seems tricky, but otherwise just go the tunnel broker site and complete the registration.
  
== Setting up SiXxs tunnel ==  
+
== Setting up Hurricane Electric tunnel ==
 +
Create the following systemd unit, replacing bold text with the IP addresses you got from HE:
  
First, you need to have {{Pkg|aiccu}}, {{Pkg|radvd}} and iproute2 installed.
+
{{Note|If you are behind a NAT (typical home router setup), use your ''local'' IPv4 address for {{ic|'''Client_IPv4_Address'''}}, e.g. {{ic|192.168.0.2}}.}}
  
# pacman -S aiccu radvd iproute2
+
{{hc|/etc/systemd/system/he-ipv6.service|2=
 +
[Unit]
 +
Description=he.net IPv6 tunnel
 +
After=network.target
  
Now edit {{ic|/etc/aiccu.conf}} and fill in your data.
+
[Service]
If you have several tunnels, you need to also supplement the tunnel_id option in the file.
+
Type=oneshot
The following is an example for a dynamic ayiay tunnel.
+
RemainAfterExit=yes
 +
ExecStart=/usr/bin/ip tunnel add he-ipv6 mode sit remote '''Server_IPv4_Address''' local '''Client_IPv4_Address''' ttl 255
 +
ExecStart=/usr/bin/ip link set he-ipv6 up mtu 1480
 +
ExecStart=/usr/bin/ip addr add '''Client_IPv6_Address''' dev he-ipv6
 +
ExecStart=/usr/bin/ip -6 route add ::/0 dev he-ipv6
 +
ExecStop=/usr/bin/ip -6 route del ::/0 dev he-ipv6
 +
ExecStop=/usr/bin/ip link set he-ipv6 down
 +
ExecStop=/usr/bin/ip tunnel del he-ipv6
  
{{bc|<nowiki>
+
[Install]
username <username>
+
WantedBy=multi-user.target
password <password>
+
}}
protocol tic
 
server tic.sixxs.net
 
ipv6_interface sixxs
 
automatic true
 
requiretls true
 
pidfile /var/run/aiccu.pid
 
defaultroute true
 
makebeats true
 
behindnat true
 
</nowiki>}}
 
  
Test the configuration now with:
+
Then start/enable {{ic|he-ipv6.service}}.
# systemctl start aiccu
 
If it works, enable it:
 
# systemctl enable aiccu
 
  
Configuring radvd and LAN side IP of the router:
+
== systemd-networkd ==
See [[Router#IPv6|Router]]
 
  
== Tunnel rc.d script ==
+
If [[systemd-networkd]] handles your network connections, it's probably a better idea to let it handle tunnel broker too (instead of using a {{ic|.service}} file).
  
For this script to work you will need the iproute2 package installed:
+
{{hc|/etc/systemd/network/he-tunnel.netdev|<nowiki>
 +
[Match]
 +
 +
[NetDev]
 +
Name=he-ipv6
 +
Kind=sit
 +
MTUBytes=1480
 +
 +
[Tunnel]
 +
Local=<local IPv4>
 +
Remote=<tunnel endpoint>
 +
TTL=255
 +
</nowiki>}}
  
  # pacman -S iproute2
+
{{hc|/etc/systemd/network/he-tunnel.network|<nowiki>
 +
[Match]
 +
Name=he-ipv6
 +
   
 +
[Network]
 +
Address=<local IPv6>
 +
Gateway=<IPv6 gateway>
 +
DNS=2001:4860:4860::8888
 +
DNS=2001:4860:4860::8844
 +
</nowiki>}}
  
Try the following init script to start and stop an IPv6 tunnel once you have registered it with HE. I placed this at {{ic|/etc/rc.d/6in4-tunnel}}. Obviously some of the variables up top will need to be filled in.
+
And, add this line to {{ic|[Network]}} section of your default Internet connection {{ic|.network}} file:
  
'''For DSL users the link_mtu should be set to 1472'''
+
Tunnel=he-ipv6
  
{{bc|<nowiki>
+
== Using the tunneling with dynamic IPv4 IP ==
#!/bin/bash
 
  
if_name=he6in4
+
The simplest way of using tunelling with a dynamic IPv4 IP is to set up a cronjob that is going to periodically update your current address. To do that open {{ic|crontab -e}} and add, in a new line:
  
# "Server IPv4 Address" under "IPv6 Tunnel Endpoints" on HE tunnel details page
+
{{bc|<nowiki>
server_ipv4=''
+
*/10 * * * * wget -O /dev/null https://USERNAME:PASSWORD@ipv4.tunnelbroker.net/ipv4_end.php?tid=TUNNELID >> /dev/null 2>&1
 
 
# Your local IP. NOTE: when behind a NAT (even with DMZ),
 
# use an address of your LOCAL machine, NOT the ROUTER one.
 
client_ipv4=''
 
 
 
# Your HE-assigned client IP, "Client IPv6 Address" on HE tunnel details page
 
client_ipv6=''
 
 
 
link_mtu=1480
 
tunnel_ttl=255
 
 
 
daemon_name=6in4-tunnel
 
 
 
. /etc/rc.conf
 
. /etc/rc.d/functions
 
 
 
case "$1" in
 
  start)
 
    stat_busy "Starting $daemon_name daemon"
 
 
 
    ifconfig $if_name &>/dev/null
 
    if [ $? -eq 0 ]; then
 
      stat_busy "Interface $if_name already exists"
 
      stat_fail
 
      exit 1
 
    fi
 
 
 
    # Note from Lekensteyn: removing "local $client_ipv4" seems to work too!
 
    ip tunnel add $if_name mode sit remote $server_ipv4 local $client_ipv4 ttl $tunnel_ttl
 
    ip link set $if_name up mtu $link_mtu
 
    ip addr add $client_ipv6 dev $if_name
 
    ip route add ::/0 dev $if_name
 
    # Here is how you would add additional ips....which should be on the eth0 interface
 
    # "Routed IPv6 Prefixes" on HE tunnel details page
 
    # ip addr add 2001:XXXX:XXXX:beef:beef:beef:beef:1/64 dev eth0
 
    # ip addr add 2001:XXXX:XXXX:beef:beef:beef:beef:2/64 dev eth0
 
    # ip addr add 2001:XXXX:XXXX:beef:beef:beef:beef:3/64 dev eth0
 
 
 
    add_daemon $daemon_name
 
    stat_done
 
    ;;
 
 
 
  stop)
 
    stat_busy "Stopping $daemon_name daemon"
 
 
 
    ifconfig $if_name &>/dev/null
 
    if [ $? -ne 0 ]; then
 
      stat_busy "Interface $if_name does not exist"
 
      stat_fail
 
      exit 1
 
    fi
 
 
 
    ip link set $if_name down
 
    ip tunnel del $if_name
 
    # Here is how you would del additional ips... if you added them to eth0 interface
 
    # ip addr del 2001:XXXX:XXXX:beef:beef:beef:beef:1/64 dev eth0
 
    # ip addr del 2001:XXXX:XXXX:beef:beef:beef:beef:2/64 dev eth0
 
    # ip addr del 2001:XXXX:XXXX:beef:beef:beef:beef:3/64 dev eth0
 
 
 
    rm_daemon $daemon_name
 
    stat_done
 
    ;;
 
 
 
  *)
 
    echo "usage: $0 {start|stop}"
 
esac
 
exit 0
 
 
</nowiki>}}
 
</nowiki>}}
  
== Start tunnel at boot time ==
+
Which should also make wget quiet and not bothering you with emails about its activity. Please replace USERNAME, PASSWORD and TUNNELID by the details of your account and tunnel. I would recommend running the command on its own first, to check if it works. To do that run:
Once you have that all setup how you want you will need to add {{ic|6in4-tunnel}} to your {{ic|/etc/rc.conf}} file:
 
{{bc|1=
 
DAEMONS=(... 6in4-tunnel ...)
 
}}
 
  
== Using the tunneling with dynamic IPv4 IP ==
+
{{bc|<nowiki>
The simplest way of using tunelling with a dynamic IPv4 IP is to set up a cronjob that is going to periodically update your current address.
 
To do that open {{ic|crontab -e}} and add, in a new line:
 
{{bc|1=
 
*/10 * * * * wget -O /dev/null https://USERNAME:PASSWORD@ipv4.tunnelbroker.net/ipv4_end.php?tid=TUNNELID >> /dev/null 2>&1
 
}}
 
Which should also make wget quiet and not bothering you with emails about its activity. Please replace USERNAME, PASSWORD and TUNNELID by the details of your account and tunnel. I would recommend running the command on its own first, to check if it works. To do that run:
 
{{bc|1=
 
 
wget https://USERNAME:PASSWORD@ipv4.tunnelbroker.net/ipv4_end.php?tid=TUNNELID
 
wget https://USERNAME:PASSWORD@ipv4.tunnelbroker.net/ipv4_end.php?tid=TUNNELID
}}
+
</nowiki>}}

Latest revision as of 16:58, 9 June 2017

Hurricane Electric offers a free tunnel broker service that is relatively painless to use under Arch if you wish to add IPv6 connectivity to an IPv4-only host.

Registering for a tunnel

It is not that hard to do. Feel free to fill in the directions here if something seems tricky, but otherwise just go the tunnel broker site and complete the registration.

Setting up Hurricane Electric tunnel

Create the following systemd unit, replacing bold text with the IP addresses you got from HE:

Note: If you are behind a NAT (typical home router setup), use your local IPv4 address for Client_IPv4_Address, e.g. 192.168.0.2.
/etc/systemd/system/he-ipv6.service
[Unit]
Description=he.net IPv6 tunnel
After=network.target

[Service]
Type=oneshot
RemainAfterExit=yes
ExecStart=/usr/bin/ip tunnel add he-ipv6 mode sit remote Server_IPv4_Address local Client_IPv4_Address ttl 255
ExecStart=/usr/bin/ip link set he-ipv6 up mtu 1480
ExecStart=/usr/bin/ip addr add Client_IPv6_Address dev he-ipv6
ExecStart=/usr/bin/ip -6 route add ::/0 dev he-ipv6
ExecStop=/usr/bin/ip -6 route del ::/0 dev he-ipv6
ExecStop=/usr/bin/ip link set he-ipv6 down
ExecStop=/usr/bin/ip tunnel del he-ipv6

[Install]
WantedBy=multi-user.target

Then start/enable he-ipv6.service.

systemd-networkd

If systemd-networkd handles your network connections, it's probably a better idea to let it handle tunnel broker too (instead of using a .service file).

/etc/systemd/network/he-tunnel.netdev
[Match]
 
[NetDev]
Name=he-ipv6
Kind=sit
MTUBytes=1480
 
[Tunnel]
Local=<local IPv4>
Remote=<tunnel endpoint>
TTL=255
/etc/systemd/network/he-tunnel.network
[Match]
Name=he-ipv6
 
[Network]
Address=<local IPv6>
Gateway=<IPv6 gateway>
DNS=2001:4860:4860::8888
DNS=2001:4860:4860::8844

And, add this line to [Network] section of your default Internet connection .network file:

Tunnel=he-ipv6

Using the tunneling with dynamic IPv4 IP

The simplest way of using tunelling with a dynamic IPv4 IP is to set up a cronjob that is going to periodically update your current address. To do that open crontab -e and add, in a new line:

*/10 * * * * wget -O /dev/null https://USERNAME:PASSWORD@ipv4.tunnelbroker.net/ipv4_end.php?tid=TUNNELID >> /dev/null 2>&1

Which should also make wget quiet and not bothering you with emails about its activity. Please replace USERNAME, PASSWORD and TUNNELID by the details of your account and tunnel. I would recommend running the command on its own first, to check if it works. To do that run:

wget https://USERNAME:PASSWORD@ipv4.tunnelbroker.net/ipv4_end.php?tid=TUNNELID