jb_alvarado
Lieutenant
- Registriert
- Sep. 2015
- Beiträge
- 553
Hallo Allerseits,
gleich zu Anfang: mein Wissen bezüglich IPv6 ist leider noch recht rudimentär...
Ich würde gerne auf einem (debian) Server für einzelne VMs IPv6 verfügbar machen. Dazu habe ich folgende Bedingungen:
Bridge ist so eingerichtete:
Interface der VM schaut so aus:
nftables forward chain ist für ipv6 in etwa so konfiguriert:
Habe noch eine postrouting chain, aber ob ich dort auch ein SNAT für IPv6 brauche, weiß ich nicht genau.
Wenn ich jetzt von Außerhalb auf die VM IP pinge, meckert die Firewall nicht. Auf dem Server schaut tcpdump so aus:
Auf der VM kommt nach kurzer Verzögerung das an:
Allerdings bekommt mein Dienst von dem ich aus pinge keine Antwort Pakete. Auch wenn ich direkt aus der VM heraus pinge habe ich 100% Paketverlust, kann aber auf dem Server mit tcpdump Traffic sehen.
Dump schaut so aus:
Ich denke das die Pakete aus dem VM Netz nicht richtig hinaus geroutet werden.
Hab ihr mir hier ein paar Tipps, wie ich das beheben kann?
gleich zu Anfang: mein Wissen bezüglich IPv6 ist leider noch recht rudimentär...
Ich würde gerne auf einem (debian) Server für einzelne VMs IPv6 verfügbar machen. Dazu habe ich folgende Bedingungen:
- Interface mit welchem der Server mit der Außenwelt kommuniziert
$dev_wan
- Ein VLan Interface für vSwitch
- an dem VLan hängt ein Bridge Interface für die VMs
$dev_wan
ist so eingerichtet:
Code:
iface eno1 inet6 static
address xxxx:xxxx:xxx:xxxx::2
netmask 64
gateway fe80::1
Bridge ist so eingerichtete:
Code:
iface br2 inet6 static
address xxxx:xxxx:xxx:xxxx::3
netmask 64
Interface der VM schaut so aus:
Code:
iface enp1s0 inet6 static
address xxxx:xxxx:xxx:xxxx::4
netmask 64
gateway xxxx:xxxx:xxx:xxxx::3
/etc/sysctl.conf
ist wie folgend konfiguriert:
Code:
net.ipv4.ip_forward=1
net.ipv6.conf.all.forwarding=1
net.ipv4.conf.all.accept_source_route = 1
net.ipv6.conf.all.accept_source_route = 1
nftables forward chain ist für ipv6 in etwa so konfiguriert:
Code:
chain forward {
type filter hook forward priority 0; policy drop;
iifname $dev_wan oifname $vm_bridge ip6 daddr $vm_net6 ct state { established, related } accept
iifname $vm_bridge oifname $dev_wan ip6 saddr $vm_net6 accept comment "allow traffic from vm bridge to wan"
iifname $vm_bridge oifname $vm_bridge accept
iifname $dev_wan ip6 daddr "xxx:xxxx:xxx:xxxx::4" accept
log prefix "drop forward " group 0 drop
}
Habe noch eine postrouting chain, aber ob ich dort auch ein SNAT für IPv6 brauche, weiß ich nicht genau.
Code:
chain postrouting {
type nat hook postrouting priority 100; policy accept;
ip saddr $vm_net4 oifname $dev_wan snat $wan_ipv4
ip6 saddr $vm_net6 oifname $dev_wan snat $wan_ipv6
}
Wenn ich jetzt von Außerhalb auf die VM IP pinge, meckert die Firewall nicht. Auf dem Server schaut tcpdump so aus:
Code:
tcpdump -n -vv ICMP6
tcpdump: listening on eno1, link-type EN10MB (Ethernet), snapshot length 262144 bytes
10:21:11.481616 IP6 (flowlabel 0xe9512, hlim 57, next-header ICMPv6 (58) payload length: 64) 2a0b:4d07:101:10::1 > xxxx:xxxx:xxx:xxxx::4: [icmp6 sum ok] ICMP6, echo request, id 30784, seq 1
10:21:11.481667 IP6 (hlim 255, next-header ICMPv6 (58) payload length: 32) fe80::b62e:99ff:fecd:4f4 > ff02::1:ff00:4: [icmp6 sum ok] ICMP6, neighbor solicitation, length 32, who has xxxx:xxxx:xxx:xxxx::4
source link-address option (1), length 8 (1): b4:2e:99:cd:04:f4
0x0000: b42e 99cd 04f4
10:21:11.912724 IP6 (flowlabel 0xe9512, hlim 57, next-header ICMPv6 (58) payload length: 64) 2a0b:4d07:101:10::1 > xxxx:xxxx:xxx:xxxx::4: [icmp6 sum ok] ICMP6, echo request, id 30784, seq 2
10:21:12.324695 IP6 (flowlabel 0xe9512, hlim 57, next-header ICMPv6 (58) payload length: 64) 2a0b:4d07:101:10::1 > xxxx:xxxx:xxx:xxxx::4: [icmp6 sum ok] ICMP6, echo request, id 30784, seq 3
10:21:12.501239 IP6 (hlim 255, next-header ICMPv6 (58) payload length: 32) fe80::b62e:99ff:fecd:4f4 > ff02::1:ff00:4: [icmp6 sum ok] ICMP6, neighbor solicitation, length 32, who has xxxx:xxxx:xxx:xxxx::4
source link-address option (1), length 8 (1): b4:2e:99:cd:04:f4
0x0000: b42e 99cd 04f4
Auf der VM kommt nach kurzer Verzögerung das an:
Code:
tcpdump -n -vv icmp6
tcpdump: listening on enp1s0, link-type EN10MB (Ethernet), snapshot length 262144 bytes
09:15:18.456139 IP6 (hlim 255, next-header ICMPv6 (58) payload length: 32) fe80::4f2:2eff:fe37:a164 > ff02::1:ff00:1: [icmp6 sum ok] ICMP6, neighbor solicitation, length 32, who has fe80::1
source link-address option (1), length 8 (1): 06:f2:2e:37:a1:64
0x0000: 06f2 2e37 a164
09:15:19.484306 IP6 (hlim 255, next-header ICMPv6 (58) payload length: 32) fe80::4f2:2eff:fe37:a164 > ff02::1:ff00:1: [icmp6 sum ok] ICMP6, neighbor solicitation, length 32, who has fe80::1
source link-address option (1), length 8 (1): 06:f2:2e:37:a1:64
0x0000: 06f2 2e37 a164
Allerdings bekommt mein Dienst von dem ich aus pinge keine Antwort Pakete. Auch wenn ich direkt aus der VM heraus pinge habe ich 100% Paketverlust, kann aber auf dem Server mit tcpdump Traffic sehen.
Dump schaut so aus:
Code:
tcpdump -n -vv icmp6
tcpdump: listening on eno1, link-type EN10MB (Ethernet), snapshot length 262144 bytes
11:38:45.430436 IP6 (hlim 255, next-header ICMPv6 (58) payload length: 32) xxxx:xxxx:xxx:xxxx::2 > ff02::1:ff00:1: [icmp6 sum ok] ICMP6, neighbor solicitation, length 32, who has fe80::1
source link-address option (1), length 8 (1): b4:2e:99:cd:04:f4
0x0000: b42e 99cd 04f4
11:38:45.431032 IP6 (class 0xc0, hlim 255, next-header ICMPv6 (58) payload length: 32) 2a01:4f8::a:25:b > xxxx:xxxx:xxx:xxxx::2: [icmp6 sum ok] ICMP6, neighbor advertisement, length 32, tgt is fe80::1, Flags [router, solicited, override]
destination link-address option (2), length 8 (1): e8:a2:45:df:aa:07
0x0000: e8a2 45df aa07
11:38:45.431060 IP6 (flowlabel 0x256b3, hlim 63, next-header ICMPv6 (58) payload length: 64) xxxx:xxxx:xxx:xxxx::2 > 2a00:1450:4001:82a::200e: [icmp6 sum ok] ICMP6, echo request, id 14304, seq 1
11:38:45.436164 IP6 (flowlabel 0x256b3, hlim 60, next-header ICMPv6 (58) payload length: 64) 2a00:1450:4001:82a::200e > xxxx:xxxx:xxx:xxxx::2: [icmp6 sum ok] ICMP6, echo reply, id 14304, seq 1
11:38:45.436217 IP6 (hlim 255, next-header ICMPv6 (58) payload length: 32) fe80::b62e:99ff:fecd:4f4 > ff02::1:ff00:4: [icmp6 sum ok] ICMP6, neighbor solicitation, length 32, who has xxxx:xxxx:xxx:xxxx::4
source link-address option (1), length 8 (1): b4:2e:99:cd:04:f4
0x0000: b42e 99cd 04f4
11:38:46.457192 IP6 (flowlabel 0x256b3, hlim 63, next-header ICMPv6 (58) payload length: 64) xxxx:xxxx:xxx:xxxx::2 > 2a00:1450:4001:82a::200e: [icmp6 sum ok] ICMP6, echo request, id 14304, seq 2
11:38:46.462321 IP6 (flowlabel 0x256b3, hlim 60, next-header ICMPv6 (58) payload length: 64) 2a00:1450:4001:82a::200e > xxxx:xxxx:xxx:xxxx::2: [icmp6 sum ok] ICMP6, echo reply, id 14304, seq 2
11:38:46.471899 IP6 (hlim 255, next-header ICMPv6 (58) payload length: 32) fe80::b62e:99ff:fecd:4f4 > ff02::1:ff00:4: [icmp6 sum ok] ICMP6, neighbor solicitation, length 32, who has xxxx:xxxx:xxx:xxxx::4
source link-address option (1), length 8 (1): b4:2e:99:cd:04:f4
0x0000: b42e 99cd 04f4
11:38:47.481182 IP6 (flowlabel 0x256b3, hlim 63, next-header ICMPv6 (58) payload length: 64) xxxx:xxxx:xxx:xxxx::2 > 2a00:1450:4001:82a::200e: [icmp6 sum ok] ICMP6, echo request, id 14304, seq 3
11:38:47.486281 IP6 (flowlabel 0x256b3, hlim 60, next-header ICMPv6 (58) payload length: 64) 2a00:1450:4001:82a::200e > xxxx:xxxx:xxx:xxxx::2: [icmp6 sum ok] ICMP6, echo reply, id 14304, seq 3
11:38:47.495877 IP6 (hlim 255, next-header ICMPv6 (58) payload length: 32) fe80::b62e:99ff:fecd:4f4 > ff02::1:ff00:4: [icmp6 sum ok] ICMP6, neighbor solicitation, length 32, who has xxxx:xxxx:xxx:xxxx::4
source link-address option (1), length 8 (1): b4:2e:99:cd:04:f4
0x0000: b42e 99cd 04f4
11:38:48.505036 IP6 (flowlabel 0x256b3, hlim 63, next-header ICMPv6 (58) payload length: 64) xxxx:xxxx:xxx:xxxx::2 > 2a00:1450:4001:82a::200e: [icmp6 sum ok] ICMP6, echo request, id 14304, seq 4
11:38:48.510161 IP6 (flowlabel 0x256b3, hlim 60, next-header ICMPv6 (58) payload length: 64) 2a00:1450:4001:82a::200e > xxxx:xxxx:xxx:xxxx::2: [icmp6 sum ok] ICMP6, echo reply, id 14304, seq 4
11:38:48.515933 IP6 (flowlabel 0x2484e, hlim 64, next-header ICMPv6 (58) payload length: 112) xxxx:xxxx:xxx:xxxx::2 > 2a00:1450:4001:82a::200e: [icmp6 sum ok] ICMP6, destination unreachable, unreachable address xxxx:xxxx:xxx:xxxx::2
11:38:48.515951 IP6 (flowlabel 0x2484e, hlim 64, next-header ICMPv6 (58) payload length: 112) xxxx:xxxx:xxx:xxxx::2 > 2a00:1450:4001:82a::200e: [icmp6 sum ok] ICMP6, destination unreachable, unreachable address xxxx:xxxx:xxx:xxxx::2
11:38:48.515965 IP6 (flowlabel 0x2484e, hlim 64, next-header ICMPv6 (58) payload length: 112) xxxx:xxxx:xxx:xxxx::2 > 2a00:1450:4001:82a::200e: [icmp6 sum ok] ICMP6, destination unreachable, unreachable address xxxx:xxxx:xxx:xxxx::2
11:38:48.515973 IP6 (flowlabel 0x2484e, hlim 64, next-header ICMPv6 (58) payload length: 112) xxxx:xxxx:xxx:xxxx::2 > 2a00:1450:4001:82a::200e: [icmp6 sum ok] ICMP6, destination unreachable, unreachable address xxxx:xxxx:xxx:xxxx::2
11:38:48.580748 IP6 (hlim 255, next-header ICMPv6 (58) payload length: 32) fe80::eaa2:4500:df:aff8 > ff02::1:ff00:3: [icmp6 sum ok] ICMP6, neighbor solicitation, length 32, who has xxxx:xxxx:xxx:xxxx::3
source link-address option (1), length 8 (1): e8:a2:45:df:af:b8
0x0000: e8a2 45df afb8
11:38:48.780503 IP6 (hlim 255, next-header ICMPv6 (58) payload length: 32) fe80::eaa2:4500:df:aff8 > ff02::1:ff00:3: [icmp6 sum ok] ICMP6, neighbor solicitation, length 32, who has xxxx:xxxx:xxx:xxxx::3
source link-address option (1), length 8 (1): e8:a2:45:df:af:b8
0x0000: e8a2 45df afb8
11:38:49.797881 IP6 (hlim 255, next-header ICMPv6 (58) payload length: 32) fe80::eaa2:4500:df:aff8 > ff02::1:ff00:3: [icmp6 sum ok] ICMP6, neighbor solicitation, length 32, who has xxxx:xxxx:xxx:xxxx::3
source link-address option (1), length 8 (1): e8:a2:45:df:af:b8
0x0000: e8a2 45df afb8
11:38:50.802844 IP6 (hlim 255, next-header ICMPv6 (58) payload length: 32) fe80::eaa2:4500:df:aff8 > ff02::1:ff00:3: [icmp6 sum ok] ICMP6, neighbor solicitation, length 32, who has xxxx:xxxx:xxx:xxxx::3
source link-address option (1), length 8 (1): e8:a2:45:df:af:b8
0x0000: e8a2 45df afb8
11:39:10.480569 IP6 (hlim 255, next-header ICMPv6 (58) payload length: 32) fe80::eaa2:4500:df:aff8 > ff02::1:ff00:4: [icmp6 sum ok] ICMP6, neighbor solicitation, length 32, who has xxxx:xxxx:xxx:xxxx::4
source link-address option (1), length 8 (1): e8:a2:45:df:af:b8
0x0000: e8a2 45df afb8
11:39:11.537948 IP6 (hlim 255, next-header ICMPv6 (58) payload length: 32) fe80::eaa2:4500:df:aff8 > ff02::1:ff00:4: [icmp6 sum ok] ICMP6, neighbor solicitation, length 32, who has xxxx:xxxx:xxx:xxxx::4
source link-address option (1), length 8 (1): e8:a2:45:df:af:b8
0x0000: e8a2 45df afb8
11:39:12.637869 IP6 (hlim 255, next-header ICMPv6 (58) payload length: 32) fe80::eaa2:4500:df:aff8 > ff02::1:ff00:4: [icmp6 sum ok] ICMP6, neighbor solicitation, length 32, who has xxxx:xxxx:xxx:xxxx::4
source link-address option (1), length 8 (1): e8:a2:45:df:af:b8
0x0000: e8a2 45df afb8
11:40:13.568942 IP6 (flowlabel 0xbcaf3, hlim 63, next-header ICMPv6 (58) payload length: 64) xxxx:xxxx:xxx:xxxx::2 > 2a00:1450:4001:827::200e: [icmp6 sum ok] ICMP6, echo request, id 57717, seq 1
11:40:13.574114 IP6 (flowlabel 0xbcaf3, hlim 119, next-header ICMPv6 (58) payload length: 64) 2a00:1450:4001:827::200e > xxxx:xxxx:xxx:xxxx::2: [icmp6 sum ok] ICMP6, echo reply, id 57717, seq 1
11:40:13.574164 IP6 (hlim 255, next-header ICMPv6 (58) payload length: 32) fe80::b62e:99ff:fecd:4f4 > ff02::1:ff00:4: [icmp6 sum ok] ICMP6, neighbor solicitation, length 32, who has xxxx:xxxx:xxx:xxxx::4
source link-address option (1), length 8 (1): b4:2e:99:cd:04:f4
0x0000: b42e 99cd 04f4
11:40:14.584454 IP6 (flowlabel 0xbcaf3, hlim 63, next-header ICMPv6 (58) payload length: 64) xxxx:xxxx:xxx:xxxx::2 > 2a00:1450:4001:827::200e: [icmp6 sum ok] ICMP6, echo request, id 57717, seq 2
11:40:14.589804 IP6 (flowlabel 0xbcaf3, hlim 119, next-header ICMPv6 (58) payload length: 64) 2a00:1450:4001:827::200e > xxxx:xxxx:xxx:xxxx::2: [icmp6 sum ok] ICMP6, echo reply, id 57717, seq 2
11:40:14.599924 IP6 (hlim 255, next-header ICMPv6 (58) payload length: 32) fe80::b62e:99ff:fecd:4f4 > ff02::1:ff00:4: [icmp6 sum ok] ICMP6, neighbor solicitation, length 32, who has xxxx:xxxx:xxx:xxxx::4
source link-address option (1), length 8 (1): b4:2e:99:cd:04:f4
0x0000: b42e 99cd 04f4
11:40:15.608370 IP6 (flowlabel 0xbcaf3, hlim 63, next-header ICMPv6 (58) payload length: 64) xxxx:xxxx:xxx:xxxx::2 > 2a00:1450:4001:827::200e: [icmp6 sum ok] ICMP6, echo request, id 57717, seq 3
11:40:15.613545 IP6 (flowlabel 0xbcaf3, hlim 119, next-header ICMPv6 (58) payload length: 64) 2a00:1450:4001:827::200e > xxxx:xxxx:xxx:xxxx::2: [icmp6 sum ok] ICMP6, echo reply, id 57717, seq 3
11:40:15.619877 IP6 (hlim 255, next-header ICMPv6 (58) payload length: 32) fe80::b62e:99ff:fecd:4f4 > ff02::1:ff00:4: [icmp6 sum ok] ICMP6, neighbor solicitation, length 32, who has xxxx:xxxx:xxx:xxxx::4
source link-address option (1), length 8 (1): b4:2e:99:cd:04:f4
0x0000: b42e 99cd 04f4
11:40:16.632357 IP6 (flowlabel 0xbcaf3, hlim 63, next-header ICMPv6 (58) payload length: 64) xxxx:xxxx:xxx:xxxx::2 > 2a00:1450:4001:827::200e: [icmp6 sum ok] ICMP6, echo request, id 57717, seq 4
11:40:16.637503 IP6 (flowlabel 0xbcaf3, hlim 119, next-header ICMPv6 (58) payload length: 64) 2a00:1450:4001:827::200e > xxxx:xxxx:xxx:xxxx::2: [icmp6 sum ok] ICMP6, echo reply, id 57717, seq 4
11:40:16.647896 IP6 (flowlabel 0x61e9c, hlim 64, next-header ICMPv6 (58) payload length: 112) xxxx:xxxx:xxx:xxxx::2 > 2a00:1450:4001:827::200e: [icmp6 sum ok] ICMP6, destination unreachable, unreachable address xxxx:xxxx:xxx:xxxx::2
11:40:16.647919 IP6 (flowlabel 0x61e9c, hlim 64, next-header ICMPv6 (58) payload length: 112) xxxx:xxxx:xxx:xxxx::2 > 2a00:1450:4001:827::200e: [icmp6 sum ok] ICMP6, destination unreachable, unreachable address xxxx:xxxx:xxx:xxxx::2
11:40:16.647933 IP6 (flowlabel 0x61e9c, hlim 64, next-header ICMPv6 (58) payload length: 112) xxxx:xxxx:xxx:xxxx::2 > 2a00:1450:4001:827::200e: [icmp6 sum ok] ICMP6, destination unreachable, unreachable address xxxx:xxxx:xxx:xxxx::2
11:40:16.647948 IP6 (flowlabel 0x61e9c, hlim 64, next-header ICMPv6 (58) payload length: 112) xxxx:xxxx:xxx:xxxx::2 > 2a00:1450:4001:827::200e: [icmp6 sum ok] ICMP6, destination unreachable, unreachable address xxxx:xxxx:xxx:xxxx::2
11:40:17.656578 IP6 (flowlabel 0xbcaf3, hlim 63, next-header ICMPv6 (58) payload length: 64) xxxx:xxxx:xxx:xxxx::2 > 2a00:1450:4001:827::200e: [icmp6 sum ok] ICMP6, echo request, id 57717, seq 5
11:40:17.661778 IP6 (flowlabel 0xbcaf3, hlim 119, next-header ICMPv6 (58) payload length: 64) 2a00:1450:4001:827::200e > xxxx:xxxx:xxx:xxxx::2: [icmp6 sum ok] ICMP6, echo reply, id 57717, seq 5
11:40:17.661873 IP6 (hlim 255, next-header ICMPv6 (58) payload length: 32) fe80::b62e:99ff:fecd:4f4 > ff02::1:ff00:4: [icmp6 sum ok] ICMP6, neighbor solicitation, length 32, who has xxxx:xxxx:xxx:xxxx::4
source link-address option (1), length 8 (1): b4:2e:99:cd:04:f4
0x0000: b42e 99cd 04f4
Ich denke das die Pakete aus dem VM Netz nicht richtig hinaus geroutet werden.
Hab ihr mir hier ein paar Tipps, wie ich das beheben kann?