Yet another IPv6 Support Thread

Skander · April 15, 2020, 3:44pm

Howdy peeps,
I hope you’re staying safe.

I have a VPS from HostSlick and it’s unmanaged, so I thought I’d cut them some slack and ask for help here instead

Y’all helped me out last time on this thread when I got a dedi, unfortunately, even with those suggestions I’m not able to figure this one out.

Setup is KVM, VPS came with IPv4, requested IPv6 recently and I got assigned a /64 block in addition to a single other IPv6.

This is on Ubuntu 18.04, but for some reason this image doesn’t use netplan.

I’m trying to configure the existing VPS to use this, messing around virtualizor it actually reconfigured by itself and added the following to the interfaces file:

root@server:~# cat /etc/network/interfaces
# The loopback network interface
auto lo
iface lo inet loopback

# The primary network interface
auto eth0
iface eth0 inet static
address 5.253.xx.xxx
netmask 255.255.255.0

gateway 5.253.xx.1
iface eth0 inet6 static
        accept_ra 0
        address 2a0f:ca80:0000:e5xx:0000:0000:0xxx:xxxx
        netmask 64

        gateway 2a0f:ca80:0000:exxx:0000:0000:0000:0001
        up /sbin/ifconfig eth0 inet6 add 2a0f:ca80:0000:0xxx:0000:0000:0000:0001/64
        up /sbin/ifconfig eth0 inet6 add 2a0f:ca80:0000:0xxx:0000:0000:0000:0002/64
        up /sbin/ifconfig eth0 inet6 add 2a0f:ca80:0000:0xxx:0000:0000:0000:0003/64
        up /sbin/ifconfig eth0 inet6 add 2a0f:ca80:0000:0xxx:0000:0000:0000:0004/64
        up /sbin/ifconfig eth0 inet6 add 2a0f:ca80:0000:0xxx:0000:0000:0000:0005/64
        up /sbin/ifconfig eth0 inet6 add 2a0f:ca80:0000:0xxx:0000:0000:0000:0006/64
        up /sbin/ifconfig eth0 inet6 add 2a0f:ca80:0000:0xxx:0000:0000:0000:0007/64

No go, I get the following:

root@server:~ip -6 neigh
fe80::21a:30ff:fea4:c00 dev eth0 lladdr 00:1a:30:a4:0c:00 router STALE
2a0f:ca80:0:e5xx::1 dev eth0  FAILED

and:

root@server:~# ip -6 a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 state UNKNOWN qlen 1000
    inet6 ::1/128 scope host
       valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 state UP qlen 1000
    inet6 2a0f:ca80:0:xxx::7/64 scope global
       valid_lft forever preferred_lft forever
    inet6 2a0f:ca80:0:xxx::6/64 scope global
       valid_lft forever preferred_lft forever
    inet6 2a0f:ca80:0:xxx::5/64 scope global
       valid_lft forever preferred_lft forever
    inet6 2a0f:ca80:0:xxx::4/64 scope global
       valid_lft forever preferred_lft forever
    inet6 2a0f:ca80:0:xxx::3/64 scope global
       valid_lft forever preferred_lft forever
    inet6 2a0f:ca80:0:xxx::2/64 scope global
       valid_lft forever preferred_lft forever
    inet6 2a0f:ca80:0:xxx::1/64 scope global
       valid_lft forever preferred_lft forever
    inet6 2a0f:ca80:0:e57f::xxx:xxxx/64 scope global
       valid_lft forever preferred_lft forever
    inet6 fe80::216:3eff:fee1:b642/64 scope link
       valid_lft forever preferred_lft forever

Pinging gives me the following:

root@server:~# ping6 2001:4860:4860::8888
PING 2001:4860:4860::8888(2001:4860:4860::8888) 56 data bytes
From 2a0f:ca80:0:xxx::7 icmp_seq=1 Destination unreachable: Address unreachable
From 2a0f:ca80:0:xxx::7 icmp_seq=2 Destination unreachable: Address unreachable
From 2a0f:ca80:0:xxx::7 icmp_seq=3 Destination unreachable: Address unreachable
^C
--- 2001:4860:4860::8888 ping statistics ---
5 packets transmitted, 0 received, +3 errors, 100% packet loss, time 4075ms

I’m lost.

Poli · April 15, 2020, 3:47pm

Hey !

Are you sure about your gateway i see an e in the middle gateway 2a0f:ca80:0000:>e<xxx:0000:0000:0000:0001 ?

Often you should look at your gateway / dns resolve config.

Skander · April 15, 2020, 3:52pm

The gateway was set by Virtualizor automatically. Here’s how it looks like vs the IP assigned to me:

    address 2a0f:ca80:0000:e57f:0000:0000:0xxx:xxxx
    gateway 2a0f:ca80:0000:e57f:0000:0000:0000:0001

This doesn’t look right to me, as I was also assigned a /64 block like this:

2a0f:ca80:0000:06xx:0000:0000:0000:0001

So the gateway should be: 2a0f:ca80::1 ?

Poli · April 15, 2020, 3:59pm

yes normally it should be something like that, for example, hetzner ipv6 gateway is: fe80::1.

To be honest your block looks pretty confusing. Because a /64 range should be bigger I guess?

And the gateway is in the pool? I mean it’s possible but it looks kinda illogical to me.

I am not really a pro of IPV6 i never had truely issues with it. Maybe still check your routes i had a few issues at home by connecting to IPV6 in my routes we never know.

But i think it’s not bounded to the routes it’s mainly how your IPV6 is looking too… the gateway, really depends on the provider too.

Skander · April 15, 2020, 4:03pm

Thanks for the input.
It’s odd, virtualizor lets me add IPs and only assigns 7 by default from the block.
The default configuration doesn’t work, and if I change it to “2a0f:ca80::1” I get network is unreachable.

Pretty confusing. The only input I got from the host is “Gateway is ::001 of our subnet”.

I’ll keep playing with it I guess and then resort to bothering them by asking for help

Poli · April 15, 2020, 4:23pm

Maybe someone more skilled than me for IPV6 will answer but yeah… it’s pretty confusing from what i see.

skorous · April 15, 2020, 8:43pm

IPv6 addresses are 128-bits so split your address in half. The left four are theirs, right four are yours to do what you want with.

So the question has been asked, the x’s in 2a0f:ca80:0000:exxx::1 aren’t really x’s, right? What happens when you do a whois on 2a0f:ca80:0000:exxx::1 ?

Skander · April 15, 2020, 8:57pm

Yeah they aren’t x’s.

ASN: AS207083

Country: NL

Registration Date: 2018-06-12

Registrar: ripencc

Owner: HOSTSLIM-GLOBAL-NETWORK, NL

and for 2a0f:ca80:0000:06xx:0000:0000:0000:0001

ASN: AS207083

Country: NL

Registration Date: 2018-06-12

Registrar: ripencc

Owner: HOSTSLIM-GLOBAL-NETWORK, NL

Looking further into it looks like the \48 of 2a0f:ca80::1 is what HostSlick are using from HostSlim (?)

Last prefix:

skorous · April 15, 2020, 9:28pm

( No offense meant with the x’s question. Spent too many hours troubleshooting things to find out it was something so obvious I didn’t ask the question. )

So what I did to find my gateway on Quadhost ( because their templates were/are broken too ) was I nmap’ed the first bunch of IPs in the /48. Something akin to: nmap -6 -sP 2a0f:ca80::1/119 … That returned me a half dozen hosts and I tried them in sequence. Hit on the right one about the fifth try.

Skander · April 15, 2020, 9:42pm

Oh please I am in no position to be offended lol.

When I run that, I get no results as it returns failed to determine route to 2a0f:ca80::xxx for every single one.

I can’t even ping 2a0f:ca80::1

skorous · April 15, 2020, 9:54pm

Have you tried tcpdump to see if you’re even seeing any ip6 traffic?

tcpdump -n -i eth0 icmp6 or ip6

Skander · April 15, 2020, 10:06pm

root@server:~# tcpdump -n -i eth0 icmp6 or ip6
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 262144 bytes
15:04:35.661111 IP6 fe80::b9a1:f33d:b78d:3135.50282 > ff02::1:3.5355: UDP, length 22
15:04:35.661910 IP6 fe80::b9a1:f33d:b78d:3135.59235 > ff02::1:3.5355: UDP, length 22
15:04:36.073712 IP6 fe80::b9a1:f33d:b78d:3135.50282 > ff02::1:3.5355: UDP, length 22
15:04:36.074134 IP6 fe80::b9a1:f33d:b78d:3135.59235 > ff02::1:3.5355: UDP, length 22
15:05:01.449927 IP6 2a0f:ca80:0:2fe::1 > ff02::1:ff00:1: ICMP6, neighbor solicitation, who has 2a0f:ca80:0:e57f::1, length 32
15:05:02.451129 IP6 2a0f:ca80:0:2fe::1 > ff02::1:ff00:1: ICMP6, neighbor solicitation, who has 2a0f:ca80:0:e57f::1, length 32
15:05:03.453204 IP6 2a0f:ca80:0:2fe::1 > ff02::1:ff00:1: ICMP6, neighbor solicitation, who has 2a0f:ca80:0:e57f::1, length 32
15:05:04.456059 IP6 2a0f:ca80:0:2fe::1 > ff02::1:ff00:1: ICMP6, neighbor solicitation, who has 2a0f:ca80:0:e57f::1, length 32
15:05:05.456961 IP6 2a0f:ca80:0:2fe::1 > ff02::1:ff00:1: ICMP6, neighbor solicitation, who has 2a0f:ca80:0:e57f::1, length 32
15:05:06.459323 IP6 2a0f:ca80:0:2fe::1 > ff02::1:ff00:1: ICMP6, neighbor solicitation, who has 2a0f:ca80:0:e57f::1, length 32
15:05:11.133475 IP6 fe80::21a:30ff:fea4:c00 > ff02::1: ICMP6, router advertisement, length 64
15:05:11.133556 IP6 fe80::216:3eff:fe66:a6e7 > ff02::1:ff00:0: ICMP6, neighbor solicitation, who has ::, length 32
15:05:11.134900 IP6 fe80::20a:f7ff:fe17:e7fd > ff02::16: HBH ICMP6, multicast listener report v2, 26 group record(s), length 528
15:05:11.138169 IP6 fe80::216:3eff:fee9:51eb > ff02::1:ff00:0: ICMP6, neighbor solicitation, who has ::, length 32
15:05:11.139167 IP6 fe80::20a9:32d9:adca:c112 > ff02::16: HBH ICMP6, multicast listener report v2, 2 group record(s), length 48
15:05:11.140072 IP6 fe80::1278:e9b6:850c:610c > ff02::16: HBH ICMP6, multicast listener report v2, 2 group record(s), length 48
15:05:11.432326 IP6 fe80::20a9:32d9:adca:c112 > ff02::16: HBH ICMP6, multicast listener report v2, 2 group record(s), length 48
15:05:11.721524 IP6 fe80::20a:f7ff:fe17:e7fd > ff02::16: HBH ICMP6, multicast listener report v2, 26 group record(s), length 528
15:05:11.970013 IP6 fe80::1278:e9b6:850c:610c > ff02::16: HBH ICMP6, multicast listener report v2, 2 group record(s), length 48

I see 2a0f:ca80:0:2fe::1 which is interesting.

skorous · April 15, 2020, 10:24pm

Are you still using the /64 or did you convert to a /48?

SERIESN · April 16, 2020, 12:06am

Hey Bud,
With virtualizor, it gets tricky at times.

the easiest way is to, generate an IP from your control panel, save, power off your VPS and power it back on.

Mr_Tom · April 16, 2020, 7:00am

Skander:

The gateway was set by Virtualizor automatically. Here’s how it looks like vs the IP assigned to me:
    address 2a0f:ca80:0000:e57f:0000:0000:0xxx:xxxx
    gateway 2a0f:ca80:0000:e57f:0000:0000:0000:0001
This doesn’t look right to me, as I was also assigned a /64 block like this:
2a0f:ca80:0000:06xx:0000:0000:0000:0001
So the gateway should be: 2a0f:ca80::1 ?

Sounds like you’ve got a gateway/address to use for connectivity, and an additional routed /64.

Try setting just the address/gateway with a 126 netmask and see if you can ping out via that. Then add any addresses from the range you need.

The following (Debian) works for me but this is not on a virtualisor server so might be different.

face eth0 inet6 static
	pre-up modprobe ipv6
	address xxxx:yyyy:zzzz::2
	netmask 126
	gateway xxxx:yyyy:zzzz::1
	up ip -6 addr add 2x2x:2y2y:2z2z::1/64 dev eth0
	down ip -6 addr del 2x2x:2y2y:2z2z::1/64 dev eth0

Skander · April 16, 2020, 2:45pm

iface eth0 inet6 static
        accept_ra 0
        pre-up modprobe ipv6
        address 2a0f:ca80:0000:e57f:0000:0000:0xxx:xxx
        netmask 126
        gateway 2a0f:ca80:0000:e57f:0000:0000:0000:0001

I kept just this, getting network unreachable.

tried this:

iface eth0 inet6 static
        accept_ra 0
        pre-up modprobe ipv6
        address 2a0f:ca80:0000:e57f:0000:0000:0xxx:xxxx
        netmask 126
        gateway 2a0f:ca80::1

Same result Edit: accept_ra was set like that from the panel but removing it does nothing.

root@server:~# ping6 google.com
connect: Network is unreachable

and

root@server:~# ip -6 a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 state UNKNOWN qlen 1000
    inet6 ::1/128 scope host
       valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 state UP qlen 1000
    inet6 2a0f:ca80:0:e57f::xxx:xxxx/126 scope global
       valid_lft forever preferred_lft forever
    inet6 fe80::216:3eff:fee1:b642/64 scope link
       valid_lft forever preferred_lft forever

Mr_Tom · April 16, 2020, 2:58pm

Has that been shortened for the post? Looking at the address above it should be 2a0f:ca80:0000:e57f::1

Edit: Assuming the gateway hasn’t been masked for the sake of posting, I can’t ping it.

Skander · April 16, 2020, 3:19pm

I tried both 2a0f:ca80:0000:e57f::1 and 2a0f:ca80::1 with the same behavior

I tried 2a0f:ca80::1 because the provider said the gateway is ::1 of their subnet

Mason · April 16, 2020, 3:21pm

Here’s a dumb question - have you checked with the provider that v6 is working on the node as intended? I spent a good couple hours in the past troubleshooting v6 connectivity, only for the provider to tell me ipv6 was borked when I popped in a ticket.

Mr_Tom · April 16, 2020, 3:31pm

Assuming it’s a /64 subnet then it would be 2a0f:ca80:0000:e57f::1 but as Mason says, might be worth checking with the provider.

Although, in saying that, I can ping 2a0f:ca80::1 - try setting the gateway to this with a netmask of 48?