I’ve been using IPv6 on my rootserver for some time now. Last week I migrated to a new rootserver and copied my domU/VM instances over to the new hardware. Everything is working fine so far – except IPv6. The network setup is the same as on the old server: the external interface is eth0. The domU/VMs are hooked up to a bridge, called xenbr0. There’s another bridge for internal communication: xenbr1.
The dom0/Xen host itself seems reachable via IPv6. The /48 subnet is provided by Sixxs and is using a static 6-to-4 tunnel. But the VMs are not reliable reachable, although it is setup in the same way as it was on the old server and where it was working like a charme.
The configs of the hosts are these:
| config | old server | new server |
|---|---|---|
| System | Debian Etch 2.6.18-6-xen-amd64 linux-image-2.6.18-6-xen-amd64 linux-modules-2.6.18-6-xen-amd64 xen-hypervisor-3.0.3-1-amd64 xen-ioemu-3.0.3-1 xen-linux-system-2.6.18-6-xen-amd64 xen-tools xen-utils-3.0.3-1 xen-utils-common |
Debian Squeeze |
| /etc/sysctl.conf | net.ipv4.ip_forward=1 net.ipv6.conf.all.forwarding=1 net.ipv4.conf.default.proxy_arp=1 |
net.ipv4.ip_forward=1 net.ipv4.ip_syncookies=1 net.ipv4.conf.all.rp_filter=1 net.ipv4.icmp_echo_ignore_broadcasts=1 |
| /etc/xen/xend-config.sxp | (network-script network-route) (vif-script vif-bridge) (dom0-min-mem 196) (dom0-cpus 0) |
(vif-script vif-bridge) (network-script network-route) (dom0-min-mem 196) (enable-dom0-ballooning yes) (total_available_memory 0) (dom0-cpus 2) (vncpasswd ”) |
| /etc/network/interfaces |
# device: eth0 auto xenbr0 auto xenbr1
auto sixxs |
# device: eth0 auto xenbr0
auto xenbr1 |
The config of one of the Xen domUs is this:
| config | old server | new server |
|---|---|---|
| system | Debian Lenny 2.6.18-6-xen-amd64 |
Debian Lenny 2.6.32-5-xen-amd64 |
| /etc/sysctl.conf | net.ipv4.conf.default.rp_filter=1 net.ipv4.tcp_syncookies=1 net.ipv4.conf.default.forwarding=1 net.ipv6.conf.default.forwarding=1 net.ipv4.conf.eth0.proxy_arp=1 net.ipv4.conf.default.proxy_arp=1 kernel.shmmax=268435456 |
net.ipv4.conf.default.rp_filter=1 net.ipv4.tcp_syncookies=1 net.ipv4.conf.default.forwarding=1 net.ipv4.conf.all.forwarding=1 net.ipv6.conf.default.forwarding=1 net.ipv4.conf.eth0.proxy_arp=1 net.ipv4.conf.default.proxy_arp=1 kernel.shmmax=268435456 |
| /etc/network/interfaces |
# The primary network interface iface eth0 inet6 static auto eth1 |
# The primary network interface auto eth0 iface eth0 inet static address 178.63.83.104 gateway 178.63.83.84 netmask 255.255.255.192 broadcast 178.63.83.127 up ip -6 address add 2001:6f8:90e:145::1/64 dev eth0 || true up ip -6 route add default via 2001:6f8:90e:1::1 src 2001:6f8:90e:1:216:3eff:fe89:6c31 || true up iptables -t nat -A POSTROUTING -s 192.168.x.96/27 -o eth0 -j MASQUERADE || true iface eth0 inet6 static auto eth1 |
The dom0 seems to be reachable via IPv6 just perfectly fine. When trying to reach the domU I see packets going through the xenbr0 bridge and reaching the domU eth0 interface. The ICMP6 echo request packets (proto 58) are unanswered there, no echo replies. Strange enough it seems to work from time to time, but mostly not. I’ve also tried to set a generic default route like ip -6 route add default dev eth0, but still no improvement.
Did I miss something when migrating to the new server? Is there any mistake in the configs? Any suggestions are appreciated! 🙂
UPDATE:
This is a tcpdump from the domU, doing a ping from dom0:
07:35:29.308261 IP6 fe80::e46d:25ff:fe1f:317b > ip6-allnodes: ICMP6, router advertisement, length 56
07:35:29.329411 IP6 gate-hro.ip6.windfluechter.net > vserv.windfluechter.net: ICMP6, echo request, seq 45, length 64
07:35:30.329439 IP6 gate-hro.ip6.windfluechter.net > vserv.windfluechter.net: ICMP6, echo request, seq 46, length 64
07:35:30.451991 IP6 2001:418:4001:3::c657:b0c5 > vserv.windfluechter.net: ICMP6, echo request, seq 52836, length 64
07:35:30.481124 IP6 fe80::e46d:25ff:fe1f:317b > ff02::1:ff70:be: ICMP6, neighbor solicitation, who has 2001:6f8:90e:1:216:3eff:fe70:be, length 32
07:35:31.329906 IP6 gate-hro.ip6.windfluechter.net > vserv.windfluechter.net: ICMP6, echo request, seq 47, length 64
07:35:31.481645 IP6 fe80::e46d:25ff:fe1f:317b > ff02::1:ff70:be: ICMP6, neighbor solicitation, who has 2001:6f8:90e:1:216:3eff:fe70:be, length 32
07:35:32.329284 IP6 gate-hro.ip6.windfluechter.net > vserv.windfluechter.net: ICMP6, echo request, seq 48, length 64
07:35:32.481114 IP6 fe80::e46d:25ff:fe1f:317b > ff02::1:ff70:be: ICMP6, neighbor solicitation, who has 2001:6f8:90e:1:216:3eff:fe70:be, length 32
07:35:33.329951 IP6 gate-hro.ip6.windfluechter.net > vserv.windfluechter.net: ICMP6, echo request, seq 49, length 64
07:35:34.329705 IP6 gate-hro.ip6.windfluechter.net > vserv.windfluechter.net: ICMP6, echo request, seq 50, length 64
UPDATE #2:
The issue is finally solved. The solution can be found here.
Are you missing this from
Are you missing this from dom0: net.ipv6.conf.all.forwarding=1
No, I don’t think so:
No, I don’t think so:
gate:~# cat /proc/sys/net/ipv6/conf/all/forwarding
1
So, it is set.