-
Notifications
You must be signed in to change notification settings - Fork 8
IPv6
From: https://serverfault.com/a/1143196
curl -6 ip.sb
Here is example how I can reach SSH server on Link-local address (address that starts
with fe80:....
and requires appending interface name with %ethX
, because it is not globally unique.
# ~/.ssh/config
Host deb12-ipv6
HostName fe80::6250:40ff:fe30:2010%%eth0
User USERNAME
IdentityFile ~/.ssh/MY_KEY
IdentitiesOnly yes
HostKeyAlias deb12-ipv6
Notice that we have to escape %
as %%
(!).
Following ping command should reveal all link-local addresses (from https://learningnetwork.cisco.com/s/question/0D53i00000Kt61BCAR/how-to-ping-all-global-ipv6-addresses)
# to reveal link-local addresses - replace eth0 with your NIC name:
ping -6 -I eth0 ff02::1
# to reveal routers
ping -6 -I eth0 ff02::2
But not on openSUSE LEAP 15.6 with firewall-cmd, because it rejects reply as invalid (from dmesg
):
STATE_INVALID_DROP: IN=eth0 OUT= MAC=X SRC=fe80:... DST=fe80:... LEN=104 TC=0 HOPLIMIT=255 FLOWLBL=0 \
PROTO=ICMPv6 TYPE=129 CODE=0 ID=6 SEQ=4
There is reported bug on:
- https://github.com/firewalld/firewalld/issues/1046
- https://github.com/firewalld/firewalld/issues/1089
- https://forums.opensuse.org/t/nftables-blocks-ipv6-icmp-multicast-echos-after-upgrade/153968/3
Workaround from SUSE forums:
firewall-cmd --permanent --direct --add-rule ipv6 raw PREROUTING 0 -p icmpv6 -j CT --notrack
firewall-cmd --reload
Experiment: configure Debian as IPv6 only system.
-
My
/etc/network/interfaces
source /etc/network/interfaces.d/* auto lo eth0 iface lo inet loopback iface lo inet6 loopback iface eth0 inet6 auto privext 2
- WARNING!
privext 2
does not work (!) - Workaround: create file
/etc/sysctl.d/98-tempaddr.conf
# Ensure that Debian uses random IPv6 address (interfaces/privext 2 does not work) net.ipv6.conf.eth0.use_tempaddr = 2
- WARNING!
-
Use IPv6 public DNS
/etc/resolv.conf
:# CloudFlare public IPv6 DNS: https://developers.cloudflare.com/1.1.1.1/ip-addresses/ nameserver 2606:4700:4700::1111 nameserver 2606:4700:4700::1001
-
Ensure that SSH server is listening on IPv6 address only in
/etc/ssh/sshd_config
AddressFamily inet6 ListenAddress ::
Some routers do not allow incoming IPv6 connections - even if you have public IPv6 address (which is nearly always public when you have IPv6 access from ISP). Firewall simply allows only outgoing IPv6 connections (and so called "NAT Forwarding" is only for IPv4).
- create dual-stack in Azure (not yet tested)
Copyright © Henryk Paluch. All rights reserved.
This work is licensed under a Creative Commons Attribution-ShareAlike 4.0 International License