Re: IPv6 source-based routing

Tom Eastep
Sat, 22 Oct 2011 13:17:00 -0000

On Sat, 2011-10-22 at 01:35 -0600, Jeff Taylor wrote:
> All right, so I have spent the evening upgrading my firewall to Natty,
> then installing the deb packages for shorewall 4.4.23.3.  I''ve
made a
> few changes in my shorewall config that were needed for the newer
> versions, and I made your changes to Providers.pm again after my last
> update, so now both shorewall and shorewall6 are starting without
> errors and everything seems to be working as expected... except I am
> still not getting the correct routing of IPv6 traffic.  For example...
>
> # ping6 2001:470:8388:10::9
> does not work
> # ping6 2001:470:f032:10::9
> DOES work
>
> Try doing a traceroute6 of each, and you''ll see where the packets
> appear to hop across my tunnels, and always end up on sit2
> (2001:470:f032::1).
>
> My providers files (under shorewall6):
> ISP1    1       10      main            sit1    2001:470:1f04:262::1
> track  eth1,eth2,eth3,eth5
> ISP2    2       20      main            sit2    2001:470:c:316::1
> track  eth1,eth2,eth3,eth5
>
> My route_rules file:
> 2001:470:1f04:262::1/64 ::/0                    ISP1            11000
> 2001:470:c:316::1/64    ::/0                    ISP2            11001
>
> At this point I''ve been working on the computer for way too many
hours
> and need to get some sleep, but if you can possibly think of anything
> else for me to check, I would be very appreciative.  Are there any
> files that should or should not be used under shorewall6 (masq, tc*,
> or others)?

Please forward the output of ''shorewall6 dump'' as a compressed
attachment.

Thanks,
-Tom
--
Tom Eastep        \ When I die, I want to go like my Grandfather who
Shoreline,         \ died peacefully in his sleep. Not screaming like
Washington, USA     \ all of the passengers in his car
http://shorewall.net \________________________________________________