Re: IPv6 source-based routing

Jeff Taylor
Fri, 21 Oct 2011 04:57:39 -0000

Interesting... it DOES work if I leave the gateway field blank (-).  My
connection still seems to work, and the results of "ip -6 rule ls"
show that my
route_rules are being entered... And yet my pings to the sit1 subnet are failing
while pings to the sit2 subnet are working fine.  So it appears I still have not
made any progress.


On 10/20/2011 09:41 PM, Jeff Taylor wrote:
> Ubuntu Lucid.
>
> I applied the patch to Providers.pm that you gave, and I tried to use the
> Server IPv6 Address provided by HE as the gateway in the providers file,
but I
> still getting the same failure when I try to enable the providers entries.
It
> should be noted that I don''t think I''m actually using
shorewall-perl on my setup.
>
> Here''s my providers file as it sits now:
> ISP1   3       -       main            sit1    2001:470:1f04:262::1
track
> eth1,eth2,eth3,eth5
> ISP2   4       -       main            sit2    2001:470:c:316::1
track
> eth1,eth2,eth3,eth5
>
> And here''s the error I get when I try to restart shorewall6:
> 21:39:59 Adding Providers...
> RTNETLINK answers: No route to host
>    ERROR: Command "ip -6 route add default via 2001:470:1f04:262::1
src
> 2001:470:8388::1 dev sit1 table 3" Failed
>
> So... any thoughts as to what I''m doing wrong at this point?
>
>
>
> On 10/20/2011 05:19 PM, Tom Eastep wrote:
>>
>> On Oct 20, 2011, at 3:45 PM, Jeff Taylor wrote:
>>
>>> I''m trying to figure out here... did you accidentally copy
your providers
>>> example under the route_rules as well, or is your configuration
just that
>>> vastly different from what I have here?  I''m running
shorewall 4.4.6, it
>>> appears there are no further updates in my distro.
>>
>> Which distro -- Gentoo?
>>
>>> I''m trying to dig up more info on the route_rules file,
beyond the man page
>>> which doesn''t give any examples to work from, and
hopefully can do some
>>> testing with that later this evening.
>>>
>>> Also, the IPv6 addresses you specified lead me to believe that you
may have
>>> both addresses coming from the same HE server.  In my case, because
I am
>>> connected under two different providers, my tunnels are coming from
two
>>> different servers (fmt2 and lax1).  This is the particular scenario
that
>>> they added filtering against yesterday.  If both of your test
connections
>>> are coming from the same source, there is no filtering against
crossovers
>>> between those, so it wouldn''t be a valid test.
>>
>> I''m not getting any crosstalk - I''ve verified that.
>>
>> -Tom
>>
>> Tom Eastep        \ When I die, I want to go like my Grandfather who
>> Shoreline,         \ died peacefully in his sleep. Not screaming like
>> Washington, USA     \ all of the passengers in his car
>> http://shorewall.net
>>
<http://shorewall.net/>\________________________________________________
>>
>>
>>
>>
>>
------------------------------------------------------------------------------
>> The demand for IT networking professionals continues to grow, and the
>> demand for specialized networking skills is growing even more rapidly.
>> Take a complimentary Learning@Cisco Self-Assessment and learn
>> about Cisco certifications, training, and career opportunities.
>> http://p.sf.net/sfu/cisco-dev2dev
>>
>>
>> _______________________________________________
>> Shorewall-users mailing list
>> Shorewall-users@lists.sourceforge.net
>> https://lists.sourceforge.net/lists/listinfo/shorewall-users
>
>
>
------------------------------------------------------------------------------
> The demand for IT networking professionals continues to grow, and the
> demand for specialized networking skills is growing even more rapidly.
> Take a complimentary Learning@Cisco Self-Assessment and learn
> about Cisco certifications, training, and career opportunities.
> http://p.sf.net/sfu/cisco-dev2dev
>
>
> _______________________________________________
> Shorewall-users mailing list
> Shorewall-users@lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/shorewall-users