Re: Proxyndp issue

Tom Eastep
2012-12-07T21:37:55Z

On 12/07/2012 10:00 AM, German Molano wrote:
> Hi there, i am getting some trouble using proxyndp on shorewall6. I
> cannot access to the  ipv6 internet from the host inside my local
> network or ping this internal host from outside networks.
>
> This is my setup:
>
> Firewall
>
> eth0 2801:0:100::2/48
> GW=2801:0:100::1
> eth1=not initialized only local ipv6 link fe80:xxxx ...
>
> SHOREWALL6 versión 4.5.9.3
>
> interfaces
> net     eth0     tcpflags,forward=1
> loc     eth1     tcpflags,forward=1
>
> zone
> fw      firewall
> loc     ipv6
> net     ipv6
>
> policy
> loc             net             ACCEPT
> net             all             DROP            info
> fw              all             ACCEPT
> all             all             REJECT          info
>
> rules
> ACCEPT     net     fw     ipv6-icmp
> SSH(ACCEPT)     net:<2001:xxxxx:2>             $FW
> ACCEPT     net     loc:<2801:0:100::58>     ipv6-icmp
>
> proxyndp
> #ADDRESS                INTERFACE       EXTERNAL HAVEROUTE       PERSISTENT
> 2801:0:100::58          eth1            eth0
>
> sysctl -a | grep proxy_ndp
> net.ipv6.conf.all.proxy_ndp = 1
> net.ipv6.conf.default.proxy_ndp = 0
> net.ipv6.conf.lo.proxy_ndp = 0
> net.ipv6.conf.eth0.proxy_ndp = 0
> net.ipv6.conf.eth1.proxy_ndp = 1
>
> sysctl -a | grep forwarding
> net.ipv6.conf.all.forwarding = 1
> net.ipv6.conf.all.mc_forwarding = 0
> net.ipv6.conf.default.forwarding = 1
> net.ipv6.conf.default.mc_forwarding = 0
> net.ipv6.conf.lo.forwarding = 1
> net.ipv6.conf.lo.mc_forwarding = 0
> net.ipv6.conf.eth0.forwarding = 1
> net.ipv6.conf.eth0.mc_forwarding = 0
> net.ipv6.conf.eth1.forwarding = 1
> net.ipv6.conf.eth1.mc_forwarding = 0
>
> Neighbors discovered on firewall:
> 2801:0:100::58 dev eth1 lladdr 00:04:23:88:ed:1d REACHABLE
> fe80::204:23ff:fe88:ed1d dev eth1 lladdr 00:04:23:88:ed:1d REACHABLE
> (local ipv6 link on internal host)
> 2801:0:100::1 dev eth0 lladdr e0:5f:b9:26:b0:80 router STALE
> fe80::e25f:b9ff:fe26:b080 dev eth0 lladdr e0:5f:b9:26:b0:80 router
> REACHABLE (local ipv6 link on router)
> fe80::210:dcff:fefe:d05f dev eth0 lladdr 00:10:dc:fe:d0:5f REACHABLE
> (local ipv6 link on host on external network)
>
> Host IPv6''s config inside my network
>
> eth0=2801:0:100::58/48
> GWIPv6=2801:0:100::1

If you are going to configure it that way, then you need to proxyndp
2801:0:100::1 on eth1.
>
> When I try to look the neighbors address on the internal host I get this:
> ip -6 neigh show
> 2801:0:100::12 dev eth0  INCOMPLETE
> 2801:0:100::1 dev eth0  FAILED
> fe80::210:4bff:fe0b:e07d dev eth0 lladdr 00:10:4b:0b:e0:7d router REACHABLE
>
> The internal host cannot answer pings comming from outside networks or
> access outside networks ...
>
> What am i missing or misconfigured?

Note that even if you add the second proxyndp, 2801:0:100:1 will be the
only host in 2801:0:100::/48 that the internal host will be able to
communicate with.

If I were you, I would configure an address on eth1 with a small subnet,
use that as the default gateway for the internal host, and use the same
small subnet (/120 or smaller) on the internal host.

Here''s how I use proxyndp; note the /126s on the two 6to4 interfaces.

10: mac: <POINTOPOINT,NOARP,UP,LOWER_UP> mtu 1480 qdisc noqueue state
UNKNOWN
     link/sit 172.20.1.254 peer 172.20.0.11
     inet6 2001:470:b:227::19/126 scope global
        valid_lft forever preferred_lft forever
     inet6 fe80::ac14:1fe/128 scope link
        valid_lft forever preferred_lft forever
11: hp: <POINTOPOINT,NOARP,UP,LOWER_UP> mtu 1480 qdisc noqueue state
UNKNOWN
     link/sit 172.20.1.254 peer 172.20.1.191
     inet6 2001:470:b:227::21/126 scope global
        valid_lft forever preferred_lft forever
     inet6 fe80::ac14:1fe/128 scope link
        valid_lft forever preferred_lft forever
12: br0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state
UNKNOWN
     link/ether 02:1b:e8:cb:b4:60 brd ff:ff:ff:ff:ff:ff
     inet 70.90.191.121/32 scope global br0
     inet 172.20.2.254/24 brd 172.20.2.255 scope global br0:1
     inet6 2001:470:b:227::1/64 scope global
        valid_lft forever preferred_lft forever
     inet6 2001:470:b:227::41/124 scope global
        valid_lft forever preferred_lft forever
     inet6 fe80::c006:1fff:febe:c298/64 scope link
        valid_lft forever preferred_lft forever

/etc/shorewall6/proxyndp:

#ADDRESS				INTERFACE	EXTERNAL	HAVEROUTE	PERSISTENT
2001:470:b:227::18			-		br0		Yes		Yes
2001:470:b:227::21			-		br0		Yes		Yes

-Tom
--
Tom Eastep        \ When I die, I want to go like my Grandfather who
Shoreline,         \ died peacefully in his sleep. Not screaming like
Washington, USA     \ all of the passengers in his car
http://shorewall.net \________________________________________________