<html><head></head><body><div>Hi François,</div><div><br></div><blockquote type="cite" style="margin:0 0 0 .8ex; border-left:2px #729fcf solid;padding-left:1ex"><blockquote type="cite" style="margin:0 0 0 .8ex; border-left:2px #729fcf solid;padding-left:1ex"><div>net.ipv4.ip_forward = 1<br></div><div>net.ipv4.conf.all.proxy_arp = 1<br></div><div>net.ipv6.conf.all.forwarding = 1<br></div><div>net.ipv6.conf.all.proxy_ndp = 1<br></div></blockquote><div><br></div><div>All that should be needed is the sysctl options that are already set in <br></div><div>/etc/sysctl.d/70-vpn.conf (by default).</div></blockquote><div><br></div><div>Yes that 's the content of the file (btw, I've added net.ipv6.conf.all.proxy_ndp = 1 as it is not defined there as standard if I remember well)</div><div><br></div><blockquote type="cite" style="margin:0 0 0 .8ex; border-left:2px #729fcf solid;padding-left:1ex"><div>Do you have a "non-standard" IPv6 deployment on that site?<br></div><div><br></div><div>The configuration assumes that (just like it would be with IPv4) the <br></div><div>IPv6 prefix that is to be assigned to the VPN clients is routed to the <br></div><div>public IPv6 address of the VPN server by the first router in the path <br></div><div>(and allow egress from this prefix as well arriving from the VPN <br></div><div>server's public IPv6 address).</div></blockquote><div><br></div><div>As you may remember, we are hosting (and managing) VM servers for our customers; the servers are in our premises and the link with the customer's networks is (currently) done via a dedicated VLAN that travels from cusrtomer's router through the BB and terminates on the eduvpn server. IPv4 and Ipv6 addresses are assigned to each end of the VLAN, one being on the eduvpn server.</div><div>Customer gave us a public IPv6 subrange (a /64) from his assigned range. </div><div>I've splitted his range into several /111, each assigned to a couple of vpn profiles.</div><div><br></div><div><br></div><blockquote type="cite" style="margin:0 0 0 .8ex; border-left:2px #729fcf solid;padding-left:1ex"><div>Of course, this all assumes that you use a *static* IPv6 address on the <br></div><div>VPN server and have the routing properly configured in your router.</div></blockquote><div><div><span style="font-size: 14.660252px;"><br></span></div><div><span style="font-size: 14.660252px;">Static IPv6 addresses are used.</span></div><div><span style="font-size: 14.660252px;">the /64 is routed by the server into the dedicated ethernet interface where the VLAN ends (eth1 in the attached file).</span></div></div><div><br></div><blockquote type="cite" style="margin:0 0 0 .8ex; border-left:2px #729fcf solid;padding-left:1ex"><div>Make sure you update the VPN server firewall to allow the forwarding <br></div><div>to/from the correct IP ranges and disable NAT there. Even without *any* <br></div><div>firewall rules on the VPN server it should work, so you can temporary <br></div><div>disable the entire firewall to see if that helps</div></blockquote><div><br></div><div>NAT is well disabled (not nat table rules defined)</div><div><br></div><div>I've also tested by setting ACCEPT as default policy and ip6tables flushed (no rule) without any success so far.</div><div><br></div><div>The only way I've found to make it work is to issue following command (for example):</div><div><br></div><div>ip -6 neigh add proxy 2001:6a8:2100:136::2:3 dev eth1</div><div><br></div><div>After that, <span style="font-size: 14.660252px;">2001:6a8:2100:136::2:3 (=an ipv6 assigned to a VPN client) can use the IPv6 network and ping or use any allowed trafic to internal servers... but I cannot use the new script feature to apply it to connections being setup. (back to the purpose of my initial mail <img src="cid:57a00ecdf60c349709d09cd0b660f93a97e12703.camel@belnet.be-0" alt=":-)" width="16px" height="16px"> )</span></div><div><br></div><blockquote type="cite" style="margin:0 0 0 .8ex; border-left:2px #729fcf solid;padding-left:1ex"><div>Can you provide the output of `ip6tables -S` and `ip6tables -S -t nat` <br></div><div>and `ip -6 addr show`</div></blockquote><div><br></div><div>see attached.</div><div><br></div><div><span><pre>-- <br></pre><div><b><font face="Arial, Helvetica, sans-serif" size="4" color="#0092d2">Pascal Panneels</font></b></div><div><font face="Arial, Helvetica, sans-serif" size="4"><b>System Architect</b></font></div><div><font face="Arial, Helvetica, sans-serif" size="4"><b>Belnet - Services</b></font></div><div><font color="#8b8e8d" face="Arial, Helvetica, sans-serif">WTC III</font></div><div><font color="#8b8e8d" face="Arial, Helvetica, sans-serif">Simon Bolivarlaan 30 Boulevard Simon Bolivar</font></div><div><font color="#8b8e8d" face="Arial, Helvetica, sans-serif">Brussel 1000 Bruxelles</font></div><div><font color="#8b8e8d" face="Arial, Helvetica, sans-serif">België - Belgique</font></div><div><font color="#8b8e8d" face="Arial, Helvetica, sans-serif">T: +32 2 790 33 33</font></div><div><a href="http://www.belnet.be"><b><font color="#0092d2" face="Arial, Helvetica, sans-serif">https://www.belnet.be</font></b></a></div><div><br></div></span></div></body></html>