Well, I feel rather stupid. I made big progress, but I’m still having problems I can’t figure out.
First, my original problem was the firewall. I didn’t think about the fact that my firewall’s default rule is to deny everything and I hadn’t yet created any IPv6 rules to allow IPv6 traffic. It was so restrictive, not even router advertisements, DHCP replies, and neighbor solicitations were making it through. Once I opened up the firewall, I successfully got an IPv6 address assigned to me. But I still can’t ping ipv6.google.com.
First, my (working?) eth0 config:
ethernet eth0 {
address dhcp
address dhcpv6
description "Red Interface"
duplex auto
hw-id 00:50:56:3f:ff:01
smp_affinity auto
speed auto
}
I now have an assigned IP address:
[code]$ show interfaces
Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down
Interface IP Address S/L Description
br0 172.16.123.1/24 u/u Green Bridge from eth1 to vtun0
eth0 68...131/23 u/u Red Interface
2001:558:6016:19::::*/64
eth1 - u/u Green Interface
eth2 192.168.123.254/24 u/u DMZ 1 Interface
lo 127.0.0.1/8 u/u
::1/128
vtun0 - u/u Green VPN[/code]
I can ping eth0’s IPv6 address, Comcast’s router’s public IPv6 address, and Comcast’s router’s link-local IPv6 address, but not ipv6.google.com, respectively:
$ ping6 2001:558:6016:19:****:****:****:****
PING 2001:558:6016:19:****:****:****:****(2001:558:6016:19:****:****:****:****) 56 data bytes
64 bytes from 2001:558:6016:19:****:****:****:****: icmp_seq=1 ttl=64 time=0.086 ms
$ ping6 2001:558:6016:19::1
PING 2001:558:6016:19::1(2001:558:6016:19::1) 56 data bytes
64 bytes from 2001:558:6016:19::1: icmp_seq=1 ttl=64 time=8.69 ms
$ ping6 -I eth0 fe80::201:5cff:fe65:ae46
PING fe80::201:5cff:fe65:ae46(fe80::201:5cff:fe65:ae46) from fe80::250:56ff:fe3f:ff01 eth0: 56 data bytes
64 bytes from fe80::201:5cff:fe65:ae46: icmp_seq=1 ttl=64 time=7.85 ms
$ ping6 2607:f8b0:4002:c07::8a
connect: Network is unreachable
$ ping6 -I eth0 2607:f8b0:4002:c07::8a
connect: Network is unreachable
Clearly my routes are messed up, and indeed I am right, there’s no route for IPv6:
[code]$ show ip route
Codes: K - kernel route, C - connected, S - static, R - RIP, O - OSPF,
I - ISIS, B - BGP, > - selected route, * - FIB route
S>* 0.0.0.0/0 [210/0] via 68.47.160.1, eth0
C>* 68...0/23 is directly connected, eth0
C> 127.0.0.0/8 is directly connected, lo
C>* 172.16.123.0/24 is directly connected, br0
C>* 192.168.123.0/24 is directly connected, eth2
$ show ipv6 route
Codes: K - kernel route, C - connected, S - static, R - RIPng, O - OSPFv3,
I - ISIS, B - BGP, * - FIB route.
C>* ::1/128 is directly connected, lo
C>* 2001:558:6016:19::/64 is directly connected, eth0
C * fe80::/64 is directly connected, vtun0
C * fe80::/64 is directly connected, eth1
C * fe80::/64 is directly connected, eth2
C * fe80::/64 is directly connected, eth0
C>* fe80::/64 is directly connected, br0[/code]
Granted, unless I’m still doing something wrong, a route should be added automatically (the IPv4 route is added automatically, so the IPv6 route should, too). But, for workaround purposes, I tried adding static routes two different ways:
[code] static {
route6 ::0/128 {
next-hop 2001:558:6016:19::1 {
}
}
}
$ show ipv6 route
Codes: K - kernel route, C - connected, S - static, R - RIPng, O - OSPFv3,
I - ISIS, B - BGP, * - FIB route.
S>* ::/128 [1/0] via 2001:558:6016:19::1, eth0
C>* ::1/128 is directly connected, lo
C>* 2001:558:6016:19::/64 is directly connected, eth0
C * fe80::/64 is directly connected, vtun0
C * fe80::/64 is directly connected, eth1
C * fe80::/64 is directly connected, eth2
C * fe80::/64 is directly connected, eth0
C>* fe80::/64 is directly connected, br0[/code]
[code] static {
route6 ::0/128 {
next-hop fe80::201:5cff:fe65:ae46 {
interface eth0
}
}
}
$ show ipv6 route
Codes: K - kernel route, C - connected, S - static, R - RIPng, O - OSPFv3,
I - ISIS, B - BGP, * - FIB route.
S>* ::/128 [1/0] via fe80::201:5cff:fe65:ae46, eth0
C>* ::1/128 is directly connected, lo
C>* 2001:558:6016:19::/64 is directly connected, eth0
C * fe80::/64 is directly connected, vtun0
C * fe80::/64 is directly connected, eth1
C * fe80::/64 is directly connected, eth2
C * fe80::/64 is directly connected, eth0
C>* fe80::/64 is directly connected, br0[/code]
[code] static {
interface-route6 ::/128 {
next-hop-interface eth0 {
}
}
}
$ show ipv6 route
Codes: K - kernel route, C - connected, S - static, R - RIPng, O - OSPFv3,
I - ISIS, B - BGP, * - FIB route.
S>* ::/128 [1/0] is directly connected, eth0
C>* ::1/128 is directly connected, lo
C>* 2001:558:6016:19::/64 is directly connected, eth0
C * fe80::/64 is directly connected, vtun0
C * fe80::/64 is directly connected, eth1
C * fe80::/64 is directly connected, eth2
C * fe80::/64 is directly connected, eth0
C>* fe80::/64 is directly connected, br0[/code]
The last one makes the most sense, because the interface never changes but the router IP might. Regardless, none of the three worked. I can still ping eth0’s IPv6 address, Comcast’s router’s public IPv6 address, and Comcast’s router’s link-local IPv6 address, but I still can’t ping ipv6.google.com.
I’m going to mess with the firewall a bit more, but since I can ping Comcast’s router, I don’t see how it could be a firewall problem. Any ideas?