Project

General

Profile

Actions
Copy link

Bug #16351

open

OpenVPN Gateway creation - incorrect IPv6 address

Added by Bert Smith about 1 month ago. Updated 26 days ago.

Status:
Incomplete
Priority:
Normal
Assignee:
-
Category:
OpenVPN
Target version:
-
Start date:
Due date:
% Done:

0%

Estimated time:
Plus Target Version:
Release Notes:
Default
Affected Version:
2.8.0
Affected Architecture:

Description

When using the "gateway creation" option of OpenVPN, the legacy IP gateway is set to the address of the firewall, while the IPv6 gateway address is set to the next address, for example:

Firewall uses: 2001:db8::1
Gateway set to: 2001:db8::2

Because of this the gateway will always be showing as offline.

Actions
Copy link
 #1

Updated by Kris Phillips 27 days ago

  • Status changed from New to Incomplete

Hello,

Please clarify what you mean by "legacy IP" and what you expect the IPv6 address to be. Both of those addresses should be within a /126 for IPv6, so what is invalid about it?

What type of connection is this? I'm assuming this is for an OpenVPN client?

More detail is needed here. Marking as Incomplete until there is sufficient information.

Actions
Copy link
 #2

Updated by Bert Smith 26 days ago

When you create a dual stack OpenVPN server with the following settings:

Gateway creation: both
IPv4 (legacy ip) tunnel network: 192.168.1.0/24
IPv6 tunnel network: 2001:db8:100:c07::/64

The interface is created like this:

 OVPN_UDP (opt5)  -> ovpns1  -> v4: 192.168.1.1/24
                                v6: 2001:db8:100:c07::1/64

ie for both stacks the address "1" is assigned to the ovpns interface on the firewall, and other addresses are used for clients.

There are then two gateways created under routing:

OVPN_UDP_VPNV4        OVPN_UDP    192.168.1.1    192.168.1.1    Interface OVPN_UDP_VPNV4 Gateway       
OVPN_UDP_VPNV6        OVPN_UDP    2001:db8:100:c07::2    2001:db8:100:c07::2    Interface OVPN_UDP_VPNV6 Gateway

As you can see the legacy gateway is .1, which is the firewall, so the gateway monitoring pings the firewall itself which responds and the gateway is marked as up.
The v6 gateway is :2 whereas the firewall is :1, and since there is no client using the :2 address attempts to ping this address fail, which results in the gateway being marked as down.

This is then visible under status->gateways where the legacy gateway shows as online and the v6 gateway shows as offilne with 100% packet loss:

OVPN_UDP_VPNV4    192.168.1.1    192.168.1.1    0.048ms    0.024ms    0.0%    Online    Interface OVPN_UDP_VPNV4 Gateway     
OVPN_UDP_VPNV6    2001:db8:100:c07::2    2001:db8:100:c07::2    0ms    0ms    100%    Offline, Packetloss: 100%    Interface OVPN_UDP_VPNV6 Gateway

Actions
Copy link

Also available in: Atom PDF