[8.170][QUESTION][ANSWERED] IPv6 Configuration - Tunnel Broker

First off let me say I'm VERY much an IPv6 n00b.  I have done practically nothing with IPv6.

I followed a tutorial by Billybob over here to get my IPv6 network up and running.  I had to tweak it a bit for 8.2.

The tunnel broker seems to work fine as I can browse IPv6 sites, however my "public" IP address shows as the tunnel broker address per this link.

I checked the masquerading setting and such per Paul (InTheAir) but everything seems right.  Is it correct that the public address I'm seeing is the address of the tunnel broker?  I would like to ultimately configure my web server to work with IPv6 but if the IPv6 block I was given is NATed or something else is up then I need to remedy that first.  Could be I just have my Astaro config nutted up.

Again, I'm very new to IPv6 so I might have missed something huge so please take pitty on this n00b.  [:S]  Thanks so much!!!

0 Astaro Beta Bot over 13 years ago

Astaro Beta Report

--------------------------------

Version: 8.170

Type: QUESTION

State: ANSWERED

Reporter: danodemano

Contributor: RFCat_vk, InTheAir, Scott_Klassen

MantisID: 

Target version: 

Fixed in version: 

--------------------------------

0 RFCat_vk_01 over 13 years ago in reply to Astaro Beta Bot

Hi and welcome to IPv6,
a couple of questions.
1/. what mode is you http proxy running in? If transparent without https scanning you will see your IPv6 outside
2/. what PF rules do you have in place that will allow IPv6 out?

And finally, IPv6 is not NAT'd.

So for incoming you would need a packet filter rule allowing the external address (any) port to point at the internal server IPv6 address.

Regards.

Ian
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 Scott_Klassen over 13 years ago

It isn't natted, but you are surfing through a proxy, so the address from the perspective of an external website is going to be the one for the WAN/proxy (In the case of IPv6, it's going to be the tunnel broker address). If the proxy is in transparent mode, you'll need to add your PC to the transparent mode skiplist in order for the PC's IP address to be apparent to website.

__________________
ACE v8/SCA v9.3

...still have a v5 install disk in a box somewhere.

http://xkcd.com
http://www.tedgoff.com/mb
http://www.projectcartoon.com/cartoon/1
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 RFCat_vk_01 over 13 years ago in reply to Scott_Klassen

Hi Scott,
thank you for the extra bit of info I forgot include.

Ian
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 danodemano over 13 years ago in reply to Scott_Klassen

It isn't natted, but you are surfing through a proxy, so the address from the perspective of an external website is going to be the one for the WAN/proxy (In the case of IPv6, it's going to be the tunnel broker address). If the proxy is in transparent mode, you'll need to add your PC to the transparent mode skiplist in order for the PC's IP address to be apparent to website.

Ahhh, that was the nugget of information I was missing! I didn't realize that the tunnel broken was actually acting as a proxy....though had I thought about it for a few minutes I might have come to that conclusion. I guess I thought it was just routing but it can't because it had to encapsulate that IPv6 information into IPv4 to get it from the broken back to my Astaro box as my ISP doesn't currently support IPv6.

Thanks so much!
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 PaulHolt over 13 years ago in reply to danodemano

Danodemano, I figured out my missing instruction. In the proxy profile check the "Full Transparent Mode" box. What this does is tell the proxy to allow the private IP address through the proxy. This affects both IPv4 and IPv6 addresses but with the masquerade setting set for IPv4 only it then does the NAT for IPv4...all is well for IPv4 going out onto the web. Now, IPv6 on the other hand is allowed out with the IPv6 address intact. If you put a machine into the transparent mode skiplist it no longer is web filtered ( it tested this just now to be sure) so everyone is allowed to surf wherever they please. Also, the way it works on my system the skip list traffic isn't logged either, I don't think you have a choice here. It would be nice if you could though.

Paul
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 danodemano over 13 years ago in reply to PaulHolt

Paul,
That box is grayed out when I go there (see screenshot). Is there something else I need to change first?
- proxy.png
- View
- Hide
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 PaulHolt over 13 years ago in reply to danodemano

That is the global setting. I use proxy profiles and you can set it there.

Paul
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 danodemano over 13 years ago

I don't have any proxy profiles. Do I have to create one first?
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 PaulHolt over 13 years ago in reply to danodemano

Yes, so you must use the URL Filtering tab to do your filter settings then. If so then use the same settings in your proxy profile because those global settings will no longer apply.

That should replicate your current setup and allow full transparent mode.

Paul
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel