SixXS::Sunset 2017-06-06

ayiya tunnel not recovering from IPv4 outage
[gb] Shadow Hawkins on Thursday, 03 July 2014 16:09:43
Hi I have an ayiya tunnel on a Raspberry Pi running FreeBSD 10.0-RELEASE. The Pi is behind a NAT ADSL router which is not 100% stable. The ADSL router seems to need rebooting every month or so. When the router is rebooted the ayiya tunnel fails, but once IPv4 connectivity comes back the ayiya tunnel doesn't seem to recover. Or maybe I'm not waiting long enough? doing service sixxs-aiccu restart didn't work I seem to have to do service sixxs-aiccu stop then service sixxs-aiccu start as separate commmands this is the software that is installed on the Pi # pkg info bash-4.3.11_2 The GNU Project's Bourne Again SHell bison-2.7.1,1 Parser generator from FSF, (mostly) compatible with Yacc ca_root_nss-3.16 The root certificate bundle from the Mozilla Project dialog4ports-0.1.5_2 Console Interface to configure ports gettext-0.18.3.1_1 GNU gettext package gmake-3.82_1 GNU version of 'make' utility gmp-5.1.3_2 Free library for arbitrary precision arithmetic gnutls-2.12.23_5 GNU Transport Layer Security library libffi-3.0.13_1 Foreign Function Interface libgpg-error-1.13 Common error values for all GnuPG components libtasn1-3.3 ASN.1 structure parser library libtool-2.4.2_3 Generic shared library support script m4-1.4.17_1,1 GNU m4 nettle-2.7.1 Low-level cryptographic library p11-kit-0.20.2_1 Library for loading and enumerating of PKCS#11 modules perl5-5.16.3_9 Practical Extraction and Report Language pkg-1.2.7_2 Package manager pkgconf-0.9.5 Utility to help to configure compiler and linker flags sixxs-aiccu-20070115_3 SixXS IPv6 TIC+ tunnel broker heartbeat client srm-1.2.12 Secure rm, a utility which destroys file contents before unlinking this is my rc.conf # less rc.conf hostname="raspberry-pi" ifconfig_ue0="DHCP" sshd_enable="YES" # Turn off a lot of standard stuff # for more free memory. cron_enable="NO" #devd is necessary for proper DHCP operation; # don't disable unless you know how to run DHCP manually. #devd_enable="NO" sendmail_submit_enable="NO" sendmail_outbound_enable="NO" sendmail_msp_queue_enable="NO" # On first boot, enlarge the root filesystem to fill the SD card autosize_enable="YES" syslogd_enable="YES" syslogd_flags="-s -v -v" ntpdate_enable="YES" ntpdate_hosts="pool.ntp.org" ntpdate_flags="-b pool.ntp.org" ntpd_enable="YES" sixxs_aiccu_enable="YES" ipv6_gateway_enable="YES" ipv6_interfaces="auto" ipv6_activate_all_interfaces="YES" ipv6_cpe_wanif="tun0" ifconfig_ue0_ipv6="inet6 2a01:xxx:y:zzzz::1 prefixlen 64" cloned_interfaces="tun0" rtadvd_enable="YES" rtadvd_interfaces="ue0" this is my aiccu.conf # cat aiccu.conf # AICCU Configuration # Login information (defaults: none) username username password password # Protocol and server to use for setting up the tunnel (defaults: none) protocol tic server tic.sixxs.net # Interface names to use (default: aiccu) # ipv6_interface is the name of the interface that will be used as a tunnel interface. # On *BSD the ipv6_interface should be set to gifX (eg gif0) for proto-41 tunnels # or tunX (eg tun0) for AYIYA tunnels. ipv6_interface tun0 # The tunnel_id to use (default: none) # (only required when there are multiple tunnels in the list) tunnel_id T123456 # Be verbose? (default: false) verbose true # Daemonize? (default: true) # Set to false if you want to see any output # When true output goes to syslog # # WARNING: never run AICCU from DaemonTools or a similar automated # 'restart' tool/script. When AICCU does not start, it has a reason # not to start which it gives on either the stdout or in the (sys)log # file. The TIC server *will* automatically disable accounts which # are detected to run in this mode. # daemonize true #daemonize false # Automatic Login and Tunnel activation? automatic true # Require TLS? # When set to true, if TLS is not supported on the server # the TIC transaction will fail. # When set to false, it will try a starttls, when that is # not supported it will continue. # In any case if AICCU is build with TLS support it will # try to do a 'starttls' to the TIC server to see if that # is supported. requiretls false # PID File pidfile /var/run/aiccu.pid # Add a default route (default: true) defaultroute true # Script to run after setting up the interfaces (default: none) #setupscript /usr/local/etc/aiccu-subnets.sh # Make heartbeats (default true) # In general you don't want to turn this off # Of course only applies to AYIYA and heartbeat tunnels not to static ones #makebeats true # Don't configure anything (default: false) #noconfigure true # Behind NAT (default: false) # Notify the user that a NAT-kind network is detected #behindnat true # Local IPv4 Override (default: none) # Overrides the IPv4 parameter received from TIC # This allows one to configure a NAT into "DMZ" mode and then # forwarding the proto-41 packets to an internal host. # # This is only needed for static proto-41 tunnels! # AYIYA and heartbeat tunnels don't require this. #local_ipv4_override thanks
ayiya tunnel not recovering from IPv4 outage
[ch] Jeroen Massar SixXS Staff on Thursday, 03 July 2014 16:23:06
The Pi is behind a NAT ADSL router which is not 100% stable. The ADSL router seems to need rebooting > every month or so.
Can you define "not 100% stable"? What happens? What model/version modem is it?
When the router is rebooted the ayiya tunnel fails, but once IPv4 connectivity comes back the ayiya
tunnel doesn't seem to recover.
What do you mean with "fail"? What happens, any technical details?
Or maybe I'm not waiting long enough?
AYIYA causes endpoint updates with every packet sent next to a regular heartbeat. Hence when a packet is able to pass outbound an inbound packet is able to follow again too (which is also a requirement for most NAT state or even firewalls to pass packets from the Internet, eg the PoP, back to AICCU).
this is the software that is installed on the Pi
sixxs-aiccu-20070115_3 SixXS IPv6 TIC+ tunnel broker heartbeat client
Distributions tend to apply patches, you'll have to check what those patches are.
this is my rc.conf
Configuration instructions can mismatch with what is actually running, hence check that everything is actually set up correctly.

Please note Posting is only allowed when you are logged in.

Static Sunset Edition of SixXS
©2001-2017 SixXS - IPv6 Deployment & Tunnel Broker