FreeBSD 5.3 + Aiccu + ip6fw = not working?
Shadow Hawkins on Wednesday, 23 February 2005 13:42:53
I'll start aiccu normally with 'sixx-aiccu start' and it doesn't give any error messages (even with daemon=false and verbose=true)
but still i cannot ping any remote hosts.
heres some (maybe) usefull information:
ifconfig:
xl0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500
options=9<RXCSUM,VLAN_MTU>
inet6 fe80::210:5aff:fedb:b62e%xl0 prefixlen 64 scopeid 0x1
inet 80.220.194.3 netmask 0xffffe000 broadcast 80.220.223.255
ether 00:10:5a:db:b6:2e
media: Ethernet autoselect (10baseT/UTP)
status: active
gif0: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> mtu 1280
tunnel inet 80.220.194.3 --> 62.78.96.38
inet6 fe80::210:5aff:fedb:b62e%gif0 prefixlen 64 scopeid 0x4
inet6 2001:14b8:100:111::2 prefixlen 128
/etc/rc.conf:
ipv6_firewall_enable="YES"
ipv6_firewall_type="OPEN"
ipv6_firewall_quiet="NO"
ip6fw list:
00100 allow ipv6 from any to any via gif0
00200 deny ipv6 from any to ::1
00300 deny ipv6 from ::1 to any
00450 allow ipv6-icmp from any to 2001:14b8:100:111::2
00550 allow ipv6-icmp from any to 2001:14b8:1b4::/48
00650 allow ipv6-icmp from 2001:14b8:100:111::2 to any
00750 allow ipv6-icmp from 2001:14b8:1b4::/48 to any
65000 allow ipv6 from any to any
65535 deny ipv6 from any to any
ping:
[nahkiss@shell public_html]$ping6 irc.cc.tut.fi
PING6(56=40+8+8 bytes) 2001:14b8:100:111::2 --> 2001:708:310:4952:4320:436c:6965:6e74
^C
--- irc.cc.tut.fi ping6 statistics ---
9 packets transmitted, 0 packets received, 100.0% packet loss
tcpdump:
13:41:33.006872 IP dsl-hkigw7s03.dial.inet.fi > fihel01.sixxs.net: cl-274.hel-01.fi.sixxs.net > pleissi.cc.tut.fi: icmp6: echo request seq 2
13:41:33.038058 IP fihel01.sixxs.net > dsl-hkigw7s03.dial.inet.fi: pleissi.cc.tut.fi > cl-274.hel-01.fi.sixxs.net: icmp6: echo reply seq 2
13:41:34.006875 IP dsl-hkigw7s03.dial.inet.fi > fihel01.sixxs.net: cl-274.hel-01.fi.sixxs.net > pleissi.cc.tut.fi: icmp6: echo request seq 3
13:41:34.038446 IP fihel01.sixxs.net > dsl-hkigw7s03.dial.inet.fi: pleissi.cc.tut.fi > cl-274.hel-01.fi.sixxs.net: icmp6: echo reply seq 3
13:41:35.006908 IP dsl-hkigw7s03.dial.inet.fi > fihel01.sixxs.net: cl-274.hel-01.fi.sixxs.net > pleissi.cc.tut.fi: icmp6: echo request seq 4
13:41:35.039839 IP fihel01.sixxs.net > dsl-hkigw7s03.dial.inet.fi: pleissi.cc.tut.fi > cl-274.hel-01.fi.sixxs.net: icmp6: echo reply seq 4
and here's 'sixxs-aiccu autotest > aiccu.txt' :
Tunnel Information for T5595:
POP Id : fihel01
IPv6 Local : 2001:14b8:100:111::2/64
IPv6 Remote : 2001:14b8:100:111::1/64
Tunnel Type : 6in4-heartbeat
Adminstate : enabled
Userstate : enabled
#######
####### AICCU Quick Connectivity Test
#######
####### [1/8] Ping the IPv4 Local/Your Outer Endpoint (80.220.194.3)
### This should return so called 'echo replies'
### If it doesn't then check your firewall settings
### Your local endpoint should always be pingable
### It could also indicate problems with your IPv4 stack
PING 80.220.194.3 (80.220.194.3): 56 data bytes
64 bytes from 80.220.194.3: icmp_seq=0 ttl=64 time=0.207 ms
64 bytes from 80.220.194.3: icmp_seq=1 ttl=64 time=0.103 ms
64 bytes from 80.220.194.3: icmp_seq=2 ttl=64 time=0.136 ms
--- 80.220.194.3 ping statistics ---
3 packets transmitted, 3 packets received, 0% packet loss
round-trip min/avg/max/stddev = 0.103/0.149/0.207/0.043 ms
######
####### [2/8] Ping the IPv4 Remote/POP Outer Endpoint (62.78.96.38)
### These pings should reach the POP and come back to you
### In case there are problems along the route between your
### host and the POP this could not return replies
### Check your firewall settings if problems occur
PING 62.78.96.38 (62.78.96.38): 56 data bytes
64 bytes from 62.78.96.38: icmp_seq=0 ttl=59 time=24.986 ms
64 bytes from 62.78.96.38: icmp_seq=1 ttl=59 time=24.901 ms
64 bytes from 62.78.96.38: icmp_seq=2 ttl=59 time=24.787 ms
--- 62.78.96.38 ping statistics ---
3 packets transmitted, 3 packets received, 0% packet loss
round-trip min/avg/max/stddev = 24.787/24.891/24.986/0.082 ms
######
####### [3/8] Traceroute to the POP (62.78.96.38) over IPv4
### This traceroute should reach the POP
### In case this traceroute fails then you have no connectivity
### to the POP and this is most probably the problem
traceroute to 62.78.96.38 (62.78.96.38), 64 hops max, 40 byte packets
1 hkimmlgw7.dsl.inet.fi (80.222.96.1) 19.009 ms 20.001 ms 19.846 ms
2 141.208.207.145 (141.208.207.145) 70.248 ms 19.831 ms 19.670 ms
3 141.208.205.214 (141.208.205.214) 19.765 ms 19.800 ms 19.730 ms
4 finnet.ficix2-ge.ficix.fi (193.110.224.20) 19.660 ms 19.315 ms 20.613 ms
5 van5r3.kv9.net (217.78.198.78) 20.603 ms 20.280 ms 20.574 ms
6 fihel01.sixxs.net (62.78.96.38) 24.720 ms 24.402 ms 23.941 ms
######
###### [4/8] Checking if we can ping IPv6 localhost (::1)
### This confirms if your IPv6 is working
### If ::1 doesn't reply then something is wrong with your IPv6 stack
PING6(56=40+8+8 bytes) ::1 --> ::1
16 bytes from ::1: Echo Request
16 bytes from ::1, icmp_seq=0 hlim=64 dst=::1%3 time=0.548 ms
16 bytes from ::1: Echo Request
16 bytes from ::1, icmp_seq=1 hlim=64 dst=::1%3 time=0.444 ms
16 bytes from ::1: Echo Request
16 bytes from ::1, icmp_seq=2 hlim=64 dst=::1%3 time=0.419 ms
--- ::1 ping6 statistics ---
3 packets transmitted, 3 packets received, 0.0% packet loss
round-trip min/avg/max/std-dev = 0.419/0.470/0.548/0.056 ms
######
###### [5/8] Ping the IPv6 Local/Your Inner Tunnel Endpoint (2001:14b8:100:111::2)
### This confirms that your tunnel is configured
### If it doesn't reply then check your interface and routing tables
PING6(56=40+8+8 bytes) 2001:14b8:100:111::2 --> 2001:14b8:100:111::2
16 bytes from 2001:14b8:100:111::2: Echo Request
16 bytes from 2001:14b8:100:111::2, icmp_seq=0 hlim=64 dst=2001:14b8:100:111::2%3 time=0.510 ms
16 bytes from 2001:14b8:100:111::2: Echo Request
16 bytes from 2001:14b8:100:111::2, icmp_seq=1 hlim=64 dst=2001:14b8:100:111::2%3 time=0.447 ms
16 bytes from 2001:14b8:100:111::2: Echo Request
16 bytes from 2001:14b8:100:111::2, icmp_seq=2 hlim=64 dst=2001:14b8:100:111::2%3 time=0.415 ms
--- 2001:14b8:100:111::2 ping6 statistics ---
3 packets transmitted, 3 packets received, 0.0% packet loss
round-trip min/avg/max/std-dev = 0.415/0.457/0.510/0.039 ms
######
###### [6/8] Ping the IPv6 Remote/POP Inner Tunnel Endpoint (2001:14b8:100:111::1)
### This confirms the reachability of the other side of the tunnel
### If it doesn't reply then check your interface and routing tables
### Don't forget to check your firewall of course
### If the previous test was succesful then this could be both
### a firewalling and a routing/interface problem
PING6(56=40+8+8 bytes) 2001:14b8:100:111::2 --> 2001:14b8:100:111::1
--- 2001:14b8:100:111::1 ping6 statistics ---
3 packets transmitted, 0 packets received, 100.0% packet loss
######
###### [7/8] Traceroute6 to the central SixXS machine (noc.sixxs.net)
### This confirms that you can reach the central machine of SixXS
### If that one is reachable you should be able to reach most IPv6 destinations
### Also check http://www.sixxs.net/ipv6calc/ which should show an IPv6 connection
### If your browser supports IPv6 and uses it of course.
traceroute6 to noc.sixxs.net (2001:838:1:1:210:dcff:fe20:7c7c) from 2001:14b8:100:111::2, 64 hops max, 12 byte packets
1 * * *
2 * * *
3 * * *
4 * * *
5 * * *
6 * * *
7 * * *
8 * * *
9 * * *
10 * * *
11 * * *
12 * * *
13 * * *
14 * * *
15 * * *
16 * * *
17 *
######
###### [8/8] Traceroute6 to (www.kame.net)
### This confirms that you can reach a Japanese IPv6 destination
### If that one is reachable you should be able to reach most IPv6 destinations
### You should also check http://www.kame.net which should display
### a animated kame (turtle), of course only when your browser supports and uses IPv6
######
###### ACCU Quick Connectivity Test (done)
### Either the above all works and gives no problems
### or it shows you where what goes wrong
### Check the SixXS FAQ (http://www.sixxs.net/faq/
### for more information and possible solutions or hints
### Don't forget to check the Forums (http://www.sixxs.net/forum/)
### for a helping hand.
### Passing the output of 'aiccu autotest >aiccu.log' is a good idea.
FreeBSD 5.3 + Aiccu + ip6fw = not working?
Jeroen Massar on Wednesday, 23 February 2005 13:47:41
And how does your IPv4 firewall look like?
FreeBSD 5.3 + Aiccu + ip6fw = not working?
Shadow Hawkins on Wednesday, 23 February 2005 14:26:50
00100 skipto 300 ip from any to any recv xl0
00200 allow ip from any to any
00300 allow tcp from any to any established
00400 allow tcp from any to any tcpflags ack
00500 allow udp from any 53 to any dst-port 1024-65535
00600 allow icmp from any to any icmptypes 0,3,4,11,12
00700 allow tcp from any to any dst-port 22
00800 allow tcp from any to any dst-port 113
00850 allow tcp from any to any dst-port 80
00862 allow tcp from any to any dst-port 6667
00868 allow tcp from any to any dst-port 25,993,995
00875 allow tcp from any to any dst-port 10000
00900 allow icmp from any to any icmptypes 8
01100 deny tcp from any to any dst-port 2049-2050
01200 deny tcp from any to any dst-port 6000-6063
01300 deny tcp from any to any dst-port 7000-7010
01400 deny tcp from any to any dst-port 1024-65535
65535 deny ip from any to any
FreeBSD 5.3 + Aiccu + ip6fw = not working?
Jeroen Massar on Wednesday, 23 February 2005 14:48:48
use 'ipfw show' this will also show you the counters. if xl0 is your internet facing interface you will not be accepting proto-41 and thus your tunnel won't work.
FreeBSD 5.3 + Aiccu + ip6fw = not working?
Shadow Hawkins on Wednesday, 23 February 2005 15:54:55
ahh, okay, now its working, thanks
FreeBSD 5.3 + Aiccu + ip6fw = not working?
Shadow Hawkins on Thursday, 07 April 2005 19:31:05
Okay, I'm having this problem again, just rebooted it and not working...
this time i already have 'allow ipv6 any to any' in ipfw...
[root@rainbox ~]$ip6fw show
00100 0 0 allow tcp from any to any
65000 424 6916 allow ipv6 from any to any
65535 5 152 deny ipv6 from any to any
[root@rainbox ~]$ipfw show
00100 69153 6945665 skipto 300 ip from any to any recv xl0
00175 439 33512 allow ipv6 from any to any
00181 0 0 allow ipv6-route from any to any
00187 0 0 allow ipv6-frag from any to any
00200 64681 18940568 allow ip from any to any
00300 56893 5342638 allow tcp from any to any established
00400 0 0 allow tcp from any to any tcpflags ack
00500 5175 991765 allow udp from any 53 to any dst-port 1024-65535
00600 60 4740 allow icmp from any to any icmptypes 0,3,4,11,12
00700 8 432 allow tcp from any to any dst-port 22
00701 0 0 allow tcp from any to any dst-port 6666
00800 6 320 allow tcp from any to any dst-port 113
00850 256 14020 allow tcp from any to any dst-port 80
00862 0 0 allow tcp from any to any dst-port 6667
00868 5 260 allow tcp from any to any dst-port 25,993,995
00875 0 0 allow tcp from any to any dst-port 10000
00899 0 0 allow udp from any to any dst-port 3740
00900 6 336 allow icmp from any to any icmptypes 8
01100 0 0 deny tcp from any to any dst-port 2049-2050
01200 0 0 deny tcp from any to any dst-port 6000-6063
01300 0 0 deny tcp from any to any dst-port 7000-7010
01400 169 8540 deny tcp from any to any dst-port 1024-65535
65535 6580 582918 deny ip from any to any
[root@rainbox ~]$ifconfig
xl0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500
options=9<RXCSUM,VLAN_MTU>
inet6 fe80::210:5aff:fedb:b62e%xl0 prefixlen 64 scopeid 0x1
inet 84.249.17.70 netmask 0xffffe000 broadcast 84.249.31.255
ether 00:10:5a:db:b6:2e
media: Ethernet autoselect (10baseT/UTP)
status: active
lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> mtu 16384
inet 127.0.0.1 netmask 0xff000000
inet6 ::1 prefixlen 128
inet6 fe80::1%lo0 prefixlen 64 scopeid 0x3
gif0: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> mtu 1280
tunnel inet 84.249.17.70 --> 62.78.96.38
inet6 fe80::210:5aff:fedb:b62e%gif0 prefixlen 64 scopeid 0x4
inet6 2001:14b8:100:111::2 --> 2001:14b8:100:111::1 prefixlen 128
everything seems ok to me but i cannot ping any remote site (yes, i can ping ::1 and 2001:14b8:100:111::2 but not anything else)
FreeBSD 5.3 + Aiccu + ip6fw = not working?
Jeroen Massar on Thursday, 07 April 2005 20:14:11
and what does a tcpdump of the ipv4 interface show? Are the packets getting out? Are you getting return results, use -n btw, addresses are better than hostnames in debugging cases.
FreeBSD 5.3 + Aiccu + ip6fw = not working?
Shadow Hawkins on Friday, 08 April 2005 11:06:48
edit:double post
FreeBSD 5.3 + Aiccu + ip6fw = not working?
Shadow Hawkins on Friday, 08 April 2005 11:05:30
[root@rainbox ~]$tcpdump -n | grep icmp6
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on xl0, link-type EN10MB (Ethernet), capture size 96 bytes
12:04:03.069569 IP 84.249.17.70 > 62.78.96.38: 2001:14b8:100:111::2 > 2001:14b8:100:111::1: icmp6: echo request seq 3
12:04:03.094078 IP 62.78.96.38 > 84.249.17.70: 2001:14b8:100:111::1 > 2001:14b8:100:111::2: icmp6: echo reply seq 3
Seems they get out and in but still 100% packet loss...
FreeBSD 5.3 + Aiccu + ip6fw = not working?
Jeroen Massar on Friday, 08 April 2005 11:45:33
Which quite logically means this is a firewalling issue on your box.
Check your firewall rules, use the counters and log statements ;)
Posting is only allowed when you are logged in. |