SixXS::Sunset 2017-06-06

FreeBSD 5.3 + Aiccu + ip6fw = not working?
[fi] Shadow Hawkins on Wednesday, 23 February 2005 13:42:53
I'll start aiccu normally with 'sixx-aiccu start' and it doesn't give any error messages (even with daemon=false and verbose=true) but still i cannot ping any remote hosts. heres some (maybe) usefull information: ifconfig: xl0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500 options=9<RXCSUM,VLAN_MTU> inet6 fe80::210:5aff:fedb:b62e%xl0 prefixlen 64 scopeid 0x1 inet 80.220.194.3 netmask 0xffffe000 broadcast 80.220.223.255 ether 00:10:5a:db:b6:2e media: Ethernet autoselect (10baseT/UTP) status: active gif0: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> mtu 1280 tunnel inet 80.220.194.3 --> 62.78.96.38 inet6 fe80::210:5aff:fedb:b62e%gif0 prefixlen 64 scopeid 0x4 inet6 2001:14b8:100:111::2 prefixlen 128 /etc/rc.conf: ipv6_firewall_enable="YES" ipv6_firewall_type="OPEN" ipv6_firewall_quiet="NO" ip6fw list: 00100 allow ipv6 from any to any via gif0 00200 deny ipv6 from any to ::1 00300 deny ipv6 from ::1 to any 00450 allow ipv6-icmp from any to 2001:14b8:100:111::2 00550 allow ipv6-icmp from any to 2001:14b8:1b4::/48 00650 allow ipv6-icmp from 2001:14b8:100:111::2 to any 00750 allow ipv6-icmp from 2001:14b8:1b4::/48 to any 65000 allow ipv6 from any to any 65535 deny ipv6 from any to any ping: [nahkiss@shell public_html]$ping6 irc.cc.tut.fi PING6(56=40+8+8 bytes) 2001:14b8:100:111::2 --> 2001:708:310:4952:4320:436c:6965:6e74 ^C --- irc.cc.tut.fi ping6 statistics --- 9 packets transmitted, 0 packets received, 100.0% packet loss tcpdump: 13:41:33.006872 IP dsl-hkigw7s03.dial.inet.fi > fihel01.sixxs.net: cl-274.hel-01.fi.sixxs.net > pleissi.cc.tut.fi: icmp6: echo request seq 2 13:41:33.038058 IP fihel01.sixxs.net > dsl-hkigw7s03.dial.inet.fi: pleissi.cc.tut.fi > cl-274.hel-01.fi.sixxs.net: icmp6: echo reply seq 2 13:41:34.006875 IP dsl-hkigw7s03.dial.inet.fi > fihel01.sixxs.net: cl-274.hel-01.fi.sixxs.net > pleissi.cc.tut.fi: icmp6: echo request seq 3 13:41:34.038446 IP fihel01.sixxs.net > dsl-hkigw7s03.dial.inet.fi: pleissi.cc.tut.fi > cl-274.hel-01.fi.sixxs.net: icmp6: echo reply seq 3 13:41:35.006908 IP dsl-hkigw7s03.dial.inet.fi > fihel01.sixxs.net: cl-274.hel-01.fi.sixxs.net > pleissi.cc.tut.fi: icmp6: echo request seq 4 13:41:35.039839 IP fihel01.sixxs.net > dsl-hkigw7s03.dial.inet.fi: pleissi.cc.tut.fi > cl-274.hel-01.fi.sixxs.net: icmp6: echo reply seq 4 and here's 'sixxs-aiccu autotest > aiccu.txt' : Tunnel Information for T5595: POP Id : fihel01 IPv6 Local : 2001:14b8:100:111::2/64 IPv6 Remote : 2001:14b8:100:111::1/64 Tunnel Type : 6in4-heartbeat Adminstate : enabled Userstate : enabled ####### ####### AICCU Quick Connectivity Test ####### ####### [1/8] Ping the IPv4 Local/Your Outer Endpoint (80.220.194.3) ### This should return so called 'echo replies' ### If it doesn't then check your firewall settings ### Your local endpoint should always be pingable ### It could also indicate problems with your IPv4 stack PING 80.220.194.3 (80.220.194.3): 56 data bytes 64 bytes from 80.220.194.3: icmp_seq=0 ttl=64 time=0.207 ms 64 bytes from 80.220.194.3: icmp_seq=1 ttl=64 time=0.103 ms 64 bytes from 80.220.194.3: icmp_seq=2 ttl=64 time=0.136 ms --- 80.220.194.3 ping statistics --- 3 packets transmitted, 3 packets received, 0% packet loss round-trip min/avg/max/stddev = 0.103/0.149/0.207/0.043 ms ###### ####### [2/8] Ping the IPv4 Remote/POP Outer Endpoint (62.78.96.38) ### These pings should reach the POP and come back to you ### In case there are problems along the route between your ### host and the POP this could not return replies ### Check your firewall settings if problems occur PING 62.78.96.38 (62.78.96.38): 56 data bytes 64 bytes from 62.78.96.38: icmp_seq=0 ttl=59 time=24.986 ms 64 bytes from 62.78.96.38: icmp_seq=1 ttl=59 time=24.901 ms 64 bytes from 62.78.96.38: icmp_seq=2 ttl=59 time=24.787 ms --- 62.78.96.38 ping statistics --- 3 packets transmitted, 3 packets received, 0% packet loss round-trip min/avg/max/stddev = 24.787/24.891/24.986/0.082 ms ###### ####### [3/8] Traceroute to the POP (62.78.96.38) over IPv4 ### This traceroute should reach the POP ### In case this traceroute fails then you have no connectivity ### to the POP and this is most probably the problem traceroute to 62.78.96.38 (62.78.96.38), 64 hops max, 40 byte packets 1 hkimmlgw7.dsl.inet.fi (80.222.96.1) 19.009 ms 20.001 ms 19.846 ms 2 141.208.207.145 (141.208.207.145) 70.248 ms 19.831 ms 19.670 ms 3 141.208.205.214 (141.208.205.214) 19.765 ms 19.800 ms 19.730 ms 4 finnet.ficix2-ge.ficix.fi (193.110.224.20) 19.660 ms 19.315 ms 20.613 ms 5 van5r3.kv9.net (217.78.198.78) 20.603 ms 20.280 ms 20.574 ms 6 fihel01.sixxs.net (62.78.96.38) 24.720 ms 24.402 ms 23.941 ms ###### ###### [4/8] Checking if we can ping IPv6 localhost (::1) ### This confirms if your IPv6 is working ### If ::1 doesn't reply then something is wrong with your IPv6 stack PING6(56=40+8+8 bytes) ::1 --> ::1 16 bytes from ::1: Echo Request 16 bytes from ::1, icmp_seq=0 hlim=64 dst=::1%3 time=0.548 ms 16 bytes from ::1: Echo Request 16 bytes from ::1, icmp_seq=1 hlim=64 dst=::1%3 time=0.444 ms 16 bytes from ::1: Echo Request 16 bytes from ::1, icmp_seq=2 hlim=64 dst=::1%3 time=0.419 ms --- ::1 ping6 statistics --- 3 packets transmitted, 3 packets received, 0.0% packet loss round-trip min/avg/max/std-dev = 0.419/0.470/0.548/0.056 ms ###### ###### [5/8] Ping the IPv6 Local/Your Inner Tunnel Endpoint (2001:14b8:100:111::2) ### This confirms that your tunnel is configured ### If it doesn't reply then check your interface and routing tables PING6(56=40+8+8 bytes) 2001:14b8:100:111::2 --> 2001:14b8:100:111::2 16 bytes from 2001:14b8:100:111::2: Echo Request 16 bytes from 2001:14b8:100:111::2, icmp_seq=0 hlim=64 dst=2001:14b8:100:111::2%3 time=0.510 ms 16 bytes from 2001:14b8:100:111::2: Echo Request 16 bytes from 2001:14b8:100:111::2, icmp_seq=1 hlim=64 dst=2001:14b8:100:111::2%3 time=0.447 ms 16 bytes from 2001:14b8:100:111::2: Echo Request 16 bytes from 2001:14b8:100:111::2, icmp_seq=2 hlim=64 dst=2001:14b8:100:111::2%3 time=0.415 ms --- 2001:14b8:100:111::2 ping6 statistics --- 3 packets transmitted, 3 packets received, 0.0% packet loss round-trip min/avg/max/std-dev = 0.415/0.457/0.510/0.039 ms ###### ###### [6/8] Ping the IPv6 Remote/POP Inner Tunnel Endpoint (2001:14b8:100:111::1) ### This confirms the reachability of the other side of the tunnel ### If it doesn't reply then check your interface and routing tables ### Don't forget to check your firewall of course ### If the previous test was succesful then this could be both ### a firewalling and a routing/interface problem PING6(56=40+8+8 bytes) 2001:14b8:100:111::2 --> 2001:14b8:100:111::1 --- 2001:14b8:100:111::1 ping6 statistics --- 3 packets transmitted, 0 packets received, 100.0% packet loss ###### ###### [7/8] Traceroute6 to the central SixXS machine (noc.sixxs.net) ### This confirms that you can reach the central machine of SixXS ### If that one is reachable you should be able to reach most IPv6 destinations ### Also check http://www.sixxs.net/ipv6calc/ which should show an IPv6 connection ### If your browser supports IPv6 and uses it of course. traceroute6 to noc.sixxs.net (2001:838:1:1:210:dcff:fe20:7c7c) from 2001:14b8:100:111::2, 64 hops max, 12 byte packets 1 * * * 2 * * * 3 * * * 4 * * * 5 * * * 6 * * * 7 * * * 8 * * * 9 * * * 10 * * * 11 * * * 12 * * * 13 * * * 14 * * * 15 * * * 16 * * * 17 * ###### ###### [8/8] Traceroute6 to (www.kame.net) ### This confirms that you can reach a Japanese IPv6 destination ### If that one is reachable you should be able to reach most IPv6 destinations ### You should also check http://www.kame.net which should display ### a animated kame (turtle), of course only when your browser supports and uses IPv6 ###### ###### ACCU Quick Connectivity Test (done) ### Either the above all works and gives no problems ### or it shows you where what goes wrong ### Check the SixXS FAQ (http://www.sixxs.net/faq/ ### for more information and possible solutions or hints ### Don't forget to check the Forums (http://www.sixxs.net/forum/) ### for a helping hand. ### Passing the output of 'aiccu autotest >aiccu.log' is a good idea.
FreeBSD 5.3 + Aiccu + ip6fw = not working?
[ch] Jeroen Massar SixXS Staff on Wednesday, 23 February 2005 13:47:41
And how does your IPv4 firewall look like?
FreeBSD 5.3 + Aiccu + ip6fw = not working?
[fi] Shadow Hawkins on Wednesday, 23 February 2005 14:26:50
00100 skipto 300 ip from any to any recv xl0 00200 allow ip from any to any 00300 allow tcp from any to any established 00400 allow tcp from any to any tcpflags ack 00500 allow udp from any 53 to any dst-port 1024-65535 00600 allow icmp from any to any icmptypes 0,3,4,11,12 00700 allow tcp from any to any dst-port 22 00800 allow tcp from any to any dst-port 113 00850 allow tcp from any to any dst-port 80 00862 allow tcp from any to any dst-port 6667 00868 allow tcp from any to any dst-port 25,993,995 00875 allow tcp from any to any dst-port 10000 00900 allow icmp from any to any icmptypes 8 01100 deny tcp from any to any dst-port 2049-2050 01200 deny tcp from any to any dst-port 6000-6063 01300 deny tcp from any to any dst-port 7000-7010 01400 deny tcp from any to any dst-port 1024-65535 65535 deny ip from any to any
FreeBSD 5.3 + Aiccu + ip6fw = not working?
[ch] Jeroen Massar SixXS Staff on Wednesday, 23 February 2005 14:48:48
use 'ipfw show' this will also show you the counters. if xl0 is your internet facing interface you will not be accepting proto-41 and thus your tunnel won't work.
FreeBSD 5.3 + Aiccu + ip6fw = not working?
[fi] Shadow Hawkins on Wednesday, 23 February 2005 15:54:55
ahh, okay, now its working, thanks
FreeBSD 5.3 + Aiccu + ip6fw = not working?
[fi] Shadow Hawkins on Thursday, 07 April 2005 19:31:05
Okay, I'm having this problem again, just rebooted it and not working... this time i already have 'allow ipv6 any to any' in ipfw... [root@rainbox ~]$ip6fw show 00100 0 0 allow tcp from any to any 65000 424 6916 allow ipv6 from any to any 65535 5 152 deny ipv6 from any to any [root@rainbox ~]$ipfw show 00100 69153 6945665 skipto 300 ip from any to any recv xl0 00175 439 33512 allow ipv6 from any to any 00181 0 0 allow ipv6-route from any to any 00187 0 0 allow ipv6-frag from any to any 00200 64681 18940568 allow ip from any to any 00300 56893 5342638 allow tcp from any to any established 00400 0 0 allow tcp from any to any tcpflags ack 00500 5175 991765 allow udp from any 53 to any dst-port 1024-65535 00600 60 4740 allow icmp from any to any icmptypes 0,3,4,11,12 00700 8 432 allow tcp from any to any dst-port 22 00701 0 0 allow tcp from any to any dst-port 6666 00800 6 320 allow tcp from any to any dst-port 113 00850 256 14020 allow tcp from any to any dst-port 80 00862 0 0 allow tcp from any to any dst-port 6667 00868 5 260 allow tcp from any to any dst-port 25,993,995 00875 0 0 allow tcp from any to any dst-port 10000 00899 0 0 allow udp from any to any dst-port 3740 00900 6 336 allow icmp from any to any icmptypes 8 01100 0 0 deny tcp from any to any dst-port 2049-2050 01200 0 0 deny tcp from any to any dst-port 6000-6063 01300 0 0 deny tcp from any to any dst-port 7000-7010 01400 169 8540 deny tcp from any to any dst-port 1024-65535 65535 6580 582918 deny ip from any to any [root@rainbox ~]$ifconfig xl0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500 options=9<RXCSUM,VLAN_MTU> inet6 fe80::210:5aff:fedb:b62e%xl0 prefixlen 64 scopeid 0x1 inet 84.249.17.70 netmask 0xffffe000 broadcast 84.249.31.255 ether 00:10:5a:db:b6:2e media: Ethernet autoselect (10baseT/UTP) status: active lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> mtu 16384 inet 127.0.0.1 netmask 0xff000000 inet6 ::1 prefixlen 128 inet6 fe80::1%lo0 prefixlen 64 scopeid 0x3 gif0: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> mtu 1280 tunnel inet 84.249.17.70 --> 62.78.96.38 inet6 fe80::210:5aff:fedb:b62e%gif0 prefixlen 64 scopeid 0x4 inet6 2001:14b8:100:111::2 --> 2001:14b8:100:111::1 prefixlen 128 everything seems ok to me but i cannot ping any remote site (yes, i can ping ::1 and 2001:14b8:100:111::2 but not anything else)
FreeBSD 5.3 + Aiccu + ip6fw = not working?
[ch] Jeroen Massar SixXS Staff on Thursday, 07 April 2005 20:14:11
and what does a tcpdump of the ipv4 interface show? Are the packets getting out? Are you getting return results, use -n btw, addresses are better than hostnames in debugging cases.
FreeBSD 5.3 + Aiccu + ip6fw = not working?
[fi] Shadow Hawkins on Friday, 08 April 2005 11:06:48
edit:double post
FreeBSD 5.3 + Aiccu + ip6fw = not working?
[fi] Shadow Hawkins on Friday, 08 April 2005 11:05:30
[root@rainbox ~]$tcpdump -n | grep icmp6 tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on xl0, link-type EN10MB (Ethernet), capture size 96 bytes 12:04:03.069569 IP 84.249.17.70 > 62.78.96.38: 2001:14b8:100:111::2 > 2001:14b8:100:111::1: icmp6: echo request seq 3 12:04:03.094078 IP 62.78.96.38 > 84.249.17.70: 2001:14b8:100:111::1 > 2001:14b8:100:111::2: icmp6: echo reply seq 3 Seems they get out and in but still 100% packet loss...
FreeBSD 5.3 + Aiccu + ip6fw = not working?
[ch] Jeroen Massar SixXS Staff on Friday, 08 April 2005 11:45:33
Which quite logically means this is a firewalling issue on your box. Check your firewall rules, use the counters and log statements ;)

Please note Posting is only allowed when you are logged in.

Static Sunset Edition of SixXS
©2001-2017 SixXS - IPv6 Deployment & Tunnel Broker