How to set up 2 default routes for IPv6 on Debian automatically on boot to give a fall back
4 Jul
2019
4 Jul
'19
5:53 p.m.
Sorry long long post. tl;dr 2 default IPv6 routes different metrics set up
persistent on Debian.
I need a bit of advice concerning routing IPv6.
Here is the problem. I do quite a bit of travelling around and a lot of it
in SE Asia. I frequently find my self where the relevant ISP does not
provide IPv6 connectivity. Even here at home my connection will
occasionally change my address or I have to reboot the router and get a
different one. I do things over the net for which I want IPv6, but also for
DNS I need a stable fixed address.
So I have an additional /56 subnet allocated to my VPS. Over the years I
have tinkered with different VPN solutions to push these addresses down to
my home network. I have found a different solution which not only was easy
to set up, but works a dream except for one tiny issue.
The /56 has been added to eth0 of my VPS. I am running wireguard and have
it set up interface wg0 to which I route a /60 subnet. <bitfolk
prefix>:e10::/60. Packets hitting this are encrypted with the server key
and then encapsulated in IPv4 UDP packets and sent to the wg0 interface on
my home machine, decrypted and if meeting criteria move through firewall
etc. Sending out it is the same in reverse, encryption being via the client
keypair. The client wg0 has subnet <bitfolk prefix>:e10::2/64, the server
only accepting packets from this range and properly encrypted.
Now here comes the problem. It is the default route issue. All that I read
says that you cannot have 2 default routes in the same table. I have looked
at a variety of solutions but find none except the one everyone seems to
say is impossible but which works. I set the route
*ip -6 route add ::0/0 dev wg0 metric 512. *
Note the metric 512. The autoconfigured one has a metric of 1024. which
gives me
*ip -6 routedefault dev wg0 metric 512 pref mediumdefault via
fe80::42c7:29ff:fe26:78c9 dev enp3s0 proto ra metric 1024 expires 265sec
mtu 1488 hoplimit 64 pref medium*
When I have finished fiddling and checking I will change the wg0 route to
metric 2000 so that traffic will normally go through the main interface and
when that has no IPv6 connectivity or is playing up, the wg0 route will be
selected, (I hope).
My 2 laptops, and Raspberry Pi will then be set up with their own wg1 etc
interfaces and will then have their own /64 subnets.
But when I try to get the route established automatically through the
wireguard conf files or through PostUp I get the message can't do it as
there is already an autoconfigured default. So I am stuck, at the moment
with adding manually after every boot/reboot. Any suggestions please?
VPS running Debian Stretch This box at home running Debian Buster.
The only answer I can think of at the mo is turn off autoconfig, but then I
lose this fallback mechanism and add difficulties with communicating with
mobile phone/router etc. Or I guess I could forget the fancy fall back idea
and just go through VPS but that could add a long delay when doing ordinary
surfing. IPv4 of course just goes out through the normal interface
4 Jul
4 Jul
5:58 p.m.
Of course I have just realised, my head has been so tied up with thoughts
of IPv6 I have forgotten, that turning off autoconfig via ra would not
affect the LAN communications etc on IPv4. But still would like to solve
this
On Thu, 4 Jul 2019 at 18:53, Keith Williams <keithwilliamsnp(a)gmail.com>
wrote:
Sorry long long post. tl;dr 2 default IPv6 routes
different metrics set up
persistent on Debian.
I need a bit of advice concerning routing IPv6.
Here is the problem. I do quite a bit of travelling around and a lot of it
in SE Asia. I frequently find my self where the relevant ISP does not
provide IPv6 connectivity. Even here at home my connection will
occasionally change my address or I have to reboot the router and get a
different one. I do things over the net for which I want IPv6, but also for
DNS I need a stable fixed address.
So I have an additional /56 subnet allocated to my VPS. Over the years I
have tinkered with different VPN solutions to push these addresses down to
my home network. I have found a different solution which not only was easy
to set up, but works a dream except for one tiny issue.
The /56 has been added to eth0 of my VPS. I am running wireguard and have
it set up interface wg0 to which I route a /60 subnet. <bitfolk
prefix>:e10::/60. Packets hitting this are encrypted with the server key
and then encapsulated in IPv4 UDP packets and sent to the wg0 interface on
my home machine, decrypted and if meeting criteria move through firewall
etc. Sending out it is the same in reverse, encryption being via the
client keypair. The client wg0 has subnet <bitfolk prefix>:e10::2/64, the
server only accepting packets from this range and properly encrypted.
Now here comes the problem. It is the default route issue. All that I read
says that you cannot have 2 default routes in the same table. I have looked
at a variety of solutions but find none except the one everyone seems to
say is impossible but which works. I set the route
*ip -6 route add ::0/0 dev wg0 metric 512. *
Note the metric 512. The autoconfigured one has a metric of 1024. which
gives me
*ip -6 routedefault dev wg0 metric 512 pref mediumdefault via
fe80::42c7:29ff:fe26:78c9 dev enp3s0 proto ra metric 1024 expires 265sec
mtu 1488 hoplimit 64 pref medium*
When I have finished fiddling and checking I will change the wg0 route to
metric 2000 so that traffic will normally go through the main interface and
when that has no IPv6 connectivity or is playing up, the wg0 route will be
selected, (I hope).
My 2 laptops, and Raspberry Pi will then be set up with their own wg1 etc
interfaces and will then have their own /64 subnets.
But when I try to get the route established automatically through the
wireguard conf files or through PostUp I get the message can't do it as
there is already an autoconfigured default. So I am stuck, at the moment
with adding manually after every boot/reboot. Any suggestions please?
VPS running Debian Stretch This box at home running Debian Buster.
The only answer I can think of at the mo is turn off autoconfig, but then
I lose this fallback mechanism and add difficulties with communicating with
mobile phone/router etc. Or I guess I could forget the fancy fall back idea
and just go through VPS but that could add a long delay when doing ordinary
surfing. IPv4 of course just goes out through the normal interface
6:06 p.m.
Hi Keith,
On Thu, Jul 04, 2019 at 06:53:49PM +0100, Keith Williams wrote:
Now here comes the problem. It is the default route
issue.
I've not done anything like this as I rely on A&A's IPv6 when at
home and just VPN everything to BitFolk when out and about on laptop
etc.
Just so I understand what you're wanting to achieve:
Your personal computers have a WireGuard VPN that provides IPv6.
You also sometimes but not always have native IPv6 on these
computers.
When you have an IPv6 default route assigned by SLAAC you want to
use that, but otherwise you want to have an IPv6 default route going out
of wg0 which would VPN the traffic via BitFolk.
Is that correct?
Cheers,
Andy
--
https://bitfolk.com/ -- No-nonsense VPS hosting
6:50 p.m.
Yes
I have it all working at the moment except being able to set up the route
through wireguard automatically. I have to enter it by hand every boot
On Thu, 4 Jul 2019 at 19:06, Andy Smith <andy(a)bitfolk.com> wrote:
Hi Keith,
On Thu, Jul 04, 2019 at 06:53:49PM +0100, Keith Williams wrote:
Now here comes the problem. It is the default
route issue.
I've not done anything like this as I rely on A&A's IPv6 when at
home and just VPN everything to BitFolk when out and about on laptop
etc.
Just so I understand what you're wanting to achieve:
Your personal computers have a WireGuard VPN that provides IPv6.
You also sometimes but not always have native IPv6 on these
computers.
When you have an IPv6 default route assigned by SLAAC you want to
use that, but otherwise you want to have an IPv6 default route going out
of wg0 which would VPN the traffic via BitFolk.
Is that correct?
Cheers,
Andy
--
https://bitfolk.com/ -- No-nonsense VPS hosting
_______________________________________________
users mailing list
users(a)lists.bitfolk.com
https://lists.bitfolk.com/mailman/listinfo/users
7:18 p.m.
Andy
Yes. Sorry, I answered before but it appeared further down the thread
On Thu, 4 Jul 2019 at 19:06, Andy Smith <andy(a)bitfolk.com> wrote:
Hi Keith,
On Thu, Jul 04, 2019 at 06:53:49PM +0100, Keith Williams wrote:
Now here comes the problem. It is the default
route issue.
I've not done anything like this as I rely on A&A's IPv6 when at
home and just VPN everything to BitFolk when out and about on laptop
etc.
Just so I understand what you're wanting to achieve:
Your personal computers have a WireGuard VPN that provides IPv6.
You also sometimes but not always have native IPv6 on these
computers.
When you have an IPv6 default route assigned by SLAAC you want to
use that, but otherwise you want to have an IPv6 default route going out
of wg0 which would VPN the traffic via BitFolk.
Is that correct?
Cheers,
Andy
--
https://bitfolk.com/ -- No-nonsense VPS hosting
_______________________________________________
users mailing list
users(a)lists.bitfolk.com
https://lists.bitfolk.com/mailman/listinfo/users
5 Jul
5 Jul
4:05 p.m.
UPDATE
No success with a variety of different methods. It seems that when the ip
-6 add is used within the .service file setting up the interface it doesn't
like it, so I wrote a simple bash file which first loads and configures the
interface then sets the route. Using it from the commandline works great
but using it in the .service file for the interface set up instead of the
normal script in Execstart doesnt.
Oh well I have lost nothing, it's only a very minor hassle and I have
learnt an awful lot about routing, networking and IPv6 along the way.
Now to try to set up wireguard client on a windows 10 box. LOL
Keith
On Thu, 4 Jul 2019 at 20:18, Keith Williams <keithwilliamsnp(a)gmail.com>
wrote:
Andy
Yes. Sorry, I answered before but it appeared further down the thread
On Thu, 4 Jul 2019 at 19:06, Andy Smith <andy(a)bitfolk.com> wrote:
Hi Keith,
On Thu, Jul 04, 2019 at 06:53:49PM +0100, Keith Williams wrote:
Now here comes the problem. It is the default
route issue.
I've not done anything like this as I rely on A&A's IPv6 when at
home and just VPN everything to BitFolk when out and about on laptop
etc.
Just so I understand what you're wanting to achieve:
Your personal computers have a WireGuard VPN that provides IPv6.
You also sometimes but not always have native IPv6 on these
computers.
When you have an IPv6 default route assigned by SLAAC you want to
use that, but otherwise you want to have an IPv6 default route going out
of wg0 which would VPN the traffic via BitFolk.
Is that correct?
Cheers,
Andy
--
https://bitfolk.com/ -- No-nonsense VPS hosting
_______________________________________________
users mailing list
users(a)lists.bitfolk.com
https://lists.bitfolk.com/mailman/listinfo/users
4 Jul
4 Jul
6:14 p.m.
On 2019-07-04 10:53, Keith Williams wrote:
Now here comes the problem. It is the default route issue. All that I
read says that you cannot have 2 default routes in the same table. I
have looked at a variety of solutions but find none except the one
everyone seems to say is impossible but which works. I set the route
/ip -6 route add ::0/0 dev wg0 metric 512. /
Note the metric 512. The autoconfigured one has a metric of 1024.
which gives me
/ip -6 route
default dev wg0 metric 512 pref medium
default via fe80::42c7:29ff:fe26:78c9 dev enp3s0 proto ra metric 1024
expires 265sec mtu 1488 hoplimit 64 pref medium/
Are you conflating the ideas of a route of last resort ("default route")
and one which routes traffic to the whole rest of the Internet?
0.0.0.0/0 and ::/0 (really 2000::/3) are functionally identical to
"default" but there can only be one default as it is a fallback in the
event of nothing more specific. It seems like the output of `ip -6
route` is confusing in this regard as well as they may be displaying
::/0 as the string "default" even when it is an additional route.
There's nothing to stop you having 2 (or 10) routes to 2000::/3 with
different metrics iirc.
Ant
7:09 p.m.
Ant,
Aaahh But when I try to add the route via postup in the wireguard conf
file, I get the message cant do cos there's an autoconfigured default
route. Which is annoying as I don't use the term default as such. Will try
using the more specific looking 2000::/3 which is as you say the same thing
but worded differently.
OK just tried it out with PostUp set in config file. Got this reply
" systemd-udevd[30023]: link_config: autonegotiation is unset or enabled,"
so it all failed.
Will set it back to how it was and think a bit more
On Thu, 4 Jul 2019 at 19:14, Anthony Newman via users <
users(a)lists.bitfolk.com> wrote:
On 2019-07-04 10:53, Keith Williams wrote:
Now here comes the problem. It is the default route issue. All that I
read says that you cannot have 2 default routes in the same table. I
have looked at a variety of solutions but find none except the one
everyone seems to say is impossible but which works. I set the route
/ip -6 route add ::0/0 dev wg0 metric 512. /
Note the metric 512. The autoconfigured one has a metric of 1024.
which gives me
/ip -6 route
default dev wg0 metric 512 pref medium
default via fe80::42c7:29ff:fe26:78c9 dev enp3s0 proto ra metric 1024
expires 265sec mtu 1488 hoplimit 64 pref medium/
Are you conflating the ideas of a route of last resort ("default route")
and one which routes traffic to the whole rest of the Internet?
0.0.0.0/0 and ::/0 (really 2000::/3) are functionally identical to
"default" but there can only be one default as it is a fallback in the
event of nothing more specific. It seems like the output of `ip -6
route` is confusing in this regard as well as they may be displaying
::/0 as the string "default" even when it is an additional route.
There's nothing to stop you having 2 (or 10) routes to 2000::/3 with
different metrics iirc.
Ant
_______________________________________________
users mailing list
users(a)lists.bitfolk.com
https://lists.bitfolk.com/mailman/listinfo/users
1769
days inactive
1770
days old
7 comments
3 participants
participants (3)
-
Andy Smith -
Anthony Newman -
Keith Williams