Cannot ping the other side of an OpenVPN tunnel (IPv6)

809 views Asked by At

I have setup OpenVPN and now need to setup the routes manually, but I cannot manage to ping the other end. The tun0 interface is up and has the IPv6 address fd2d:65e3:ed0d:8::1010/64 (global scope) set by OpenVPN. Now I try to reach the other end.

$ping6 -I tun0 ff02::2
PING ff02::2(ff02::2) from fd2d:65e3:ed0d:8::1010 tun0: 56 data bytes
64 bytes from fd2d:65e3:ed0d:8::1010: icmp_seq=1 ttl=64 time=0.049 ms
64 bytes from fd2d:65e3:ed0d:8::: icmp_seq=1 ttl=64 time=63.2 ms (DUP!)

The other sides IP address is fd2d:65e3:ed0d:8::, alright, let's first add a route:

$ip route add fd2d:65e3:ed0d:8::/64 dev tun0

.. and now let's ping the other side:

$ping6 fd2d:65e3:ed0d:8::
PING fd2d:65e3:ed0d:8::(fd2d:65e3:ed0d:8::) 56 data bytes
64 bytes from fd2d:65e3:ed0d:8::1010: icmp_seq=1 ttl=64 time=0.031 ms

Why is the local interface responding? How can I ping the other end of the tunnel?

EDIT:

ip route add 2000::/3 via fd2d:65e3:ed0d:8:: dev tun0

... does get me "RTNETLINK answers: No route to host", but this is allowed:

ip route add 2000::/3 via fd2d:65e3:ed0d:8::1 dev tun0
2

There are 2 answers

0
mwarning On BEST ANSWER

Jeremy is about right. It is an anycast address. Since it is not really meant to ping/connect to the other side, the right thing to do is to not use the address at all:

ip route add fd94:a10e:82b8:8::/64 dev tun0
ip route add 2000::/3 dev tun0

Now we could e.g. ping google:

ping6 2001:4860:4860::8888
3
Jeremy Visser On

The first address in the subnet is an anycast address pointing to the nearest router. As you are a router, it points to yourself.

You must configure the other end to use any address other than the first address.