How to allow protocol-41 (6in4) through the GCE firewall?

Question

As a stop-gap until Google supports native IPv6 on Google Compute Engine, I'd like to configure a 6in4 (IP protocol 41) tunnel.

I added a firewall rule to allow protocol 41 on my VM's network:

Name        Source tag / IP range  Allowed protocols / ports  Target tags
allow-6in4  216.66.xxx.xxx         41                         Apply to all targets

And configured the tunnel in /etc/network/interfaces:

auto 6in4
iface 6in4 inet6 v4tunnel
  address 2001:470:xxxx:xxxx::2
  netmask 64
  endpoint 216.66.xxx.xxx
  gateway 2001:470:xxxx:xxxx::1
  ttl 64
  up ip link set mtu 1280 dev $IFACE

And ping6 2001:470:xxxx:xxxx::1 and verified that 6in4 traffic was outbound:

$ sudo tcpdump -pni eth0 host 216.66.xxx.xxx
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes
22:52:03.732841 IP 10.240.xxx.xxx > 216.66.xxx.xxx: IP6 2001:470:xxxx:xxxx::2 > 2001:470:xxxx:xxxx::1: ICMP6, echo request, seq 1, length 64
22:52:04.740726 IP 10.240.xxx.xxx > 216.66.xxx.xxx: IP6 2001:470:xxxx:xxxx::2 > 2001:470:xxxx:xxxx::1: ICMP6, echo request, seq 2, length 64
22:52:05.748690 IP 10.240.xxx.xxx > 216.66.xxx.xxx: IP6 2001:470:xxxx:xxxx::2 > 2001:470:xxxx:xxxx::1: ICMP6, echo request, seq 3, length 64  

I changed the endpoint temporarily to an address where I can run tcpdump, and confirmed that packets are not arriving at the destination. I even tried NAT myself in case GCE wasn't doing this for 6in4 packets, but no luck (iptables -t nat -A POSTROUTING -p ipv6 -j SNAT --to-source 130.211.xxx.xxx).

Has anyone gotten a 6in4 tunnel to work on a GCE VM? Is there some magic setting I missed somewhere?

Answer 1

TL;DR: You can't.

Per Networking and Firewalls:

Traffic that uses a protocol other than TCP, UDP, and ICMP is blocked, unless explicitly allowed through Protocol Forwarding.

Per Protocol Forwarding:

Google Compute Engine supports protocol forwarding for the following protocols:

AH: Specifies the IP Authentication Header protocol.

ESP: Specifies the IP Encapsulating Security Payload protocol.

SCTP: Specifies the Stream Control Transmission Protocol.

TCP: Specifies the Transmission Control Protocol.

UDP: Specifies the User Datagram Protocol.

Hence, a Protocol Forwarding rule needs to be for one of the following IP protocol numbers:

• 51 (AH)
• 50 (ESP)
• 132 (SCTP)
• 6 (TCP)
• 17 (UDP)

The Protocol Forwarding page makes it clear that other protocol numbers, such as 41 (6in4) are not supported:

Note: This is an exhaustive list of supported protocols. Only protocols that appear here are supported for protocol forwarding.