ipv6 tunnel

diff --git a/distro-end b/distro-end
index 2e6b687a503385cdb9385c49085c8a4f15dce05c..3cc63c2e3e10ba81553c315f708059e037894871 100755 (executable)
--- a/distro-end
+++ b/distro-end
@@ -187,9 +187,18 @@ export RENEWED_LINEAGE=/etc/letsencrypt/live/mumble.iankelling.org
 EOF
 
 
-    vpn-server-setup -rd
+    # requested from linode via a support ticket.
+    # https://www.linode.com/docs/networking/an-overview-of-ipv6-on-linode/
+    # ipv6 stuff pieced together
+    # via slightly wrong information from
+    # https://github.com/angristan/openvpn-install/blob/master/openvpn-install.sh
+    # https://community.openvpn.net/openvpn/wiki/IPv6
+    # and man openvpn
+
+    vpn-server-setup -rd 2600:3c00:e000:280::1/64 2600:3c00::f03c:91ff:feb4:0bf3
     s tee /etc/openvpn/client-config/mail <<'EOF'
 ifconfig-push 10.8.0.4 255.255.255.0
+ifconfig-ipv6-push 2600:3c00:e000:280::2/64
 EOF
 
     if [[ -e /lib/systemd/system/openvpn-server@.service ]]; then

diff --git a/mail-route b/mail-route
index 52f4651becd9c8afc758c2fd791157f9224e9784..0b8908467b8e1b8996386f00d2fed1f144da8a15 100755 (executable)
--- a/mail-route
+++ b/mail-route
@@ -1,6 +1,5 @@
 #!/bin/bash
 # Copyright (C) 2016 Ian Kelling
-set -x
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
 # You may obtain a copy of the License at
@@ -26,6 +25,10 @@ a vpn ip. If called from --up/--down in openvpn, (we have multiple args) $1 is t
 tun_dev, and action is from $script_type.
 
 Is idempotent.
+
+
+todo: Need to give mail.iankelling.org an ipv6 dns address.
+
 EOF
   exit $1
 }
@@ -76,7 +79,7 @@ down() {
   # note, this is not going to work if the interface has been deleted.
   # we could also check for an iptable rule that on some tun interface like the one
   # we use, but meh, the way I'm using the script now, tun_dev is supplied by openvpn
-  if [[ ! tun_dev ]]; then
+  if [[ ! $tun_dev ]]; then
     tun_dev=$(ip a show to 10.8.0.4/24 | sed -rn '1s/^\S+\s+([^:]+).*/\1/p')
   fi
   e() { echo "$0: $*"; "$@" || printf "maybe ok failure: %s\n" "$*"; }
@@ -84,11 +87,17 @@ down() {
 }
 
 show() {
-  e() { printf "${0##*/}: %s\n" "$*"; "$@"; }
+  printf "$(tput setaf 5)█$(tput sgr0)%.0s" $(seq ${COLUMNS:-60});
+  echo
+  e() { printf "=================================\n# %s\n\n" "$*"; "$@"; }
   e iptables -t mangle -S
+  e ip6tables -t mangle -S
   e iptables -t nat -S
   e ip rule
+  e ip -6 rule
   e ip route show table 1
+  e ip -6 route show table 1
+  e ip -6 route show default
 
   tun_dev=$(ip a show to 10.8.0.4/24 | sed -rn '1s/^\S+\s+([^:]+).*/\1/p')
   if [[ $tun_dev == tun* ]]; then
@@ -106,7 +115,8 @@ runtest() {
 }
 
 iptmod() { #iptables modify
-  local check cmd="$*" exists=true
+  local cmd="$*"
+  local exists=true
   ${cmd/-[AD]/-C} &>/dev/null || exists=false
   if runtest; then e $cmd; fi
 }
@@ -115,28 +125,44 @@ iptmod() { #iptables modify
 modify() {
   # match source or dest port. note, when we send to a port, it picks a random high port as
   # the source.
-  for port in 25 143 587; do # smtp and imap.
-    iptcommon="OUTPUT -m tcp -p tcp -m multiport --ports $port -j MARK --set-mark"
-    iptmod iptables -t mangle $iptables_op $iptcommon 0x1
-    iptmod iptables -t mangle $iptables_op $iptcommon 0x0 -d 10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,127.0.0.0/8
-    # note, we could have used a custom chain and returned instead of setting the mark again.
-    # in case anyone was ever curious, the inverse of private ips is:   #0.0.0.0/5,8.0.0.0/7,11.0.0.0/8,12.0.0.0/6,16.0.0.0/4,32.0.0.0/3,64.0.0.0/2,128.0.0.0/3,160.0.0.0/5,168.0.0.0/6,172.0.0.0/12,172.32.0.0/11,172.64.0.0/10,172.128.0.0/9,173.0.0.0/8,174.0.0.0/7,176.0.0.0/4,192.0.0.0/9,192.128.0.0/11,192.160.0.0/13,192.169.0.0/16,192.170.0.0/15,192.172.0.0/14,192.176.0.0/12,192.192.0.0/10,193.0.0.0/8,194.0.0.0/7,196.0.0.0/6,200.0.0.0/5,208.0.0.0/4,224.0.0.0/3
-  done
+
+  iptcommon="OUTPUT -m tcp -p tcp -m multiport --ports 25,143,587 -j MARK --set-mark"
+  iptmod iptables -t mangle $iptables_op $iptcommon 0x1
+  iptmod iptables -t mangle $iptables_op $iptcommon 0x0 -d 10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,127.0.0.0/8
+  # note, we could have used a custom chain and returned instead of setting the mark again.
+  # in case anyone was ever curious, the inverse of private ips is:   #0.0.0.0/5,8.0.0.0/7,11.0.0.0/8,12.0.0.0/6,16.0.0.0/4,32.0.0.0/3,64.0.0.0/2,128.0.0.0/3,160.0.0.0/5,168.0.0.0/6,172.0.0.0/12,172.32.0.0/11,172.64.0.0/10,172.128.0.0/9,173.0.0.0/8,174.0.0.0/7,176.0.0.0/4,192.0.0.0/9,192.128.0.0/11,192.160.0.0/13,192.169.0.0/16,192.170.0.0/15,192.172.0.0/14,192.176.0.0/12,192.192.0.0/10,193.0.0.0/8,194.0.0.0/7,196.0.0.0/6,200.0.0.0/5,208.0.0.0/4,224.0.0.0/3
+  iptmod ip6tables -t mangle $iptables_op $iptcommon 0x1 -d 2000::/3
 
   if [[ $tun_dev ]]; then
-    # when $tun_dev goes away, so does this rul
+    # when $tun_dev goes away, so does this rule.
     iptmod iptables -t nat $iptables_op POSTROUTING -o $tun_dev -m mark --mark 0x1 -j SNAT --to-source 10.8.0.4
+    iptmod ip6tables -t nat $iptables_op POSTROUTING -o $tun_dev -m mark --mark 0x1 -j SNAT --to-source 2600:3c00:e000:280::2
+
   fi
 
 
   iprulecmd="fwmark 1 table 1"
-  exists=true; ip rule show $iprulecmd | grep . &>/dev/null || exists=false
-  if runtest; then e ip rule $ip_op $iprulecmd; fi
+  for v in -4 -6; do
+    exists=true; ip $v rule show $iprulecmd | grep . &>/dev/null || exists=false
+    if runtest; then e ip $v rule $ip_op $iprulecmd; fi
+  done
 
   iproutecmd="default via 10.8.0.1 table 1"
   exists=true; ip route show $iproutecmd | grep . &>/dev/null || exists=false
   if runtest; then e ip route $ip_op $iproutecmd; fi
-
+  if [[ $tun_dev ]]; then
+    # when $tun_dev goes away, so does this route.
+    iproutecmd="default dev $tun_dev table 1"
+    exists=true; ip -6 route show $iproutecmd | grep . &>/dev/null || exists=false
+    if runtest; then e ip -6 route $ip_op $iproutecmd; fi
+
+    # We could only do this if we dont have a default route with [[ ! $(ip -6 r show default) ]] but
+    # metric seems to be perfectly good. 6000 because on my home comp,
+    # its about 6 times slower to ping google, than the default 1024 metric.
+    iproutecmd="default dev $tun_dev"
+    exists=true; ip -6 route show $iproutecmd | grep . &>/dev/null || exists=false
+    if runtest; then e ip -6 route $ip_op $iproutecmd metric 6000; fi
+  fi
   # on debian this is 0 (no filter), on ubuntu it\'s 1, which is no good. 0 or 2 both work fine.
   # 2 drops it if the packet is not routable, martian address, or my default route is screwed up,
   # so, eh, might as well. some rhel docs recommend using it.
@@ -154,8 +180,6 @@ else
   esac
 fi
 
-
-
 exit 0
 
 

diff --git a/mail-setup b/mail-setup
index 6e21394cd84f58e99f4acd23a02bbf8b7bd23e55..11f8dffe089dc81613f83513cbcd5e2562df351d 100755 (executable)
--- a/mail-setup
+++ b/mail-setup
@@ -477,8 +477,6 @@ EOF
 # enable 587 in addition to the default 25, so that
 # i can send mail where port 25 is firewalled by isp
 daemon_smtp_ports = 25 : 587
-# i don't have ipv6 setup for my vpn tunnel yet.
-disable_ipv6 = true
 
 MAIN_TLS_ENABLE = true