From: Ian Kelling Date: Mon, 12 Aug 2019 04:02:30 +0000 (-0400) Subject: ipv6 tunnel X-Git-Url: https://iankelling.org/git/?p=distro-setup;a=commitdiff_plain;h=63acc2d602eb316a1c0abb7ec842e4789c8beaec ipv6 tunnel --- diff --git a/distro-end b/distro-end index 2e6b687..3cc63c2 100755 --- a/distro-end +++ b/distro-end @@ -187,9 +187,18 @@ export RENEWED_LINEAGE=/etc/letsencrypt/live/mumble.iankelling.org EOF - vpn-server-setup -rd + # requested from linode via a support ticket. + # https://www.linode.com/docs/networking/an-overview-of-ipv6-on-linode/ + # ipv6 stuff pieced together + # via slightly wrong information from + # https://github.com/angristan/openvpn-install/blob/master/openvpn-install.sh + # https://community.openvpn.net/openvpn/wiki/IPv6 + # and man openvpn + + vpn-server-setup -rd 2600:3c00:e000:280::1/64 2600:3c00::f03c:91ff:feb4:0bf3 s tee /etc/openvpn/client-config/mail <<'EOF' ifconfig-push 10.8.0.4 255.255.255.0 +ifconfig-ipv6-push 2600:3c00:e000:280::2/64 EOF if [[ -e /lib/systemd/system/openvpn-server@.service ]]; then diff --git a/mail-route b/mail-route index 52f4651..0b89084 100755 --- a/mail-route +++ b/mail-route @@ -1,6 +1,5 @@ #!/bin/bash # Copyright (C) 2016 Ian Kelling -set -x # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. # You may obtain a copy of the License at @@ -26,6 +25,10 @@ a vpn ip. If called from --up/--down in openvpn, (we have multiple args) $1 is t tun_dev, and action is from $script_type. Is idempotent. + + +todo: Need to give mail.iankelling.org an ipv6 dns address. + EOF exit $1 } @@ -76,7 +79,7 @@ down() { # note, this is not going to work if the interface has been deleted. # we could also check for an iptable rule that on some tun interface like the one # we use, but meh, the way I'm using the script now, tun_dev is supplied by openvpn - if [[ ! tun_dev ]]; then + if [[ ! $tun_dev ]]; then tun_dev=$(ip a show to 10.8.0.4/24 | sed -rn '1s/^\S+\s+([^:]+).*/\1/p') fi e() { echo "$0: $*"; "$@" || printf "maybe ok failure: %s\n" "$*"; } @@ -84,11 +87,17 @@ down() { } show() { - e() { printf "${0##*/}: %s\n" "$*"; "$@"; } + printf "$(tput setaf 5)█$(tput sgr0)%.0s" $(seq ${COLUMNS:-60}); + echo + e() { printf "=================================\n# %s\n\n" "$*"; "$@"; } e iptables -t mangle -S + e ip6tables -t mangle -S e iptables -t nat -S e ip rule + e ip -6 rule e ip route show table 1 + e ip -6 route show table 1 + e ip -6 route show default tun_dev=$(ip a show to 10.8.0.4/24 | sed -rn '1s/^\S+\s+([^:]+).*/\1/p') if [[ $tun_dev == tun* ]]; then @@ -106,7 +115,8 @@ runtest() { } iptmod() { #iptables modify - local check cmd="$*" exists=true + local cmd="$*" + local exists=true ${cmd/-[AD]/-C} &>/dev/null || exists=false if runtest; then e $cmd; fi } @@ -115,28 +125,44 @@ iptmod() { #iptables modify modify() { # match source or dest port. note, when we send to a port, it picks a random high port as # the source. - for port in 25 143 587; do # smtp and imap. - iptcommon="OUTPUT -m tcp -p tcp -m multiport --ports $port -j MARK --set-mark" - iptmod iptables -t mangle $iptables_op $iptcommon 0x1 - iptmod iptables -t mangle $iptables_op $iptcommon 0x0 -d 10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,127.0.0.0/8 - # note, we could have used a custom chain and returned instead of setting the mark again. - # in case anyone was ever curious, the inverse of private ips is: #0.0.0.0/5,8.0.0.0/7,11.0.0.0/8,12.0.0.0/6,16.0.0.0/4,32.0.0.0/3,64.0.0.0/2,128.0.0.0/3,160.0.0.0/5,168.0.0.0/6,172.0.0.0/12,172.32.0.0/11,172.64.0.0/10,172.128.0.0/9,173.0.0.0/8,174.0.0.0/7,176.0.0.0/4,192.0.0.0/9,192.128.0.0/11,192.160.0.0/13,192.169.0.0/16,192.170.0.0/15,192.172.0.0/14,192.176.0.0/12,192.192.0.0/10,193.0.0.0/8,194.0.0.0/7,196.0.0.0/6,200.0.0.0/5,208.0.0.0/4,224.0.0.0/3 - done + + iptcommon="OUTPUT -m tcp -p tcp -m multiport --ports 25,143,587 -j MARK --set-mark" + iptmod iptables -t mangle $iptables_op $iptcommon 0x1 + iptmod iptables -t mangle $iptables_op $iptcommon 0x0 -d 10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,127.0.0.0/8 + # note, we could have used a custom chain and returned instead of setting the mark again. + # in case anyone was ever curious, the inverse of private ips is: #0.0.0.0/5,8.0.0.0/7,11.0.0.0/8,12.0.0.0/6,16.0.0.0/4,32.0.0.0/3,64.0.0.0/2,128.0.0.0/3,160.0.0.0/5,168.0.0.0/6,172.0.0.0/12,172.32.0.0/11,172.64.0.0/10,172.128.0.0/9,173.0.0.0/8,174.0.0.0/7,176.0.0.0/4,192.0.0.0/9,192.128.0.0/11,192.160.0.0/13,192.169.0.0/16,192.170.0.0/15,192.172.0.0/14,192.176.0.0/12,192.192.0.0/10,193.0.0.0/8,194.0.0.0/7,196.0.0.0/6,200.0.0.0/5,208.0.0.0/4,224.0.0.0/3 + iptmod ip6tables -t mangle $iptables_op $iptcommon 0x1 -d 2000::/3 if [[ $tun_dev ]]; then - # when $tun_dev goes away, so does this rul + # when $tun_dev goes away, so does this rule. iptmod iptables -t nat $iptables_op POSTROUTING -o $tun_dev -m mark --mark 0x1 -j SNAT --to-source 10.8.0.4 + iptmod ip6tables -t nat $iptables_op POSTROUTING -o $tun_dev -m mark --mark 0x1 -j SNAT --to-source 2600:3c00:e000:280::2 + fi iprulecmd="fwmark 1 table 1" - exists=true; ip rule show $iprulecmd | grep . &>/dev/null || exists=false - if runtest; then e ip rule $ip_op $iprulecmd; fi + for v in -4 -6; do + exists=true; ip $v rule show $iprulecmd | grep . &>/dev/null || exists=false + if runtest; then e ip $v rule $ip_op $iprulecmd; fi + done iproutecmd="default via 10.8.0.1 table 1" exists=true; ip route show $iproutecmd | grep . &>/dev/null || exists=false if runtest; then e ip route $ip_op $iproutecmd; fi - + if [[ $tun_dev ]]; then + # when $tun_dev goes away, so does this route. + iproutecmd="default dev $tun_dev table 1" + exists=true; ip -6 route show $iproutecmd | grep . &>/dev/null || exists=false + if runtest; then e ip -6 route $ip_op $iproutecmd; fi + + # We could only do this if we dont have a default route with [[ ! $(ip -6 r show default) ]] but + # metric seems to be perfectly good. 6000 because on my home comp, + # its about 6 times slower to ping google, than the default 1024 metric. + iproutecmd="default dev $tun_dev" + exists=true; ip -6 route show $iproutecmd | grep . &>/dev/null || exists=false + if runtest; then e ip -6 route $ip_op $iproutecmd metric 6000; fi + fi # on debian this is 0 (no filter), on ubuntu it\'s 1, which is no good. 0 or 2 both work fine. # 2 drops it if the packet is not routable, martian address, or my default route is screwed up, # so, eh, might as well. some rhel docs recommend using it. @@ -154,8 +180,6 @@ else esac fi - - exit 0 diff --git a/mail-setup b/mail-setup index 6e21394..11f8dff 100755 --- a/mail-setup +++ b/mail-setup @@ -477,8 +477,6 @@ EOF # enable 587 in addition to the default 25, so that # i can send mail where port 25 is firewalled by isp daemon_smtp_ports = 25 : 587 -# i don't have ipv6 setup for my vpn tunnel yet. -disable_ipv6 = true MAIN_TLS_ENABLE = true