Mam tunel z henetu i 6to4. Ustawiałem to dosyć dawno i też miałem problem z rozgłoszeniem tego po sieci. Metodą prób i błędów jakoś to ustawiłem. Tak wygląda moja konfiguracja:
/etc/dhcp6s.conf
# The followings are a sample configuration to provide a DNS server address
# for every client as well as to delegate a permanent IPv6 prefix
# 2001:db8:1111::/48 to a client whose DUID is 00:01:00:01:aa:bb.option domain-name-servers 2001:4860:4860::8888;
option domain-name-servers 2001:4860:4860::8844;host serwer {
duid 00:01:00:01:1a:7f:aa:94:00:00:39:4a:5d:a3;
address 2001:470:71:53d:10::2 infinity;
};interface br-lan {
address-pool pool1 86400;
};pool pool1 {
range 2001:470:71:53d:10::1000 to 2001:470:71:53d:10::2000 ;
};
/etc/config/network
config interface 'loopback'
option ifname 'lo'
option proto 'static'
option ipaddr '127.0.0.1'
option netmask '255.0.0.0'config interface 'lan'
option ifname 'eth0'
option type 'bridge'
option proto 'static'
option ipaddr '192.168.1.1'
option netmask '255.255.255.0'
option ip6assign '64'
option ip6hint '10'
option ip6addr '2001:470:71:53d:10::1/64'
option dns '192.168.1.1'config interface 'wan'
option ifname 'eth1'
option proto 'dhcp'config switch
option name 'eth0'
option reset '1'
option enable_vlan '1'config switch_vlan
option device 'eth0'
option vlan '1'
option ports '0 1 2 3 4 5'config interface 'wan6'
option proto '6to4'config interface 'henet'
option proto '6in4'
option peeraddr '216.66.80.162'
option ip6addr '2001:470:70:53d::2/64'
option ip6prefix '2001:470:71:53d::/64'
option tunnelid '123456'
option username 'xxxxxxxxxx'
option password 'xxxxxxxxxx'
/etc/config/firewall
config defaults
option syn_flood '1'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'REJECT'config zone
option name 'lan'
list network 'lan'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'REJECT'config zone
option name 'wan'
list network 'wan'
list network 'wan6'
list network 'henet'
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
option masq '1'
option mtu_fix '1'config forwarding
option src 'lan'
option dest 'wan'config rule
option name 'Allow-DHCP-Renew'
option src 'wan'
option proto 'udp'
option dest_port '68'
option target 'ACCEPT'
option family 'ipv4'config rule
option name 'Allow-Ping'
option src 'wan'
option proto 'icmp'
option icmp_type 'echo-request'
option family 'ipv4'
option target 'ACCEPT'config rule
option name 'Allow-DHCPv6'
option src 'wan'
option proto 'udp'
option src_ip 'fe80::/10'
option src_port '547'
option dest_ip 'fe80::/10'
option dest_port '546'
option family 'ipv6'
option target 'ACCEPT'config rule
option name 'Allow-ICMPv6-Input'
option src 'wan'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
list icmp_type 'router-solicitation'
list icmp_type 'neighbour-solicitation'
list icmp_type 'router-advertisement'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'config rule
option name 'Allow-ICMPv6-Forward'
option src 'wan'
option dest '*'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'config include
option path '/etc/firewall.user'
option reload '1'config include
option type 'script'
option path '/usr/lib/gargoyle_firewall_util/gargoyle_additions.firewall'
option family 'IPv4'
option reload '1'config include 'miniupnpd'
option type 'script'
option path '/usr/share/miniupnpd/firewall.include'
option family 'IPv4'
option reload '1'config include 'openvpn_include_file'
option path '/etc/openvpn.firewall'
option reload '1'config zone
option name 'wan6'
option network 'wan6'
option family 'ipv6'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'REJECT'config forwarding
option src 'wan6'
option dest 'lan'config forwarding
option src 'lan'
option dest 'wan6'config rule
option name 'Allow Multicast v6'
option src 'wan'
option src_ip 'ff00::/8'
option dest_ip 'ff00::/8'
option family 'ipv6'config zone
option name 'henet'
option network 'henet'
option family 'ipv6'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'REJECT'config forwarding
option src 'henet'
option dest 'lan'config forwarding
option src 'lan'
option dest 'henet'config rule
option name 'Allow Multicast v6'
option src 'wan'
option src_ip 'ff00::/8'
option dest_ip 'ff00::/8'
option family 'ipv6'
option target 'ACCEPT'config rule
option name '6to4'
option src 'wan'
option proto '41'
option target 'ACCEPT'
/etc/sysctl.conf
kernel.panic=3
net.ipv4.conf.default.arp_ignore=1
net.ipv4.conf.all.arp_ignore=1
net.ipv4.ip_forward=1
net.ipv4.icmp_echo_ignore_broadcasts=1
net.ipv4.icmp_ignore_bogus_error_responses=1
net.ipv4.tcp_ecn=0
net.ipv4.tcp_fin_timeout=30
net.ipv4.tcp_keepalive_time=120
net.ipv4.tcp_syncookies=1
net.ipv4.tcp_timestamps=1
net.ipv4.tcp_sack=1
net.ipv4.tcp_dsack=1net.ipv6.conf.default.forwarding=1
net.ipv6.conf.all.forwarding=1net.netfilter.nf_conntrack_acct=1
net.netfilter.nf_conntrack_checksum=0
#net.netfilter.nf_conntrack_max=16384
#net.netfilter.nf_conntrack_tcp_timeout_established=3600
net.netfilter.nf_conntrack_udp_timeout=60
net.netfilter.nf_conntrack_udp_timeout_stream=180# disable bridge firewalling by default
net.bridge.bridge-nf-call-arptables=0
net.bridge.bridge-nf-call-ip6tables=0
net.bridge.bridge-nf-call-iptables=0net.ipv4.tcp_tw_reuse=1
net.ipv4.tcp_max_tw_buckets=8192
net.netfilter.nf_conntrack_max=4096
net.netfilter.nf_conntrack_tcp_timeout_established=600
