IPv6

A

AllOnline

New Member
Hallo zusammen,

ich habe das Problem, dass mein Server bzgl IPv6 scheinbar falsch konfiguriert ist. Könnt ihr mir bitte helfen?:

Code: 
root@proxmox:/# ping6 ipv6.l.google.com
PING ipv6.l.google.com(fa-in-x93.1e100.net) 56 data bytes
From static.xxxxx.clients.your-server.de icmp_seq=2 Destination unreachable: Address unreachable
From static.xxxxx.clients.your-server.de icmp_seq=3 Destination unreachable: Address unreachable
From static.xxxxx.clients.your-server.de icmp_seq=4 Destination unreachable: Address unreachable
From static.xxxxx.clients.your-server.de icmp_seq=6 Destination unreachable: Address unreachable
From static.xxxxx.clients.your-server.de icmp_seq=7 Destination unreachable: Address unreachable
From static.xxxxx.clients.your-server.de icmp_seq=8 Destination unreachable: Address unreachable
From static.xxxxx.clients.your-server.de icmp_seq=10 Destination unreachable: Address unreachable
From static.xxxxx.clients.your-server.de icmp_seq=11 Destination unreachable: Address unreachable
From static.xxxxx.clients.your-server.de icmp_seq=12 Destination unreachable: Address unreachable
^C
--- ipv6.l.google.com ping statistics ---
13 packets transmitted, 0 received, +9 errors, 100% packet loss, time 12002ms

Mein Server ist von außen auch nicht zu erreichen.

Code: 
auto lo
iface lo inet loopback

auto eth0
iface eth0 inet manual

iface eth0 inet6 static
  address 2a01:4f8:xxxx:xxxx::2
  netmask 64
  gateway fe80::1


auto vmbr0
iface vmbr0 inet static
        address 176.9.137.xxx
        netmask 255.255.255.224
        gateway 176.9.137.1
        bridge_ports eth0
        bridge_stp off
        bridge_fd 0


Code: 
root@proxmox:/# iptables --list
Chain INPUT (policy DROP)
target     prot opt source               destination
fail2ban-apache  tcp  --  anywhere             anywhere            multiport dports www,https
fail2ban-postfix  tcp  --  anywhere             anywhere            multiport dports smtp,ssmtp
fail2ban-ssh  tcp  --  anywhere             anywhere            multiport dports ssh
fail2ban-ssh-ddos  tcp  --  anywhere             anywhere            multiport dports ssh
dynamic    all  --  anywhere             anywhere            ctstate INVALID,NEW
net2fw     all  --  anywhere             anywhere
dmz2fw     all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere            ctstate RELATED,ESTABLISHED
Reject     all  --  anywhere             anywhere
reject     all  --  anywhere             anywhere            [goto]

Chain FORWARD (policy DROP)
target     prot opt source               destination
dynamic    all  --  anywhere             anywhere            ctstate INVALID,NEW
net2dmz    all  --  anywhere             anywhere
dmz_frwd   all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere            ctstate RELATED,ESTABLISHED
Reject     all  --  anywhere             anywhere
reject     all  --  anywhere             anywhere            [goto]

Chain OUTPUT (policy DROP)
target     prot opt source               destination
fw2net     all  --  anywhere             anywhere
fw2dmz     all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere            ctstate RELATED,ESTABLISHED
Reject     all  --  anywhere             anywhere
reject     all  --  anywhere             anywhere            [goto]

Chain @dmz2fw (1 references)
target     prot opt source               destination
RETURN     all  --  anywhere             anywhere            limit: avg 1/sec burst 2
LOG        all  --  anywhere             anywhere            limit: avg 5/min burst 5 LOG level info prefix `Shorewall:dmz2fw:DROP:'
DROP       all  --  anywhere             anywhere

Chain @net2dmz (0 references)
target     prot opt source               destination
RETURN     all  --  anywhere             anywhere            limit: avg 8/sec burst 30
LOG        all  --  anywhere             anywhere            limit: avg 5/min burst 5 LOG level info prefix `Shorewall:net2dmz:DROP:'
DROP       all  --  anywhere             anywhere

Chain @net2fw (1 references)
target     prot opt source               destination
RETURN     all  --  anywhere             anywhere            limit: avg 1/sec burst 2
LOG        all  --  anywhere             anywhere            limit: avg 5/min burst 5 LOG level info prefix `Shorewall:net2fw:DROP:'
DROP       all  --  anywhere             anywhere

Chain Drop (3 references)
target     prot opt source               destination
           all  --  anywhere             anywhere
reject     tcp  --  anywhere             anywhere            tcp dpt:auth /* Auth */
dropBcast  all  --  anywhere             anywhere
ACCEPT     icmp --  anywhere             anywhere            icmp fragmentation-needed /* Needed ICMP types */
ACCEPT     icmp --  anywhere             anywhere            icmp time-exceeded /* Needed ICMP types */
dropInvalid  all  --  anywhere             anywhere
DROP       udp  --  anywhere             anywhere            multiport dports loc-srv,microsoft-ds /* SMB */
DROP       udp  --  anywhere             anywhere            udp dpts:netbios-ns:netbios-ssn /* SMB */
DROP       udp  --  anywhere             anywhere            udp spt:netbios-ns dpts:1024:65535 /* SMB */
DROP       tcp  --  anywhere             anywhere            multiport dports loc-srv,netbios-ssn,microsoft-ds /* SMB */
DROP       udp  --  anywhere             anywhere            udp dpt:1900 /* UPnP */
dropNotSyn  tcp  --  anywhere             anywhere
DROP       udp  --  anywhere             anywhere            udp spt:domain /* Late DNS Replies */

Chain Reject (3 references)
target     prot opt source               destination
           all  --  anywhere             anywhere
reject     tcp  --  anywhere             anywhere            tcp dpt:auth /* Auth */
dropBcast  all  --  anywhere             anywhere
ACCEPT     icmp --  anywhere             anywhere            icmp fragmentation-needed /* Needed ICMP types */
ACCEPT     icmp --  anywhere             anywhere            icmp time-exceeded /* Needed ICMP types */
dropInvalid  all  --  anywhere             anywhere
reject     udp  --  anywhere             anywhere            multiport dports loc-srv,microsoft-ds /* SMB */
reject     udp  --  anywhere             anywhere            udp dpts:netbios-ns:netbios-ssn /* SMB */
reject     udp  --  anywhere             anywhere            udp spt:netbios-ns dpts:1024:65535 /* SMB */
reject     tcp  --  anywhere             anywhere            multiport dports loc-srv,netbios-ssn,microsoft-ds /* SMB */
DROP       udp  --  anywhere             anywhere            udp dpt:1900 /* UPnP */
dropNotSyn  tcp  --  anywhere             anywhere
DROP       udp  --  anywhere             anywhere            udp spt:domain /* Late DNS Replies */

Chain blacklst (2 references)
target     prot opt source               destination

Chain dmz2fw (1 references)
target     prot opt source               destination
ACCEPT     udp  --  anywhere             anywhere            udp dpts:bootps:bootpc
ACCEPT     all  --  anywhere             anywhere            ctstate RELATED,ESTABLISHED
@dmz2fw    tcp  --  anywhere             anywhere            tcp flags:FIN,SYN,RST,ACK/SYN
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:ssh /* SSH */
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:www /* HTTP */
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:https /* HTTPS */
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:smtp /* SMTP */
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:ssmtp /* SMTPS */
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:imap2 /* IMAP */
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:imaps /* IMAPS */
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:pop3 /* POP3 */
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:pop3s /* POP3S */
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:ftp /* FTP */
ACCEPT     icmp --  anywhere             anywhere            icmp echo-request
ACCEPT     icmp --  anywhere             anywhere            icmp echo-request /* Ping */
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:8006
ACCEPT     tcp  --  anywhere             anywhere            tcp dpts:5900:5999
Drop       all  --  anywhere             anywhere
LOG        all  --  anywhere             anywhere            LOG level info prefix `Shorewall:dmz2fw:DROP:'
DROP       all  --  anywhere             anywhere

Chain dmz2net (1 references)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere            ctstate RELATED,ESTABLISHED
ACCEPT     all  --  anywhere             anywhere

Chain dmz_frwd (1 references)
target     prot opt source               destination
ACCEPT     udp  --  anywhere             anywhere            udp dpts:bootps:bootpc
dmz2net    all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere

Chain dropBcast (2 references)
target     prot opt source               destination
DROP       all  --  anywhere             anywhere            ADDRTYPE match dst-type BROADCAST
DROP       all  --  anywhere             base-address.mcast.net/4

Chain dropInvalid (2 references)
target     prot opt source               destination
DROP       all  --  anywhere             anywhere            ctstate INVALID

Chain dropNotSyn (2 references)
target     prot opt source               destination
DROP       tcp  --  anywhere             anywhere            tcp flags:!FIN,SYN,RST,ACK/SYN

Chain dynamic (2 references)
target     prot opt source               destination

Chain fail2ban-apache (1 references)
target     prot opt source               destination
RETURN     all  --  anywhere             anywhere

Chain fail2ban-postfix (1 references)
target     prot opt source               destination
RETURN     all  --  anywhere             anywhere

Chain fail2ban-ssh (1 references)
target     prot opt source               destination
RETURN     all  --  anywhere             anywhere

Chain fail2ban-ssh-ddos (1 references)
target     prot opt source               destination
RETURN     all  --  anywhere             anywhere

Chain fw2dmz (1 references)
target     prot opt source               destination
ACCEPT     udp  --  anywhere             anywhere            udp dpts:bootps:bootpc
ACCEPT     all  --  anywhere             anywhere            ctstate RELATED,ESTABLISHED
ACCEPT     all  --  anywhere             anywhere

Chain fw2net (1 references)
target     prot opt source               destination
ACCEPT     udp  --  anywhere             anywhere            udp dpts:bootps:bootpc
ACCEPT     all  --  anywhere             anywhere            ctstate RELATED,ESTABLISHED
ACCEPT     all  --  anywhere             anywhere

Chain logdrop (0 references)
target     prot opt source               destination
DROP       all  --  anywhere             anywhere

Chain logflags (5 references)
target     prot opt source               destination
LOG        all  --  anywhere             anywhere            LOG level info ip-options prefix `Shorewall:logflags:DROP:'
DROP       all  --  anywhere             anywhere

Chain logreject (0 references)
target     prot opt source               destination
reject     all  --  anywhere             anywhere

Chain net2dmz (1 references)
target     prot opt source               destination
blacklst   all  --  anywhere             anywhere            ctstate INVALID,NEW
smurfs     all  --  anywhere             anywhere            ctstate INVALID,NEW
tcpflags   tcp  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere            ctstate RELATED,ESTABLISHED
Drop       all  --  anywhere             anywhere
LOG        all  --  anywhere             anywhere            LOG level info prefix `Shorewall:net2dmz:DROP:'
DROP       all  --  anywhere             anywhere

Chain net2fw (1 references)
target     prot opt source               destination
blacklst   all  --  anywhere             anywhere            ctstate INVALID,NEW
smurfs     all  --  anywhere             anywhere            ctstate INVALID,NEW
ACCEPT     udp  --  anywhere             anywhere            udp dpts:bootps:bootpc
tcpflags   tcp  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere            ctstate RELATED,ESTABLISHED
@net2fw    tcp  --  anywhere             anywhere            tcp flags:FIN,SYN,RST,ACK/SYN
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:ssh /* SSH */
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:www /* HTTP */
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:https /* HTTPS */
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:smtp /* SMTP */
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:ssmtp /* SMTPS */
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:imap2 /* IMAP */
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:imaps /* IMAPS */
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:pop3 /* POP3 */
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:pop3s /* POP3S */
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:ftp /* FTP */
ACCEPT     icmp --  anywhere             anywhere            icmp echo-request
ACCEPT     icmp --  anywhere             anywhere            icmp echo-request /* Ping */
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:8006
ACCEPT     tcp  --  anywhere             anywhere            tcp dpts:5900:5999
Drop       all  --  anywhere             anywhere
LOG        all  --  anywhere             anywhere            LOG level info prefix `Shorewall:net2fw:DROP:'
DROP       all  --  anywhere             anywhere

Chain reject (10 references)
target     prot opt source               destination
DROP       all  --  anywhere             anywhere            ADDRTYPE match src-type BROADCAST
DROP       all  --  base-address.mcast.net/4  anywhere
DROP       igmp --  anywhere             anywhere
REJECT     tcp  --  anywhere             anywhere            reject-with tcp-reset
REJECT     udp  --  anywhere             anywhere            reject-with icmp-port-unreachable
REJECT     icmp --  anywhere             anywhere            reject-with icmp-host-unreachable
REJECT     all  --  anywhere             anywhere            reject-with icmp-host-prohibited

Chain shorewall (0 references)
target     prot opt source               destination

Chain smurflog (2 references)
target     prot opt source               destination
LOG        all  --  anywhere             anywhere            LOG level info prefix `Shorewall:smurfs:DROP:'
DROP       all  --  anywhere             anywhere

Chain smurfs (2 references)
target     prot opt source               destination
RETURN     all  --  default              anywhere
smurflog   all  --  anywhere             anywhere            [goto] ADDRTYPE match src-type BROADCAST
smurflog   all  --  base-address.mcast.net/4  anywhere            [goto]

Chain tcpflags (2 references)
target     prot opt source               destination
logflags   tcp  --  anywhere             anywhere            [goto] tcp flags:FIN,SYN,RST,PSH,ACK,URG/FIN,PSH,URG
logflags   tcp  --  anywhere             anywhere            [goto] tcp flags:FIN,SYN,RST,PSH,ACK,URG/NONE
logflags   tcp  --  anywhere             anywhere            [goto] tcp flags:SYN,RST/SYN,RST
logflags   tcp  --  anywhere             anywhere            [goto] tcp flags:FIN,SYN/FIN,SYN
logflags   tcp  --  anywhere             anywhere            [goto] tcp spt:0 flags:FIN,SYN,RST,ACK/SYN

Es ist ein proxmox Server mit shorewall.
 
Warum hast Du die IPv6 Adresse bei eth0 eingetragen und nicht bei vmbr0, so wie auch die IPv4 Adresse?

Code: 
iface vmbr0 inet6 static
  address 2a01:4f8:xxxx:xxxx::2
  netmask 64
  gateway fe80::1
 
Nach deinem Vorschlag:

Code: 
root@proxmox:/# /etc/init.d/networking restart
Running /etc/init.d/networking restart is deprecated because it may not enable again some interfaces ... (warning).
Reconfiguring network interfaces...SIOCDELRT: No such process
device vmbr0 already exists; can't create bridge with the same name
run-parts: /etc/network/if-pre-up.d/bridge exited with return code 1
done.
 
So kann es zumindest gehen:
http://forum.proxmox.com/archive/index.php/t-6436.html

Code: 
root@proxmox:/# ip -6 ro add ::/0 via  fe80::1 dev vmbr0
root@proxmox:/# ping6 ipv6.google.com
PING ipv6.google.com(fa-in-x69.1e100.net) 56 data bytes
64 bytes from fa-in-x69.1e100.net: icmp_seq=1 ttl=55 time=6.01 ms
64 bytes from fa-in-x69.1e100.net: icmp_seq=2 ttl=55 time=5.96 ms
64 bytes from fa-in-x69.1e100.net: icmp_seq=3 ttl=55 time=6.05 ms
64 bytes from fa-in-x69.1e100.net: icmp_seq=4 ttl=55 time=6.00 ms
64 bytes from fa-in-x69.1e100.net: icmp_seq=5 ttl=55 time=5.96 ms

Von außen ist zwar dann nicht meine URL aber zumindest die IPv6 zu erreichen. (Mal DNS nachprüfen)
 
vb-server said:
Hast du 2x auto vmbr0?
Click to expand...

Code: 
iface vmbr0 inet6 static
  address 2a01:4f8:160:1102::2
  netmask 64
  gateway fe80::1


auto vmbr0
iface vmbr0 inet static
        address 176.9.137.23
        netmask 255.255.255.224
        gateway 176.9.137.1
        bridge_ports eth0
        bridge_stp off
        bridge_fd 0

Nach nevakee nevakee's Vorschlag, oder nicht?
 
auto vmbr0 brauchst du nur einmal, und zwar BEVOR du das erste vmbr-interface confst. So in der form:

auto vmbr0
iface vmbr0 inet static
address bla
netmask bla
gateway bla

iface vmbr0 inet6 static
address bla
netmask bla
gateway bla
 
You must log in or register to reply here.
Back
Top