IPv6 - Revision history

Tony: /* ip6tables */

2013-11-17T04:35:01Z

‎ip6tables

Tony: Added connection state kernel modules needed for ip6tables.

2013-11-17T04:29:01Z

Added connection state kernel modules needed for ip6tables.

FRCorey at 03:21, 11 April 2012

2012-04-11T03:21:24Z

109.73.14.252: proxy_ndp may need to be enabled

2011-12-27T17:36:40Z

proxy_ndp may need to be enabled

Kir: Reverted edits by 173.12.28.45 (talk) to last revision by 88.74.63.8

2011-11-28T05:27:49Z

Reverted edits by 173.12.28.45 (talk) to last revision by 88.74.63.8

173.12.28.45: ICbAOgoaX

2011-11-28T04:04:54Z

ICbAOgoaX

88.74.63.8: s/to/from/

2011-05-06T17:40:45Z

s/to/from/

Cgb: Documented venet static IPv6 configuration (opening paragraph leads users to think IPv6 won't work with venet)

2011-02-10T07:40:13Z

Documented venet static IPv6 configuration (opening paragraph leads users to think IPv6 won't work with venet)

92.55.24.144: possibly useful link to sixxs wiki.

2010-05-17T04:16:04Z

possibly useful link to sixxs wiki.

64.65.127.175 at 03:55, 27 January 2010

2010-01-27T03:55:16Z

@@ Line 57: / Line 57: @@
 ==ip6tables==
-If you will be using connection tracking in ip6tables (i.e. '-m state --state'), you'll need to enable extra kernel modules in the host /etc/vz.conf.  Add 'ipt_state' to IPTABLES and 'nf_conntrack_ipv6' to IP6TABLES.  They should look something like this:
+If you will be using connection tracking in any container ip6tables firewall rules (i.e. '-m state --state'), you'll need to enable additional kernel modules in the host /etc/vz.conf.  Add 'ipt_state' to IPTABLES and 'nf_conntrack_ipv6' to IP6TABLES.  They should look something like this:
 <pre>

← Older revision		Revision as of 04:29, 17 November 2013
Line 55:		Line 55:

	Removal is effective immediately and the host stops replying to echo requests.		Removal is effective immediately and the host stops replying to echo requests.
		+
		+	==ip6tables==
		+	If you will be using connection tracking in ip6tables (i.e. '-m state --state'), you'll need to enable extra kernel modules in the host /etc/vz.conf. Add 'ipt_state' to IPTABLES and 'nf_conntrack_ipv6' to IP6TABLES. They should look something like this:
		+
		+	<pre>
		+	IPTABLES="ipt_REJECT ipt_tos ipt_limit ipt_multiport iptable_filter iptable_mangle ipt_TCPMSS ipt_tcpmss ipt_ttl ipt_length ipt_state"
		+
		+	IP6TABLES="ip6_tables ip6table_filter ip6table_mangle ip6t_REJECT nf_conntrack_ipv6"
		+	</pre>

	==See also==		==See also==

← Older revision		Revision as of 03:21, 11 April 2012
Line 4:		Line 4:

	venet devices are not fully IPv6 compliant, but still works if you statically assign IPv6 addresses. They do not properly support MAC addresses and consequently link local addresses and can not play nice with neighbor discovery or router advertisements, router discovery, or auto-conf. They also require additional modifications to the layer 3 forwarding behaviour of the host via sysctl.		venet devices are not fully IPv6 compliant, but still works if you statically assign IPv6 addresses. They do not properly support MAC addresses and consequently link local addresses and can not play nice with neighbor discovery or router advertisements, router discovery, or auto-conf. They also require additional modifications to the layer 3 forwarding behaviour of the host via sysctl.
		+
		+	== Configure the Node ==
		+	In order for IPv6 to work for containers you must have a fully functioning IPv6 interface on the host node.
		+
		+	== CentOS Node Configuration for IPv6 ==
		+
		+	<pre>Add the below to the file /etc/sysconfig/network
		+
		+	NETWORKING_IPV6=yes
		+	IPV6FORWARDING=yes
		+	IPV6_DEFAULTDEV=eth0
		+	IPV6_DEFAULTGW=aaaa:bbbb:a01a::1
		+	IPV6_AUTOCONF=no
		+
		+	Add the below to the file /etc/sysconfig/network-scripts/ifcfg-ethX X being your interface number
		+
		+	IPV6INIT=yes
		+	IPV6ADDR=aaaa:bbbb:cccc:0000:0100::1
		+
		+	/etc/sysctl.conf also needs
		+
		+	net.ipv6.conf.default.forwarding = 1
		+	net.ipv6.conf.all.forwarding = 1
		+	net.ipv6.conf.all.proxy_ndp = 1
		+	</pre>
		+

	== venet example ==		== venet example ==

← Older revision		Revision as of 17:36, 27 December 2011
Line 14:		Line 14:

	In my tests, the container had to be restarted before it would respond to ICMP6 echo requests.		In my tests, the container had to be restarted before it would respond to ICMP6 echo requests.
		+
		+	In other tests on 2.6.32-042stab044.11 kernel, container failed to receive Neighbor Solicitation requests and replies, so I had to enable proxy_ndp:
		+
		+	<pre>
		+	# sysctl -w net.ipv6.conf.all.proxy_ndp=1
		+	</pre>
		+
		+	(and later add appropriate line to /etc/sysctl.conf).

	=== Removing an IPv6 address from a container ===		=== Removing an IPv6 address from a container ===

← Older revision		Revision as of 05:27, 28 November 2011
Line 1:		Line 1:
−	~~Boy that relaly helps me~~ the ~~heck out~~.	+	[[Category:HOWTO]]
		+	[[Category:Networking]]
		+	IPv6 works best when veth devices are used to bridge VEs to their host. An IPv6 compliant method of using veth interfaces for VEs can be found in the [[VEs and HNs in same subnets]] article.
		+
		+	venet devices are not fully IPv6 compliant, but still works if you statically assign IPv6 addresses. They do not properly support MAC addresses and consequently link local addresses and can not play nice with neighbor discovery or router advertisements, router discovery, or auto-conf. They also require additional modifications to the layer 3 forwarding behaviour of the host via sysctl.
		+
		+	== venet example ==
		+	(tests done on CentOS kernel 2.6.18-194.26.1.el5.028stab079.2)
		+
		+	=== Adding an IPv6 address to a container ===
		+	<pre>
		+	# vzctl set <id> --ipadd <ipv6_addr> --save
		+	</pre>
		+
		+	In my tests, the container had to be restarted before it would respond to ICMP6 echo requests.
		+
		+	=== Removing an IPv6 address from a container ===
		+	<pre>
		+	# vzctl set <id> --ipdel <ipv6_addr> --save
		+	</pre>
		+
		+	Removal is effective immediately and the host stops replying to echo requests.
		+
		+	==See also==
		+	* [[Virtual Ethernet device]]
		+	* [[Differences between venet and veth]]
		+
		+	== External Links ==
		+	* A user success story / howto on SixXS wiki [https://www.sixxs.net/wiki/User:JNN2-SIXXS/OpenVZ].

← Older revision		Revision as of 04:04, 28 November 2011
Line 1:		Line 1:
−	~~[[Category:HOWTO]]~~	+	Boy that relaly helps me the heck out.
−	~~[[Category:Networking]]~~
−	~~IPv6 works best when veth devices are used to bridge VEs to their host. An IPv6 compliant method of using veth interfaces for VEs can be found in~~ the ~~[[VEs and HNs in same subnets]] article.~~
−
−	venet devices are not fully IPv6 compliant, but still works if you statically assign IPv6 addresses. They do not properly support MAC addresses and consequently link local addresses and can not play nice with neighbor discovery or router advertisements, router discovery, or auto-conf. They also require additional modifications to the layer 3 forwarding behaviour of the host via sysctl.
−
−	~~== venet example ==~~
−	~~(tests done on CentOS kernel 2.6.18-194.26.1.el5.028stab079.2)~~
−
−	~~=== Adding an IPv6 address to a container ===~~
−	~~<pre>~~
−	~~# vzctl set <id> --ipadd <ipv6_addr> --save~~
−	~~</pre>~~
−
−	~~In my tests, the container had to be restarted before it would respond to ICMP6 echo requests.~~
−
−	~~=== Removing an IPv6 address from a container ===~~
−	~~<pre>~~
−	~~# vzctl set <id> --ipdel <ipv6_addr> --save~~
−	~~</pre>~~
−
−	~~Removal is effective immediately and the host stops replying to echo requests.~~
−
−	~~==See also==~~
−	* [[Virtual Ethernet device]]
−	* [[Differences between venet and veth]]
−
−	~~== External Links ==~~
−	* A user success story / howto on SixXS wiki [https://www.sixxs.net/wiki/User:JNN2-SIXXS/OpenVZ].

@@ Line 15: / Line 15: @@
 In my tests, the container had to be restarted before it would respond to ICMP6 echo requests.
-=== Removing an IPv6 address to a container ===
+=== Removing an IPv6 address from a container ===
 <pre>
 # vzctl set <id> --ipdel <ipv6_addr> --save

@@ Line 3: / Line 3: @@
 IPv6 works best when veth devices are used to bridge VEs to their host.  An IPv6 compliant method of using veth interfaces for VEs can be found in the [[VEs and HNs in same subnets]] article.
-venet devices are not fully IPv6 compliant.  They do not properly support MAC addresses and consequently link local addresses and can not play nice with neighbor discovery or router advertisements, router discovery, or auto-conf.  They also require additional modifications to the layer 3 forwarding behaviour of the host via sysctl.
+venet devices are not fully IPv6 compliant, but still works if you statically assign IPv6 addresses.  They do not properly support MAC addresses and consequently link local addresses and can not play nice with neighbor discovery or router advertisements, router discovery, or auto-conf.  They also require additional modifications to the layer 3 forwarding behaviour of the host via sysctl.
 ==See also==

← Older revision		Revision as of 04:16, 17 May 2010
Line 8:		Line 8:
	* [[Virtual Ethernet device]]		* [[Virtual Ethernet device]]
	* [[Differences between venet and veth]]		* [[Differences between venet and veth]]
		+
		+	== External Links ==
		+	* A user success story / howto on SixXS wiki [https://www.sixxs.net/wiki/User:JNN2-SIXXS/OpenVZ].

@@ Line 4: / Line 4: @@
 venet devices are not fully IPv6 compliant.  They do not properly support MAC addresses and consequently link local addresses and can not play nice with neighbor discovery or router advertisements, router discovery, or auto-conf.  They also require additional modifications to the layer 3 forwarding behaviour of the host via sysctl.
 ==See also==
 * [[Virtual Ethernet device]]
 * [[Differences between venet and veth]]