Linux IPv6 HOWTO (de)

Networking

<myipaddress>
1.2.3.4
$ whoami
# whoami
diff -u --recursive --new-file v2.1.7/linux/include/linux/in6.h
¬ linux/include/linux/in6.h

--- v2.1.7/linux/include/linux/in6.h Thu Jan 1 02:00:00 1970 
+++ linux/include/linux/in6.h Sun Nov 3 11:04:42 1996 
@@ -0,0 +1,99 @@ 
+/* 
+ * Types and definitions for AF_INET6 
+ * Linux INET6 implementation 
+ * + * Authors: 
+ * Pedro Roque <******> 
+ * 
+ * Source: 
+ * IPv6 Program Interfaces for BSD Systems 
+ * <draft-ietf-ipngwg-bsd-api-05.txt>
2^128-1: 340282366920938463463374607431768211455
2^128-1: 0xffffffffffffffffffffffffffffffff
2^128-1: ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff
2001:0db8:0100:f101:0210:a4ff:fee3:9566
2001:0db8:0100:f101:0210:a4ff:fee3:9566  -> 
¬ 2001:0db8:100:f101:210:a4ff:fee3:9566
2001:0db8:100:f101:0:0:0:1  ->  2001:0db8:100:f101::1
0000:0000:0000:0000:0000:0000:0000:0001  ->  ::1
# ipv6calc --addr_to_base85 2001:0db8:0100:f101:0210:a4ff:fee3:9566 
Itu&-ZQ82s>J%s99FJXT
0000:0000:0000:0000:0000:0000:0000:0001 
::1
0000:0000:0000:0000:0000:0000:0000:0000 
::
0:0:0:0:0:ffff:a.b.c.d/96
::ffff:a.b.c.d/96
::ffff:1.2.3.4
0:0:0:0:0:0:a.b.c.d/96
::a.b.c.d/96
fe8x:  <- zurzeit als einziger in Benutzung
fe9x:
feax:
febx:
fecx:  <- meistens genutzt.
fedx:
feex:
fefx:
fcxx:
fdxx:  <- zurzeit als einziger in Benutzung
fd0f:8b72:ac90::/48
2xxx: 
3xxx:
3ffe:
3ffe:ffff:100:f102::1
3ffe:ffff: 
2002:
2002:c0a8:0101:5::1
ipv4="1.2.3.4"; sla="5"; printf "2002:%02x%02x:%02x%02x:%04x::1" `echo $ipv4
¬ | tr "." " "` $sla
2001:
3ffe:ffff::/32
2001:0DB8::/32   EXAMPLENET-WF
ffxy:
ff02::1:ff00:1234
2001:0db8:100:f101:210:a4ff:fee3:9566/64  <- Node's address
2001:0db8:100:f101::/64  <- subnet-router anycast address
00:10:a4:01:23:45
0210:a4ff:fe01:2345
2001:0db8:0100:f101:0210:a4ff:fe01:2345
2001:0db8:100:f101::1
2001:0db8:100:1:2:3:4:5/48
2001:0db8:0100:0000:0000:0000:0000:0000
ffff:ffff:ffff:0000:0000:0000:0000:0000
2001:0db8:100::/48     ::            U  1 0 0 sit1 
2000::/3               ::192.88.99.1 UG 1 0 0 tun6to4
2001:0db8:100:1:2:3:4:5/48  ->  routed through device sit1
2001:0db8:200:1:2:3:4:5/48  ->  routed through device tun6to4
/proc/net/if_inet6
# test -f /proc/net/if_inet6 && echo "Running kernel is IPv6 ready"
# modprobe ipv6
# lsmod |grep -w 'ipv6' && echo "IPv6 module successfully loaded"
alias net-pf-10 ipv6  # automatically load IPv6 module on demand
alias net-pf-10 off   # disable automatically load of IPv6 module on demand
# /sbin/ifconfig -? 2>& 1|grep -qw 'inet6' && echo "utility 'ifconfig' is
¬ IPv6-ready"
# /sbin/route -? 2>& 1|grep -qw 'inet6' && echo "utility 'route' is IPv6-ready"
# /sbin/ip 2>&1 |grep -qw 'inet6' && echo "utility 'ip' is IPv6-ready"
# ping6 <hostwithipv6address>
# ping6 <ipv6address>
# ping6 [-I <device>] <link-local-ipv6address>
# ping6 <link-local-ipv6address>%<device>
# ping6 -c 1 ::1 
PING ::1(::1) from ::1 : 56 data bytes 
64 bytes from ::1: icmp_seq=0 hops=64 time=292 usec

--- ::1 ping statistics --- 
1 packets transmitted, 1 packets received, 0% packet loss 
round-trip min/avg/max/mdev = 0.292/0.292/0.292/0.000 ms
# ping6 fe80::212:34ff:fe12:3456 
connect: Invalid argument
# ping6 -I eth0 -c 1 fe80::2e0:18ff:fe90:9205 
PING fe80::212:23ff:fe12:3456(fe80::212:23ff:fe12:3456) from
¬ fe80::212:34ff:fe12:3478 eth0: 56 data bytes 
64 bytes from fe80::212:23ff:fe12:3456: icmp_seq=0 hops=64 time=445 usec

--- fe80::2e0:18ff:fe90:9205 ping statistics --- 
1 packets transmitted, 1 packets received, 0% packet loss round-trip
¬ min/avg/max/mdev = 0.445/0.445/0.445/0.000 ms
# ping6 -c 1 fe80::2e0:18ff:fe90:9205%eth0
# ping6 -I eth0 ff02::1
PING ff02::1(ff02::1) from fe80:::2ab:cdff:feef:0123 eth0: 56 data bytes
64 bytes from ::1: icmp_seq=1 ttl=64 time=0.104 ms
64 bytes from fe80::212:34ff:fe12:3450: icmp_seq=1 ttl=64 time=0.549 ms (DUP!) 
# ping6 ff02::1%eth0
# traceroute6 www.6bone.net 
traceroute to 6bone.net (3ffe:b00:c18:1::10) from 2001:0db8:0000:f101::2, 30
¬ hops max, 16 byte packets 
 1 localipv6gateway (2001:0db8:0000:f101::1) 1.354 ms 1.566 ms 0.407 ms 
 2 swi6T1-T0.ipv6.switch.ch (3ffe:2000:0:400::1) 90.431 ms 91.956 ms 92.377 ms 
 3 3ffe:2000:0:1::132 (3ffe:2000:0:1::132) 118.945 ms 107.982 ms 114.557 ms 
 4 3ffe:c00:8023:2b::2 (3ffe:c00:8023:2b::2) 968.468 ms 993.392 ms 973.441 ms 
 5 3ffe:2e00:e:c::3 (3ffe:2e00:e:c::3) 507.784 ms 505.549 ms 508.928 ms 
 6 www.6bone.net (3ffe:b00:c18:1::10) 1265.85 ms * 1304.74 ms
# traceroute -I -n ipv6.google.com
traceroute to ipv6.google.com (2a00:1450:4016:804::200e), 30 hops max, 80 byte packets
 1  2001:a61:***  0.410 ms  0.510 ms  0.655 ms
 2  2001:a60::89:705:1  26.428 ms  34.361 ms  41.777 ms
 3  2001:a60::89:0:1:2  19.131 ms  19.163 ms  19.248 ms
 4  2001:a60:0:106::2  20.464 ms  20.467 ms  20.457 ms
 5  2001:4860::9:4000:cf86  21.836 ms *  21.852 ms
 6  2001:4860:0:1::19  21.690 ms  21.585 ms  22.919 ms
 7  2a00:1450:4016:804::200e  23.176 ms  19.310 ms  20.065 ms
# tracepath6 www.6bone.net 
 1?: [LOCALHOST] pmtu 1480 
 1: 3ffe:401::2c0:33ff:fe02:14 150.705ms 
 2: 3ffe:b00:c18::5 267.864ms 
 3: 3ffe:b00:c18::5 asymm 2 266.145ms pmtu 1280 
 3: 3ffe:3900:5::2 asymm 4 346.632ms 
 4: 3ffe:28ff:ffff:4::3 asymm 5 365.965ms 
 5: 3ffe:1cff:0:ee::2 asymm 4 534.704ms 
 6: 3ffe:3800::1:1 asymm 4 578.126ms !N 
Resume: pmtu 1280
# tcpdump -t -n -i eth0 -s 512 -vv ip6 or proto ipv6 
tcpdump: listening on eth0 
2001:0db8:100:f101:2e0:18ff:fe90:9205 > 2001:0db8:100:f101::1: icmp6: echo
¬ request (len 64, hlim 64) 
2001:0db8:100:f101::1 > 2001:0db8:100:f101:2e0:18ff:fe90:9205: icmp6: echo
¬ reply (len 64, hlim 64)
# tcpdump -t -n -i ppp0 -s 512 -vv ip6 or proto ipv6 
tcpdump: listening on ppp0 
1.2.3.4 > 5.6.7.8: 2002:ffff:f5f8::1 > 2001:0db8:100::1: icmp6: echo request
¬ (len 64, hlim 64) (DF) (ttl 64, id 0, len 124) 
5.6.7.8 > 1.2.3.4: 2001:0db8:100::1 > 2002:ffff:f5f8::1: icmp6: echo reply (len
¬ 64, hlim 61) (ttl 23, id 29887, len 124) 
1.2.3.4 > 5.6.7.8: 2002:ffff:f5f8::1 > 2001:0db8:100::1: icmp6: echo request
¬ (len 64, hlim 64) (DF) (ttl 64, id 0, len 124) 
5.6.7.8 > 1.2.3.4: 2001:0db8:100::1 > 2002:ffff:f5f8::1: icmp6: echo reply (len
¬ 64, hlim 61) (ttl 23, id 29919, len 124)
# host -t AAAA www.join.uni-muenster.de
www.join.uni-muenster.de. is an alias for tolot.join.uni-muenster.de. 
tolot.join.uni-muenster.de. has AAAA address
¬ 2001:638:500:101:2e0:81ff:fe24:37c6
$ telnet 3ffe:400:100::1 80
Trying 3ffe:400:100::1... 
Connected to 3ffe:400:100::1. 
Escape character is '^]'. 
HEAD / HTTP/1.0

HTTP/1.1 200 OK 
Date: Sun, 16 Dec 2001 16:07:21 
GMT Server: Apache/2.0.28 (Unix) 
Last-Modified: Wed, 01 Aug 2001 21:34:42 GMT 
ETag: "3f02-a4d-b1b3e080" 
Accept-Ranges: bytes 
Content-Length: 2637 
Connection: close 
Content-Type: text/html; charset=ISO-8859-1

Connection closed by foreign host.
$ ssh -6 ::1 
user@::1's password: ****** 
[user@ipv6host user]$
# ip link set dev <interface> up
# ip link set dev <interface> down
# ip link set dev eth0 up
# ip link set dev eth0 down
# /sbin/ifconfig <interface> up
# /sbin/ifconfig <interface> down
# /sbin/ifconfig eth0 up
# /sbin/ifconfig eth0 down
# /sbin/ip -6 addr show dev <interface>
# /sbin/ip -6 addr show dev eth0
2: eth0: <BROADCAST,MULTICAST,UP&gt; mtu 1500 qdisc pfifo_ fast qlen 100
inet6 fe80::210:a4ff:fee3:9566/10 scope link
inet6 2001:0db8:0:f101::1/64 scope global
inet6 fec0:0:0:f101::1/64 scope site 
# /sbin/ip -6 addr show dev eth0 
3: eth0: <BROADCAST,MULTICAST,PROMISC,UP&gt; mtu 1500 qdisc pfifo_fast qlen
¬ 100 
inet6 2002:d950:f5f8:f101:2e0:18ff:fe90:9205/64 scope global dynamic 
valid_lft 16sec preferred_lft 6sec 
inet6 3ffe:400:100:f101:2e0:18ff:fe90:9205/64 scope global dynamic 
valid_lft 2591997sec preferred_lft 604797sec inet6 fe80::2e0:18ff:fe90:9205/10
¬ scope link
# /sbin/ifconfig <interface>
# /sbin/ifconfig eth0 |grep "inet6 addr:"
inet6 addr: fe80::210:a4ff:fee3:9566/10 Scope:Link
inet6 addr: 2001:0db8:0:f101::1/64 Scope:Global
inet6 addr: fec0:0:0:f101::1/64 Scope:Site
# /sbin/ip -6 addr add <ipv6address>/<prefixlength> dev <interface> 
# /sbin/ip -6 addr add 2001:0db8:0:f101::1/64 dev eth0 
# /sbin/ifconfig <interface> inet6 add <ipv6address>/<prefixlength>
# /sbin/ifconfig eth0 inet6 add 2001:0db8:0:f101::1/64 
# /sbin/ip -6 addr del <ipv6address>/<prefixlength> dev <interface> 
# /sbin/ip -6 addr del 2001:0db8:0:f101::1/64 dev eth0 
# /sbin/ifconfig <interface> inet6 del <ipv6address>/<prefixlength>
# /sbin/ifconfig eth0 inet6 del 2001:0db8:0:f101::1/64
# sysctl -w net.ipv6.conf.eth0.use_tempaddr=2
# ip link set dev eth0 down
# ip link set dev eth0 up
# ip -6 addr show dev eth0
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qlen 1000
    inet6 2001:db8:0:1:8992:3c03:d6e2:ed72/64 scope global secondary dynamic   <- pseudo-random IID
       valid_lft 604711sec preferred_lft 86311sec
    inet6 2001:db8:0:1::224:21ff:fe01:2345/64 scope global     <- IID based on MAC
       valid_lft 604711sec preferred_lft 86311sec
    ...
net.ipv6.conf.eth0.use_tempaddr=2
net.ipv6.conf.all.use_tempaddr=2
net.ipv6.conf.default.use_tempaddr=2
# sysctl -p
# nmcli connection 
NAME UUID TYPE DEVICE
ens4v1 d0fc2b2e-5fa0-4675-96b5-b723ca5c46db 802-3-ethernet ens4v1 
# ip -o addr show dev ens4v1 | grep temporary | wc -l
0
# nmcli connection show ens4v1 |grep ip6-privacy
ipv6.ip6-privacy: -1 (unknown)
# nmcli connection modify ens4v1 ipv6.ip6-privacy 2
# nmcli connection down ens4v1; nmcli connection up ens4v1
# nmcli connection show ens4v1 |grep ip6-privacy
ipv6.ip6-privacy: 2 (active, prefer temporary IP)
# ip -o addr show dev ens4v1 | grep temporary | wc -l
2
# /sbin/ip -6 route show [dev <device>]
# /sbin/ip -6 route show dev eth0
2001:0db8:0:f101::/64 proto kernel metric 256 mtu 1500 advmss 1440
fe80::/10             proto kernel metric 256 mtu 1500 advmss 1440
ff00::/8              proto kernel metric 256 mtu 1500 advmss 1440
default               proto kernel metric 256 mtu 1500 advmss 1440
# /sbin/route -A inet6 
# /sbin/route -A inet6 |grep -w "eth0"
2001:0db8:0:f101 ::/64 :: UA  256 0 0 eth0 <- Interface route for global
¬ address
fe80::/10        ::       UA  256 0 0 eth0 <- Interface route for link-local
¬ address
ff00::/8         ::       UA  256 0 0 eth0 <- Interface route for all multicast
¬ addresses
::/0             ::       UDA 256 0 0 eth0 <- Automatic default route
# /sbin/ip -6 route add <ipv6network>/<prefixlength> via <ipv6address>
¬ [dev <device>]
# /sbin/ip -6 route add default via 2001:0db8:0:f101::1
# /sbin/route -A inet6 add <ipv6network>/<prefixlength> gw
¬ <ipv6address> [dev <device>] 
# /sbin/route -A inet6 add default gw 2001:0db8:0:f101::1
# /sbin/ip -6 route del <ipv6network>/<prefixlength> via <ipv6address>
¬ [dev <device>]
# /sbin/ip -6 route del default via 2001:0db8:0:f101::1
# /sbin/route -A inet6 del <ipv6network>/<prefixlength> gw <ipv6address> [dev
¬ <device>]
# /sbin/route -A inet6 del default gw 2001:0db8:0:f101::1
# /sbin/ip -6 route add <ipv6network>/<prefixlength> dev <device>
¬ metric 1
# /sbin/ip -6 route add default dev eth0 metric 1
# /sbin/route -A inet6 add <network>/<prefixlength> dev <device>
# /sbin/route -A inet6 add default dev eth0 
# /sbin/ip -6 route del <ipv6network>/<prefixlength> dev <device>
# /sbin/ip -6 route del default dev eth0 
# /sbin/route -A inet6 del <network>/<prefixlength> dev <device>
# /sbin/route -A inet6 del default dev eth0
# ip -6 route show | grep ^default
default via fe80::212:34ff:fe12:3450 dev eth0 proto kernel metric 1024 expires
¬ 29sec mtu 1500 advmss 1440
# ip -6 neigh show [dev <device>]
# ip -6 neigh show
fe80::201:23ff:fe45:6789 dev eth0 lladdr 00:01:23:45:67:89 router nud reachable
# ip -6 neigh add <IPv6 address> lladdr <link-layer address> dev <device>
# ip -6 neigh add fec0::1 lladdr 02:01:02:03:04:05 dev eth0
# ip -6 neigh del <IPv6 address> lladdr <link-layer address> dev <device>
# ip -6 neigh del fec0::1 lladdr 02:01:02:03:04:05 dev eth0
# ip -6 neigh help
Usage: ip neigh { add | del | change | replace } { ADDR [ lladdr LLADDR ] 
          [ nud { permanent | noarp | stale | reachable } ] 
          | proxy ADDR } [ dev DEV ] 
       ip neigh {show|flush} [ to PREFIX ] [ dev DEV ] [ nud STATE ]
|   3+13   |    32     |    16  |            64 bits             | 
+---+------+-----------+--------+--------------------------------+ 
|  FP+TLA  |  V4ADDR   | SLA ID |           Interface ID         | 
|  0x2002  |           |        |                                | 
+---+------+-----------+--------+--------------------------------+
# /sbin/ip -6 tunnel show [<device>]
# /sbin/ip -6 tunnel show 
sit0: ipv6/ip remote any local any ttl 64 nopmtudisc 
sit1: ipv6/ip remote 195.226.187.50 local any ttl 64
# /sbin/route -A inet6 
# /sbin/route -A inet6 | grep "\Wsit0\W*$" 
::/96      ::               U   256  2  0  sit0 
2002::/16  ::               UA  256  0  0  sit0 
2000::/3   ::193.113.58.75  UG    1  0  0  sit0 
fe80::/10  ::               UA  256  0  0  sit0 
ff00::/8   ::               UA  256  0  0  sit0
# /sbin/ip tunnel add <device> mode sit ttl <ttldefault> remote
¬ <ipv4addressofforeigntunnel> local <ipv4addresslocal>
# /sbin/ip tunnel add sit1 mode sit ttl <ttldefault> remote
¬ <ipv4addressofforeigntunnel1> local <ipv4addresslocal>
# /sbin/ip link set dev sit1 up
# /sbin/ip -6 route add <prefixtoroute1> dev sit1 metric 1

# /sbin/ip tunnel add sit2 mode sit ttl <ttldefault>
¬ <ipv4addressofforeigntunnel2> local <ipv4addresslocal>
# /sbin/ip link set dev sit2 up
# /sbin/ip -6 route add <prefixtoroute2> dev sit2 metric 1

# /sbin/ip tunnel add sit3 mode sit ttl <ttldefault>
¬ <ipv4addressofforeigntunnel3> local <ipv4addresslocal>
# /sbin/ip link set dev sit3 up
# /sbin/ip -6 route add <prefixtoroute3> dev sit3 metric 1
# /sbin/ifconfig sit0 up

# /sbin/ifconfig sit0 tunnel <ipv4addressofforeigntunnel1>
# /sbin/ifconfig sit1 up
# /sbin/route -A inet6 add <prefixtoroute1> dev sit1

# /sbin/ifconfig sit0 tunnel <ipv4addressofforeigntunnel2>
# /sbin/ifconfig sit2 up
# /sbin/route -A inet6 add <prefixtoroute2> dev sit2

# /sbin/ifconfig sit0 tunnel <ipv4addressofforeigntunnel3>
# /sbin/ifconfig sit3 up
# /sbin/route -A inet6 add <prefixtoroute3> dev sit3
# /sbin/ifconfig sit0 up

# /sbin/route -A inet6 add <prefixtoroute1> gw
¬ ::<ipv4addressofforeigntunnel1> dev sit0
# /sbin/route -A inet6 add <prefixtoroute2> gw
¬ ::<ipv4addressofforeigntunnel2> dev sit0
# /sbin/route -A inet6 add <prefixtoroute3> gw
¬ ::<ipv4addressofforeigntunnel3> dev sit0
# /sbin/ip tunnel del <device>
# /sbin/ip -6 route del <prefixtoroute1> dev sit1
# /sbin/ip link set sit1 down
# /sbin/ip tunnel del sit1

# /sbin/ip -6 route del <prefixtoroute2> dev sit2
# /sbin/ip link set sit2 down
# /sbin/ip tunnel del sit2

# /sbin/ip -6 route del <prefixtoroute3> dev sit3
# /sbin/ip link set sit3 down
# /sbin/ip tunnel del sit3
# /sbin/route -A inet6 del <prefixtoroute3> dev sit3
# /sbin/ifconfig sit3 down

# /sbin/route -A inet6 del <prefixtoroute2> dev sit2
# /sbin/ifconfig sit2 down

# /sbin/route -A inet6 add <prefixtoroute1> dev sit1
# /sbin/ifconfig sit1 down

# /sbin/ifconfig sit0 down
# /sbin/route -A inet6 del <prefixtoroute1> gw
¬ ::<ipv4addressofforeigntunnel1> dev sit0
# /sbin/route -A inet6 del <prefixtoroute2> gw
¬ ::<ipv4addressofforeigntunnel2> dev sit0
# /sbin/route -A inet6 del <prefixtoroute3> gw
¬ ::<ipv4addressofforeigntunnel3> dev sit0

# /sbin/ifconfig sit0 down
1.2.3.4
2002:0102:0304::
2002:0102:0304::1
ipv4="1.2.3.4"; printf "2002:%02x%02x:%02x%02x::1" `echo $ipv4 | tr "." " "`
# /sbin/ip tunnel add tun6to4 mode sit ttl <ttldefault> remote any local
¬ <localipv4address> 
# /sbin/ip link set dev tun6to4 up 
# /sbin/ip -6 addr add <local6to4address>/16 dev tun6to4 
# /sbin/ip -6 route add default via ::192.88.99.1 dev tun6to4 metric 1
# /sbin/ip -6 route add default via 2002:c058:6301::1 dev tun6to4 metric 1
# /sbin/ifconfig sit0 up 
# /sbin/ifconfig sit0 add <local6to4address>/16
# /sbin/route -A inet6 add default gw ::192.88.99.1 dev sit0
# /sbin/ip -6 route flush dev tun6to4
# /sbin/ip link set dev tun6to4 down
# /sbin/ip tunnel del tun6to4 
# /sbin/route -A inet6 del default gw ::192.88.99.1 dev sit0
# /sbin/ifconfig sit0 del <local6to4address>/16
# /sbin/ifconfig sit0 down 
# /sbin/ip -6 tunnel show [<device>]
# /sbin/ip -6 tunnel show mode any
ip6tnl0: ipv6/ipv6 remote :: local :: encaplimit 0 hoplimit 0 tclass 0x00 flowlabel 0x00000 (flowinfo 0x00000000)
ip6tnl1: ip/ipv6 remote fd00:0:0:2::a local fd00:0:0:2::1 dev eth1 encaplimit 4 hoplimit 64 tclass 0x00 flowlabel 0x00000 (flowinfo 0x00000000)
# /sbin/ip tunnel add <device> mode ip4ip6 remote <ipv6addressofforeigntunnel> local <ipv6addresslocal>
# /sbin/ip -6 tunnel add ip6tnl1 mode ip4ip6 remote <ipv6addressofforeigntunnel1> local <ipv6addresslocal>
# /sbin/ip link set dev ip6tnl1 up 
# /sbin/ip -6 route add <prefixtoroute1> dev ip6tnl1 metric 1

# /sbin/ip -6 tunnel add ip6tnl2 mode ip4ip6 remote <ipv6addressofforeigntunnel2> local <ipv6addresslocal>
# /sbin/ip link set dev ip6tnl2 up
# /sbin/ip -6 route add <prefixtoroute2> dev ip6tnl2 metric 1

# /sbin/ip -6 tunnel add ip6tnl3 mode ip4ip6 remote <ipv6addressofforeigntunnel3> local <ipv6addresslocal>
# /sbin/ip link set dev ip6tnl3 up
# /sbin/ip -6 route add <prefixtoroute3> dev ip6tnl3 metric 1
# /sbin/ip -6 tunnel del <device>
# /sbin/ip -6 route del <prefixtoroute1> dev ip6tnl1
# /sbin/ip link set ip6tnl1 down
# /sbin/ip -6 tunnel del ip6tnl1

# /sbin/ip -6 route del <prefixtoroute2> dev ip6tnl2
# /sbin/ip link set ip6tnl2 down
# /sbin/ip -6 tunnel del ip6tnl2

# /sbin/ip -6 route del <prefixtoroute3> dev ip6tnl3
# /sbin/ip link set ip6tnl3 down
# /sbin/ip -6 tunnel del ip6tnl3 
CONFIG_PROC_FS=y
# mount | grep "type proc"
none on /proc type proc (rw)
# cat /proc/sys/net/ipv6/conf/all/forwarding
0
# echo "1" >/proc/sys/net/ipv6/conf/all/forwarding
CONFIG_SYSCTL=y
# sysctl net.ipv6.conf.all.forwarding
net.ipv6.conf.all.forwarding = 0
# sysctl -w net.ipv6.conf.all.forwarding=1
net.ipv6.conf.all.forwarding = 1
# sysctl -w net.ipv4.ip_local_port_range="32768 61000"
net.ipv4.ip_local_port_range = 32768 61000
ZEBRA: netlink-listen error: No buffer space available, type=RTM_NEWROUTE(24),
¬ seq=426, pid=0
# cat /proc/net/if_inet6
00000000000000000000000000000001 01 80 10 80 lo
+------------------------------+ ++ ++ ++ ++ ++
|                                |  |  |  |  |
1                                2  3  4  5  6
# cat /proc/net/ipv6_route
00000000000000000000000000000000 00 00000000000000000000000000000000 00
+------------------------------+ ++ +------------------------------+ ++
|                                |  |                                |
1                                2  3                                4

¬ 00000000000000000000000000000000 ffffffff 00000001 00000001 00200200 lo
¬ +------------------------------+ +------+ +------+ +------+ +------+ ++
¬ |                                |        |        |        |        |
¬ 5                                6        7        8        9        10
# cat /proc/net/sockstat6
TCP6: inuse 7 
UDP6: inuse 2 
RAW6: inuse 1 
FRAG6: inuse 0 memory 0
$ dig +short aaaa st1.bieringer.de
2001:4dd0:ff00:834::2
2a01:238:423d:8800:85b3:9e6b:3019:8909 
precedence  ::1/128       50            # default
precedence  ::/0          40            # default
precedence  2002::/16     30            # default
precedence ::/96          20            # default
precedence ::ffff:0:0/96  10            # default
precedence 2001:4dd0:ff00:834::/64  80  # dst-A
precedence 2a01:238:423d:8800::/64  90  # dst-B
$ telnet st1.bieringer.de
Trying 2a01:238:423d:8800:85b3:9e6b:3019:8909...    (dst-B)
...
Trying 2001:4dd0:ff00:834::2...                     (dst-A)
...
precedence 2001:4dd0:ff00:834::/64  90  # dst-A ex 80
precedence 2a01:238:423d:8800::/64  80  # dst-B ex 90
$ telnet st1.bieringer.de
Trying 2001:4dd0:ff00:834::2...                     (dst-A)
...
Trying 2a01:238:423d:8800:85b3:9e6b:3019:8909...    (dst-B)
...
# ip addrlabel
prefix ::1/128 label 0 
prefix ::/96 label 3 
prefix ::ffff:0.0.0.0/96 label 4 
prefix 2001::/32 label 6 
prefix 2001:10::/28 label 7 
prefix 2002::/16 label 2 
prefix fc00::/7 label 5 
prefix ::/0 label 1 
# ip -6 addr show dev eth1 | grep -w inet6 |grep -w global
    inet6 2001:6f8:12d8:2:5054:ff:fefb:6582/64 scope global dynamic     (src-A)
    inet6 2001:6f8:900:8cbc:5054:ff:fefb:6582/64 scope global dynamic   (src-B)
$ telnet st1.bieringer.de
Trying 2001:4dd0:ff00:834::2...                     (dst-A)
...
Trying 2a01:238:423d:8800:85b3:9e6b:3019:8909...    (dst-B)
...
IP6 2001:6f8:12d8:2:5054:ff:fefb:6582.37762 > 2001:4dd0:ff00:834::2.telnet:                  (src-A -> dst-A)
IP6 2001:6f8:12d8:2:5054:ff:fefb:6582.45754 > 2a01:238:423d:8800:85b3:9e6b:3019:8909.telnet: (src-A -> dst-B)
# ip addrlabel add prefix 2001:6f8:12d8:2::/64 label 200
# ip addrlabel add prefix 2001:6f8:900:8cbc::/64 label 300
# ip addrlabel add prefix 2001:4dd0:ff00:834::/64 label 200
# ip addrlabel add prefix 2a01:238:423d:8800::/64 label 300
# ip addrlabel
prefix ::1/128 label 0 
prefix ::/96 label 3 
prefix ::ffff:0.0.0.0/96 label 4 
prefix 2a01:238:423d:8800::/64 label 300   # dst-B
prefix 2001:4dd0:ff00:834::/64 label 200   # dst-A
prefix 2001:6f8:900:8cbc::/64 label 300    # src-B
prefix 2001:6f8:12d8:2::/64 label 200      # src-A
prefix 2001::/32 label 6 
prefix 2001:10::/28 label 7 
prefix 2002::/16 label 2 
prefix fc00::/7 label 5 
prefix ::/0 label 1 
$ telnet st1.bieringer.de
Trying 2001:4dd0:ff00:834::2...                     (dst-A)
...
Trying 2a01:238:423d:8800:85b3:9e6b:3019:8909...    (dst-B)
...
IP6 2001:6f8:12d8:2:5054:ff:fefb:6582.37765   > 2001:4dd0:ff00:834::2.telnet:                  (src-A -> dst-A)
IP6 2001:6f8:900:8cbc:5054:ff:fefb:6582.39632 > 2a01:238:423d:8800:85b3:9e6b:3019:8909.telnet: (src-B -> dst-B)
# netstat -nlptu
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State      
¬ PID/Program name
tcp        0      0 0.0.0.0:32768           0.0.0.0:*               LISTEN     
¬ 1258/rpc.statd
tcp        0      0 0.0.0.0:32769           0.0.0.0:*               LISTEN     
¬ 1502/rpc.mountd
tcp        0      0 0.0.0.0:515             0.0.0.0:*               LISTEN     
¬ 22433/lpd Waiting
tcp        0      0 1.2.3.1:139             0.0.0.0:*               LISTEN     
¬ 1746/smbd
tcp        0      0 0.0.0.0:111             0.0.0.0:*               LISTEN     
¬ 1230/portmap
tcp        0      0 0.0.0.0:6000            0.0.0.0:*               LISTEN     
¬ 3551/X
tcp        0      0 1.2.3.1:8081            0.0.0.0:*               LISTEN     
¬ 18735/junkbuster
tcp        0      0 1.2.3.1:3128            0.0.0.0:*               LISTEN     
¬ 18822/(squid)
tcp        0      0 127.0.0.1:953           0.0.0.0:*               LISTEN     
¬ 30734/named
tcp        0      0 ::ffff:1.2.3.1:993      :::*                    LISTEN     
¬ 6742/xinetd-ipv6
tcp        0      0 :::13                   :::*                    LISTEN     
¬ 6742/xinetd-ipv6
tcp        0      0 ::ffff:1.2.3.1:143      :::*                    LISTEN     
¬ 6742/xinetd-ipv6
tcp        0      0 :::53                   :::*                    LISTEN     
¬ 30734/named
tcp        0      0 :::22                   :::*                    LISTEN     
¬ 1410/sshd
tcp        0      0 :::6010                 :::*                    LISTEN     
¬ 13237/sshd
udp        0      0 0.0.0.0:32768           0.0.0.0:*                          
¬ 1258/rpc.statd
udp        0      0 0.0.0.0:2049            0.0.0.0:*                          
¬ -
udp        0      0 0.0.0.0:32770           0.0.0.0:*                          
¬ 1502/rpc.mountd
udp        0      0 0.0.0.0:32771           0.0.0.0:*                          
¬ -
udp        0      0 1.2.3.1:137             0.0.0.0:*                          
¬ 1751/nmbd
udp        0      0 0.0.0.0:137             0.0.0.0:*                          
¬ 1751/nmbd
udp        0      0 1.2.3.1:138             0.0.0.0:*                          
¬ 1751/nmbd
udp        0      0 0.0.0.0:138             0.0.0.0:*                          
¬ 1751/nmbd
udp        0      0 0.0.0.0:33044           0.0.0.0:*                          
¬ 30734/named
udp        0      0 1.2.3.1:53              0.0.0.0:*                          
¬ 30734/named
udp        0      0 127.0.0.1:53            0.0.0.0:*                          
¬ 30734/named
udp        0      0 0.0.0.0:67              0.0.0.0:*                          
¬ 1530/dhcpd
udp        0      0 0.0.0.0:67              0.0.0.0:*                          
¬ 1530/dhcpd
udp        0      0 0.0.0.0:32858           0.0.0.0:*                          
¬ 18822/(squid)
udp        0      0 0.0.0.0:4827            0.0.0.0:*                          
¬ 18822/(squid)
udp        0      0 0.0.0.0:111             0.0.0.0:*                          
¬ 1230/portmap
udp        0      0 :::53                   :::*                               
¬ 30734/named
15:43:49.484751 fe80::212:34ff:fe12:3450 > ff02::1: icmp6: router
¬ advertisement(chlim=64, router_ltime=30, reachable_time=0,
¬ retrans_time=0)(prefix info: AR valid_ltime=30, preffered_ltime=20,
¬ prefix=2002:0102:0304:1::/64)(prefix info: LAR valid_ltime=2592000,
¬ preffered_ltime=604800, prefix=2001:0db8:0:1::/64)(src lladdr:
¬ 0:12:34:12:34:50) (len 88, hlim 255)
15:44:21.152646 fe80::212:34ff:fe12:3456 > ff02::2: icmp6: router solicitation
¬ (src lladdr: 0:12:34:12:34:56) (len 16, hlim 255)
15:44:17.712338 :: > ff02::1:ff12:3456: icmp6: neighbor sol: who has
¬ fe80::212:34ff:fe12:3456(src lladdr: 0:12:34:12:34:56) (len 32, hlim 255)
15:44:21.905596 :: > ff02::1:ff12:3456: icmp6: neighbor sol: who has
¬ 2002:0102:0304:1:212:34ff:fe12:3456(src lladdr: 0:12:34:12:34:56) (len 32,
¬ hlim 255)
15:44:22.304028 :: > ff02::1:ff12:3456: icmp6: neighbor sol: who has
¬ 2001:0db8:0:1:212:34ff:fe12:3456(src lladdr: 0:12:34:12:34:56) (len 32, hlim
¬ 255)
13:07:47.664538 2002:0102:0304:1:2e0:18ff:fe90:9205 > ff02::1:ff00:10: icmp6:
¬ neighbor sol: who has 2001:0db8:0:1::10(src lladdr: 0:e0:18:90:92:5) (len 32,
¬ hlim 255)
13:11:20.870070 fe80::2e0:18ff:fe90:9205 > ff02::1:ff00:10: icmp6: neighbor
¬ sol: who has fe80::10(src lladdr: 0:e0:18:90:92:5) (len 32, hlim 255)
/etc/sysconfig/network-scripts/network-functions-ipv6
# test -f /etc/sysconfig/network-scripts/network-functions-ipv6 && echo "Main
¬ IPv6 script library exists"
# source /etc/sysconfig/network-scripts/network-functions-ipv6 &&
¬ getversion_ipv6_functions 
20011124
# modprobe -c | grep net-pf-10
alias net-pf-10 off
NETWORKING_IPV6=yes
# service network restart
# modprobe -c | grep ipv6
alias net-pf-10 ipv6
IP6ADDR="<ipv6-Adresse>/<prefix>"
IPADDR="<ipv6-Adresse>/<prefix>"
iface eth0 inet6 static
        pre-up modprobe ipv6
        address 2001:0db8:1234:5::1:1
        # To suppress completely autoconfiguration:
        # up echo 0 > /proc/sys/net/ipv6/conf/all/autoconf
        netmask 64
        # The router is autoconfigured and has no fixed address.
        # It is magically
        # found. (/proc/sys/net/ipv6/conf/all/accept_ra). Otherwise:
        #gateway 2001:0db8:1234:5::1
# ifup --force eth0
# ip -6 addr show dev eth0 scope link
2: eth0: <BROADCAST,MULTICAST,UP> mtu 1500 qlen1000
    inet6 fe80::211:d8ff:fe6b:f0f5/64 scope link
       valid_lft forever preferred_lft forever 
# cd /path/to/src 
# tar z|jxf kernel-version.tar.gz|bz2 
# mv linux linux-version-iptables-version+IPv6 
# tar z|jxf iptables-version.tar.gz|bz2 
# cd iptables-version 
# make pending-patches KERNEL_DIR=/path/to/src/linux-version-iptables-version/ 
# make patch-o-matic KERNEL_DIR=/path/to/src/linux-version-iptables-version/ 
# make print-extensions 
Extensions found: IPv6:owner IPv6:limit IPv6:mac IPv6:multiport
# cd /path/to/src/linux-version-iptables-version/ 
- EXTRAVERSION = 
+ EXTRAVERSION = -iptables-version+IPv6-try 
            Code maturity level options 
                  Prompt for development and/or incomplete code/drivers : yes 
            Networking options 
                  Network packet filtering: yes 
                  The IPv6 protocol: module 
                       IPv6: Netfilter Configuration 
                             IP6 tables support: module 
                             All new options like following: 
                                   limit match support: module 
                                   MAC address match support: module 
                                   Multiple port match support: module 
                                   Owner match support: module 
                                   netfilter MARK match support: module 
                                   Aggregated address check: module 
                                   Packet filtering: module 
                                        REJECT target support: module 
                                        LOG target support: module 
                                   Packet mangling: module 
                                   MARK target support: module 
# mv /usr/src/linux /usr/src/linux.old 
# ln -s /path/to/src/linux-version-iptables-version /usr/src/linux 
# rpm --rebuild /path/to/SRPMS/iptables-version-release.src.rpm 
# rpm -Fhv /path/to/RPMS/cpu/iptables*-version-release.cpu.rpm 
# rpm -ihv /path/to/RPMS/cpu/iptables*-version-release.cpu.rpm 
# rpm -ihv --nodeps /path/to/RPMS/cpu/iptables*-version-release.cpu.rpm 
# ln -s /lib/iptables/ /usr/lib/iptables 
# modprobe ip6_tables 
# [ ! -f /proc/net/ip6_tables_names ] && echo "Current kernel doesn't support
¬ 'ip6tables' firewalling (IPv6)!" 
# ip6tables -L 
# ip6tables -n -v --line-numbers -L 
# ip6tables -n -v --line-numbers -L INPUT 
# ip6tables --table filter --append INPUT  -j LOG --log-prefix "INPUT:"
¬ --log-level 7 
# ip6tables --table filter --append INPUT  -j DROP 
# ip6tables --table filter --delete INPUT 1 
# ip6tables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
# ip6tables -A INPUT -i sit+ -p icmpv6 -j ACCEPT 
# ip6tables -A OUTPUT -o sit+ -p icmpv6 -j ACCEPT 
# ip6tables -A INPUT -p icmpv6 --icmpv6-type echo-request -j ACCEPT
# ip6tables -A INPUT --protocol icmpv6 --icmpv6-type echo-request
¬ -j ACCEPT --match limit --limit 30/minute
# ip6tables -A INPUT -i sit+ -p tcp -s 2001:0db8:100::1/128 --sport 512:65535
¬ --dport 22 -j ACCEPT 
# ip6tables -A OUTPUT -o sit+ -p tcp -d 2001:0db8:100::1/128 --dport 512:65535
¬ --sport 22 ! --syn -j ACCEPT 
# iptables -A INPUT -i ppp0 -p ipv6 -j ACCEPT 
# iptables -A OUTPUT -o ppp0 -p ipv6 -j ACCEPT 
# iptables -A INPUT -i ppp0 -p ipv6 -s 192.0.2.2 -j ACCEPT 
# iptables -A OUTPUT -o ppp0 -p ipv6 -d 192.0.2.2 -j ACCEPT 
# ip6tables -I INPUT -i sit+ -p tcp --syn -j DROP 
# ip6tables -I FORWARD -i sit+ -p tcp --syn -j DROP 
# ip6tables -I INPUT -i sit+ -p udp ! --dport 32768:60999 -j DROP 
# ip6tables -I FORWARD -i sit+ -p udp ! --dport 32768:60999 -j DROP 
Datei: /etc/sysconfig/ip6tables

*filter :INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:RH-Firewall-1-INPUT - [0:0]
-A INPUT -j RH-Firewall-1-INPUT
-A FORWARD -j RH-Firewall-1-INPUT
-A RH-Firewall-1-INPUT -i lo -j ACCEPT
-A RH-Firewall-1-INPUT -p icmpv6 -j ACCEPT
-A RH-Firewall-1-INPUT -p 50 -j ACCEPT
-A RH-Firewall-1-INPUT -p 51 -j ACCEPT
-A RH-Firewall-1-INPUT -p udp --dport 5353 -d ff02::fb -j ACCEPT
-A RH-Firewall-1-INPUT -p udp -m udp --dport 631 -j ACCEPT 
-A RH-Firewall-1-INPUT -p tcp -m tcp --dport 631 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -p tcp --dport 22 -j ACCEPT
-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp6-adm-prohibited
COMMIT 
Datei: /etc/sysconfig/iptables

*filter :INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:RH-Firewall-1-INPUT - [0:0]
-A INPUT -j RH-Firewall-1-INPUT
-A FORWARD -j RH-Firewall-1-INPUT
-A RH-Firewall-1-INPUT -i lo -j ACCEPT
-A RH-Firewall-1-INPUT -p icmp --icmp-type any -j ACCEPT
-A RH-Firewall-1-INPUT -p 50 -j ACCEPT
-A RH-Firewall-1-INPUT -p 51 -j ACCEPT
-A RH-Firewall-1-INPUT -p udp --dport 5353 -d 224.0.0.251 -j ACCEPT
-A RH-Firewall-1-INPUT -p udp -m udp --dport 631 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m tcp --dport 631 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited
COMMIT 
# service iptables start
# service ip6tables start
# chkconfig iptables on
# chkconfig ip6tables on
# ip6tables -n -v -L 
Chain INPUT (policy DROP 0 packets, 0 bytes) 
 pkts bytes target     prot opt in     out     source               destination
    0     0 extIN      all      sit+   *       ::/0                 ::/0 
    4   384 intIN      all      eth0   *       ::/0                 ::/0 
    0     0 ACCEPT     all      *      *       ::1/128              ::1/128 
    0     0 ACCEPT     all      lo     *       ::/0                 ::/0 
    0     0 LOG        all      *      *       ::/0                 ::/0       
¬        LOG flags 0 level 7 prefix `INPUT-default:' 
    0     0 DROP       all      *      *       ::/0                 ::/0 
 
Chain FORWARD (policy DROP 0 packets, 0 bytes) 
 pkts bytes target     prot opt in     out     source               destination
¬ 
    0     0 int2ext    all      eth0   sit+    ::/0                 ::/0 
    0     0 ext2int    all      sit+   eth0    ::/0                 ::/0 
    0     0 LOG        all      *      *       ::/0                 ::/0       
¬        LOG flags 0 level 7 prefix `FORWARD-default:' 
    0     0 DROP       all      *      *       ::/0                 ::/0 
 
Chain OUTPUT (policy DROP 0 packets, 0 bytes) 
 pkts bytes target     prot opt in     out     source               destination
¬ 
    0     0 extOUT     all      *      sit+    ::/0                 ::/0 
    4   384 intOUT     all      *      eth0    ::/0                 ::/0 
    0     0 ACCEPT     all      *      *       ::1/128              ::1/128 
    0     0 ACCEPT     all      *      lo      ::/0                 ::/0 
    0     0 LOG        all      *      *       ::/0                 ::/0       
¬        LOG flags 0 level 7 prefix `OUTPUT-default:' 
    0     0 DROP       all      *      *       ::/0                 ::/0 
 
Chain ext2int (1 references) 
 pkts bytes target     prot opt in     out     source               destination
¬ 
    0     0 ACCEPT     icmpv6    *      *       ::/0                 ::/0 
    0     0 ACCEPT     tcp      *      *       ::/0                 ::/0       
¬        tcp spts:1:65535 dpts:1024:65535 flags:!0x16/0x02 
    0     0 LOG        all      *      *       ::/0                 ::/0       
¬        LOG flags 0 level 7 prefix `ext2int-default:' 
    0     0 DROP       tcp      *      *       ::/0                 ::/0 
    0     0 DROP       udp      *      *       ::/0                 ::/0 
    0     0 DROP       all      *      *       ::/0                 ::/0 
 
Chain extIN (1 references) 
 pkts bytes target     prot opt in     out     source               destination
¬ 
    0     0 ACCEPT     tcp      *      *       3ffe:400:100::1/128  ::/0       
¬        tcp spts:512:65535 dpt:22 
    0     0 ACCEPT     tcp      *      *       3ffe:400:100::2/128  ::/0       
¬        tcp spts:512:65535 dpt:22 
    0     0 ACCEPT     icmpv6    *      *       ::/0                 ::/0 
    0     0 ACCEPT     tcp      *      *       ::/0                 ::/0       
¬        tcp spts:1:65535 dpts:1024:65535 flags:!0x16/0x02 
    0     0 ACCEPT     udp      *      *       ::/0                 ::/0       
¬        udp spts:1:65535 dpts:1024:65535 
    0     0 LOG        all      *      *       ::/0                 ::/0       
¬        limit: avg 5/min burst 5 LOG flags 0 level 7 prefix `extIN-default:' 
    0     0 DROP       all      *      *       ::/0                 ::/0 
 
Chain extOUT (1 references) 
 pkts bytes target     prot opt in     out     source               destination
¬ 
    0     0 ACCEPT     tcp      *      *       ::/0                
¬ 2001:0db8:100::1/128tcp spt:22 dpts:512:65535 flags:!0x16/0x02 
    0     0 ACCEPT     tcp      *      *       ::/0                
¬ 2001:0db8:100::2/128tcp spt:22 dpts:512:65535 flags:!0x16/0x02 
    0     0 ACCEPT     icmpv6    *      *       ::/0                 ::/0 
    0     0 ACCEPT     tcp      *      *       ::/0                 ::/0       
¬        tcp spts:1024:65535 dpts:1:65535 
    0     0 ACCEPT     udp      *      *       ::/0                 ::/0       
¬        udp spts:1024:65535 dpts:1:65535 
    0     0 LOG        all      *      *       ::/0                 ::/0       
¬        LOG flags 0 level 7 prefix `extOUT-default:' 
    0     0 DROP       all      *      *       ::/0                 ::/0 
 
Chain int2ext (1 references) 
 pkts bytes target     prot opt in     out     source               destination
¬ 
    0     0 ACCEPT     icmpv6    *      *       ::/0                 ::/0 
    0     0 ACCEPT     tcp      *      *       ::/0                 ::/0       
¬        tcp spts:1024:65535 dpts:1:65535 
    0     0 LOG        all      *      *       ::/0                 ::/0       
¬        LOG flags 0 level 7 prefix `int2ext:' 
    0     0 DROP       all      *      *       ::/0                 ::/0 
    0     0 LOG        all      *      *       ::/0                 ::/0       
¬        LOG flags 0 level 7 prefix `int2ext-default:' 
    0     0 DROP       tcp      *      *       ::/0                 ::/0 
    0     0 DROP       udp      *      *       ::/0                 ::/0 
    0     0 DROP       all      *      *       ::/0                 ::/0 
 
Chain intIN (1 references) 
 pkts bytes target     prot opt in     out     source               destination
¬ 
    0     0 ACCEPT     all      *      *       ::/0                
¬ fe80::/ffc0:: 
    4   384 ACCEPT     all      *      *       ::/0                 ff02::/16 
 
Chain intOUT (1 references) 
 pkts bytes target     prot opt in     out     source               destination
¬ 
    0     0 ACCEPT     all      *      *       ::/0                
¬ fe80::/ffc0:: 
    4   384 ACCEPT     all      *      *       ::/0                 ff02::/16 
    0     0 LOG        all      *      *       ::/0                 ::/0       
¬        LOG flags 0 level 7 prefix `intOUT-default:' 
    0     0 DROP       all      *      *       ::/0                 ::/0 
# ip6tables -t nat -A POSTROUTING -o sixxs -s fec0::/64 -j MASQUERADE
# ip6tables -t nat -A PREROUTING -d 2001:db8:0:1:5054:ff:fe01:2345 -i sixxs -j DNAT --to-destination fec0::5054:ff:fe01:2345
# ip6tables -t nat -A PREROUTING -i sixxs -p tcp --dport 8080 -j DNAT --to-destination [fec0::1234]:80
# modprobe nf_tables
# modprobe nf_tables_ipv4
# modprobe nf_tables_ipv6
# modprobe nf_tables_inet 
# iptables -F
# ip6tables -F
# nft add table inet filter 
# nft add chain inet filter input { type filter hook input priority 0 \; }
# nft add rule inet filter input ct state established,related counter accept 
# nft add rule inet filter input meta nfproto ipv4 icmp type { echo-request } counter accept
# nft add rule inet filter input meta nfproto ipv6 icmpv6 type echo-request counter accept 
# nft add rule inet filter input meta nfproto ipv6
¬  icmpv6 type { nd-neighbor-advert, nd-neighbor-solicit, nd-router-advert} ip6 hoplimit 1 accept
# nft add rule inet filter input meta nfproto ipv6
¬  icmpv6 type { nd-neighbor-advert, nd-neighbor-solicit, nd-router-advert} ip6 hoplimit 255 counter accept
# nft add rule inet filter input tcp dport 22 ct state new tcp flags \& \(syn \| ack\) == syn counter accept
# nft add rule inet filter input tcp dport 0-65535 reject
# nft add rule inet filter input udp dport 0-65535 counter drop
# nft add rule inet filter input counter drop
table inet filter {
	chain input {
		 type filter hook input priority 0;
		 ct state established,related counter packets 0 bytes 0 accept
		 ip protocol icmp icmp type { echo-request} counter packets 0 bytes 0 accept
		 ip6 nexthdr ipv6-icmp icmpv6 type echo-request counter packets 0 bytes 0 accept
		 ip6 nexthdr ipv6-icmp ip6 hoplimit 1 icmpv6 type { nd-neighbor-advert, nd-neighbor-solicit, nd-router-advert} accept
		 ip6 nexthdr ipv6-icmp ip6 hoplimit 255 icmpv6 type { nd-neighbor-advert, nd-neighbor-solicit, nd-router-advert} accept
		 tcp dport ssh ct state new tcp flags & (syn | ack) == syn counter packets 0 bytes 0 accept
		 tcp dport >= 0 tcp dport <= 65535 counter packets 0 bytes 0 reject
		 udp dport >= 0 udp dport <= 65535 counter packets 0 bytes 0 drop
		 log prefix counter packets 0 bytes 0 drop
	}
} 
# modprobe xt_LOG
#*.emerg    :omusrmsg:* 
# nft add rule inet filter input tcp dport 22 ct state new tcp flags \& \(syn \| ack\) == syn log prefix \"inet/input/accept: \" counter accept
# for table in ip ip6 inet; do nft list table $table filter; done
table ip filter {
	chain input {
		 type filter hook input priority 0;
		 ct state established,related counter packets 241 bytes 25193 accept
		 counter packets 2 bytes 120 mark 0x00000100 accept
		 icmp type { echo-request} counter packets 0 bytes 0 meta mark set 0x00000100 accept
	}
}
table ip6 filter {
	chain input {
		 type filter hook input priority 0;
		 ct state established,related counter packets 14 bytes 4077 accept
		 counter packets 4 bytes 408 mark 0x00000100 accept
		 icmpv6 type echo-request counter packets 1 bytes 104 meta mark set 0x00000100
		 icmpv6 type { nd-neighbor-advert, nd-neighbor-solicit, nd-router-advert} counter packets 2 bytes 224 meta mark set 0x00000100 accept
	}
}
table inet filter {
	chain input {
		 type filter hook input priority 0;
		 ct state established,related counter packets 307 bytes 31974 accept
		 counter packets 6 bytes 528 mark 0x00000100 accept
		 tcp dport ssh ct state new tcp flags & (syn | ack) == syn log prefix "inet/input/accept: " meta mark set 0x00000100 counter packets 3 bytes 200 accept
		 log prefix "inet/input/reject: " counter packets 0 bytes 0 reject
	}
}
# nc6 ::1 daytime
13 JUL 2002 11:22:22 CEST
# nmap -6 -sT ::1
Starting nmap V. 3.10ALPHA3 ( www.insecure.org/nmap/ ) 
Interesting ports on localhost6 (::1): 
(The 1600 ports scanned but not shown below are in state: closed) 
Port       State       Service 
22/tcp     open        ssh 
53/tcp     open        domain 
515/tcp    open        printer 
2401/tcp   open        cvspserver
Nmap run completed -- 1 IP address (1 host up) scanned in 0.525 seconds
# ./strobe ::1 strobe 1.05 (c) 1995-1999 Julian Assange <proff@iq.org>.
::1 2401 unassigned unknown
::1 22 ssh Secure Shell - RSA encrypted rsh 
::1 515 printer spooler (lpd)
::1 6010 unassigned unknown 
::1 53 domain Domain Name Server
#!/sbin/setkey -f
flush;
spdflush;
spdadd 2001:db8:1:1::1 2001:db8:2:2::2 any -P out ipsec esp/transport//require;
spdadd 2001:db8:2:2::2 2001:db8:1:1::1 any -P in  ipsec esp/transport//require;
#!/sbin/setkey -f
flush;
spdflush;
spdadd 2001:db8:1:1::1 2001:db8:2:2::2 any -P out ipsec
¬ esp/tunnel/2001:db8:1:1::1-2001:db8:2:2::2/require;
spdadd 2001:db8:2:2::2 2001:db8:1:1::1 any -P in  ipsec
¬ esp/tunnel/2001:db8:2:2::2-2001:db8:1:1::1/require;
# Racoon IKE daemon configuration file.
# See 'man racoon.conf' for a description of the format and entries.
path include "/etc/racoon";
path pre_shared_key "/etc/racoon/psk.txt";

listen
{
        isakmp 2001:db8:1:1::1;
}

remote 2001:db8:2:2::2
{
        exchange_mode main;
        lifetime time 24 hour;
        proposal
        {
                encryption_algorithm 3des;
                hash_algorithm md5;
                authentication_method pre_shared_key;
                dh_group 2;
        }
}

# gateway-to-gateway
sainfo address 2001:db8:1:1::1 any address 2001:db8:2:2::2 any
{
        lifetime time 1 hour;
        encryption_algorithm 3des;
        authentication_algorithm hmac_md5;
        compression_algorithm deflate;
}

sainfo address 2001:db8:2:2::2 any address 2001:db8:1:1::1 any
{
        lifetime time 1 hour;
        encryption_algorithm 3des;
        authentication_algorithm hmac_md5;
        compression_algorithm deflate;
} 
# file for pre-shared keys used for IKE authentication
# format is: 'identifier' 'key'

2001:db8:2:2::2 verysecret 
# racoon -F -v -f /etc/racoon/racoon.conf
Foreground mode. 
2005-01-01 20:30:15: INFO: @(#)ipsec-tools 0.3.3 (http://ipsec-tools.sourceforge.net)
2005-01-01 20:30:15: INFO: @(#)This product linked
¬ OpenSSL 0.9.7a Feb 19 2003 (http://www.openssl.org/)
2005-01-01 20:30:15: INFO: 2001:db8:1:1::1[500] used as isakmp port (fd=7)
2005-01-01 20:31:06: INFO: IPsec-SA request for 2001:db8:2:2::2
¬ queued due to no phase1 found.
2005-01-01 20:31:06: INFO: initiate new phase 1 negotiation:
¬ 2001:db8:1:1::1[500]<=>2001:db8:2:2::2[500]
2005-01-01 20:31:06: INFO: begin Identity Protection mode.
2005-01-01 20:31:09: INFO: ISAKMP-SA established
¬ 2001:db8:1:1::1[500]-2001:db8:2:2::2[500] spi:da3d3693289c9698:ac039a402b2db401
2005-01-01 20:31:09: INFO: initiate new phase 2 negotiation:
¬ 2001:6f8:900:94::2[0]<=>2001:db8:2:2::2[0]
2005-01-01 20:31:10: INFO: IPsec-SA established:
¬ ESP/Tunnel 2001:db8:2:2::2->2001:db8:1:1::1 spi=253935531(0xf22bfab) 
2005-01-01 20:31:10: INFO: IPsec-SA established:
¬ ESP/Tunnel 2001:db8:1:1::1->2001:db8:2:2::2 spi=175002564(0xa6e53c4) 
20:35:55.305707 2001:db8:1:1::1 > 2001:db8:2:2::2: ESP(spi=0x0a6e53c4,seq=0x3)
20:35:55.537522 2001:db8:2:2::2 > 2001:db8:1:1::1: ESP(spi=0x0f22bfab,seq=0x3)
# setkey -D
2001:db8:1:1::1 2001:db8:2:2::2
        esp mode=tunnel spi=175002564(0x0a6e53c4) reqid=0(0x00000000)
        E: 3des-cbc  bd26bc45 aea0d249 ef9c6b89 7056080f 5d9fa49c 924e2edd
        A: hmac-md5  60c2c505 517dd8b7 c9609128 a5efc2db
        seq=0x00000000 replay=4 flags=0x00000000 state=mature
        created: Jan  1 20:31:10 2005   current: Jan  1 20:40:47 2005
        diff: 577(s)    hard: 3600(s)   soft: 2880(s)
        last: Jan  1 20:35:05 2005      hard: 0(s)      soft: 0(s)
        current: 540(bytes)     hard: 0(bytes)  soft: 0(bytes)
        allocated: 3    hard: 0 soft: 0
        sadb_seq=1 pid=22358 refcnt=0
2001:db8:2:2::2 2001:db8:1:1::1
        esp mode=tunnel spi=253935531(0x0f22bfab) reqid=0(0x00000000)
        E: 3des-cbc  c1ddba65 83debd62 3f6683c1 20e747ac 933d203f 4777a7ce
        A: hmac-md5  3f957db9 9adddc8c 44e5739d 3f53ca0e
        seq=0x00000000 replay=4 flags=0x00000000 state=mature
        created: Jan  1 20:31:10 2005   current: Jan  1 20:40:47 2005
        diff: 577(s)    hard: 3600(s)   soft: 2880(s)
        last: Jan  1 20:35:05 2005      hard: 0(s)      soft: 0(s)
        current: 312(bytes)     hard: 0(bytes)  soft: 0(bytes)
        allocated: 3    hard: 0 soft: 0
        sadb_seq=0 pid=22358 refcnt=0 
# /etc/ipsec.conf - Openswan IPsec configuration file
#
# Manual:     ipsec.conf.5
version 2.0     # conforms to second version of ipsec.conf specification

# basic configuration
config setup
        # Debug-logging controls:  "none" for (almost) none, "all" for lots.
        # klipsdebug=none
        # plutodebug="control parsing"

#Disable Opportunistic Encryption
include /etc/ipsec.d/examples/no_oe.conf

conn ipv6-p1-p2
        connaddrfamily=ipv6       # Important for IPv6, but no longer needed since StrongSwan 4
        left=2001:db8:1:1::1
        right=2001:db8:2:2::2
        authby=secret
        esp=aes128-sha1
        ike=aes128-sha-modp1024
        type=transport
        #type=tunnel
        compress=no
        #compress=yes
        auto=add
        #auto=up
2001:db8:1:1::1 2001:db8:2:2::2 : PSK      "verysecret"
# /etc/rc.d/init.d/ipsec start
# ipsec auto --up ipv6-peer1-peer2
104 "ipv6-p1-p2" #1: STATE_MAIN_I1: initiate
106 "ipv6-p1-p2" #1: STATE_MAIN_I2: sent MI2, expecting MR2
108 "ipv6-p1-p2" #1: STATE_MAIN_I3: sent MI3, expecting MR3
004 "ipv6-p1-p2" #1: STATE_MAIN_I4: ISAKMP SA established
112 "ipv6-p1-p2" #2: STATE_QUICK_I1: initiate
004 "ipv6-p1-p2" #2: STATE_QUICK_I2: sent QI2,
¬ IPsec SA established {ESP=>0xa98b7710 <0xa51e1f22} 
# setkey -D
2001:db8:1:1::1 2001:db8:2:2::2
        esp mode=transport spi=2844489488(0xa98b7710) reqid=16385(0x00004001)
        E: aes-cbc  082ee274 2744bae5 7451da37 1162b483
        A: hmac-sha1  b7803753 757417da 477b1c1a 64070455 ab79082c
        seq=0x00000000 replay=64 flags=0x00000000 state=mature
        created: Jan  1 21:16:32 2005   current: Jan  1 21:22:20 2005
        diff: 348(s)    hard: 0(s)      soft: 0(s)
        last:                           hard: 0(s)      soft: 0(s)
        current: 0(bytes)       hard: 0(bytes)  soft: 0(bytes)
        allocated: 0    hard: 0 soft: 0
        sadb_seq=1 pid=23825 refcnt=0
2001:db8:2:2::2 2001:db8:1:1::1
        esp mode=transport spi=2770214690(0xa51e1f22) reqid=16385(0x00004001)
        E: aes-cbc  6f59cc30 8d856056 65e07b76 552cac18
        A: hmac-sha1  c7c7d82b abfca8b1 5440021f e0c3b335 975b508b
        seq=0x00000000 replay=64 flags=0x00000000 state=mature
        created: Jan  1 21:16:31 2005   current: Jan  1 21:22:20 2005
        diff: 349(s)    hard: 0(s)      soft: 0(s)
        last:                           hard: 0(s)      soft: 0(s)
        current: 0(bytes)       hard: 0(bytes)  soft: 0(bytes)
        allocated: 0    hard: 0 soft: 0
        sadb_seq=0 pid=23825 refcnt=0 
# ip xfrm policy
...

# ip xfrm state
...
------------------->-------
                Queue 1    \
                --->---     ---->--------->--------->-------------------
Dicke Leitung   Queue 2      Queue 1 / Queue 2 / Queue 3   Dünne Leitung
                --->----    ---->--------->--------->-------------------
                Queue 3    /
------------------->-------
# tc qdisc add dev eth1 root handle 1: cbq avpkt 1000 bandwidth 1000Mbit
# tc class add dev eth1 parent 1: classid 1:1 cbq rate   1Mbit allot 1500 bounded 
# tc class add dev eth1 parent 1: classid 1:2 cbq rate  50Mbit allot 1500 bounded
# tc class add dev eth1 parent 1: classid 1:3 cbq rate  10Mbit allot 1500 bounded
# tc class add dev eth1 parent 1: classid 1:4 cbq rate 200kbit allot 1500 bounded
# tc filter add dev eth1 parent 1: protocol ip   u32 match ip  protocol 6 0xff match ip dport 5001 0xffff flowid 1:1
# tc filter add dev eth1 parent 1: protocol ipv6 u32 match ip6 protocol 6 0xff match ip6 dport 5001 0xffff flowid 1:2
# tc filter add dev eth1 parent 1: protocol ipv6 u32 match ip6 flowlabel 12345 0x3ffff flowid 1:3 
# tc filter add dev eth1 parent 1: protocol ipv6 handle 32 fw flowid 1:4
# ip6tables -A POSTROUTING -t mangle -p tcp --dport 5003 -j MARK --set-mark 32 
# iperf -V -s -p 5001
# iperf -V -s -p 5002
# iperf -V -s -p 5003
# iperf -V -c SERVER-IPv4 -p 5001    (erwartet:      1 MBit/s)
# iperf -V -c SERVER-IPv6 -p 5001    (erwartet:     50 MBit/s)
# iperf -V -c SERVER-IPv4 -p 5002    (erwartet:  >> 50 MBit/s && <= 1000 MBit/s)
# iperf -V -c SERVER-IPv6 -p 5002    (erwartet:  >> 50 MBit/s && <= 1000 MBit/s)
# iperf -V -c SERVER-IPv4 -p 5003    (erwartet:  >> 50 MBit/s && <= 1000 MBit/s)
# iperf -V -c SERVER-IPv6 -p 5003    (erwartet:    200 kBit/s)
options {
        # sure other options here, too
        listen-on-v6 { any; };
};
# netstat -lnptu |grep "named\W*$" 
tcp 0 0 :::53         :::*      LISTEN 1234/named
¬ # incoming TCP requests
udp 0 0 1.2.3.4:53    0.0.0.0:*        1234/named
¬ # incoming UDP requests to IPv4 1.2.3.4
udp 0 0 127.0.0.1:53  0.0.0.0:*        1234/named
¬ # incoming UDP requests to IPv4 localhost
udp 0 0 0.0.0.0:32868 0.0.0.0:*        1234/named
¬ # dynamic chosen port for outgoing queries
udp 0 0 :::53         :::*             1234/named
¬ # incoming UDP request to any IPv6
# dig localhost @::1
options {
        # sure other options here, too
        listen-on-v6 { none; };
};
acl internal-net { 
        127.0.0.1; 
        1.2.3.0/24;  
        2001:0db8:100::/56; 
        ::1/128; 
        ::ffff:1.2.3.4/128; 
};
acl ns-internal-net { 
        1.2.3.4;  
        1.2.3.5;  
        2001:0db8:100::4/128; 
        2001:0db8:100::5/128; 
};
options {
        # sure other options here, too
        listen-on-v6 { none; };
        allow-query { internal-net; }; 
        allow-transfer { ns-internal-net; }; 
};
query-source-v6 address <ipv6address|*> port <port|*>;
transfer-source-v6 <ipv6addr|*> [port port];
notify-source-v6 <ipv6addr|*> [port port];
$ host -t aaaa www.6bone.net 2001:0db8:200:f101::1 
Using domain server: 
Name: 2001:0db8:200:f101::1 
Address: 2001:0db8:200:f101::1#53 
Aliases:

Host www.6bone.net. not found: 5(REFUSED)
Jan 3 12:43:32 gate named[12347]: client
¬ 2001:0db8:200:f101:212:34ff:fe12:3456#32770: 
 query denied
$ host -t aaaa www.6bone.net 2001:0db8:200:f101::1 
Using domain server: 
Name: 2001:0db8:200:f101::1 
Address: 2001:0db8:200:f101::1#53 
Aliases:

www.6bone.net. is an alias for 6bone.net. 
6bone.net. has AAAA address 3ffe:b00:c18:1::10
# diff -u /etc/xinetd.d/daytime.orig /etc/xinetd.d/daytime 
--- /etc/xinetd.d/daytime.orig Sun Dec 16 19:00:14 2001 
+++ /etc/xinetd.d/daytime Sun Dec 16 19:00:22 2001 
@@ -10,5 +10,5 @@ 
        protocol = tcp 
        user = root 
        wait = no 
-       disable = yes 
+       disable = no 
 }
# netstat -lnptu -A inet6 |grep "xinetd*" 
tcp 0 0 ::ffff:192.168.1.1:993  :::*  LISTEN  12345/xinetd-ipv6 
tcp 0 0 :::13                   :::*  LISTEN  12345/xinetd-ipv6 <- service
¬ daytime/tcp
tcp 0 0 ::ffff:192.168.1.1:143  :::*  LISTEN  12345/xinetd-ipv6
Listen [2001:0db8:100::1]:80
<VirtualHost [2001:0db8:100::1]:80>
        ServerName ipv6only.yourdomain.yourtopleveldomain
        # ...sure more config lines
</VirtualHost>
Listen [2001:0db8:100::2]:80 
Listen 1.2.3.4:80
<VirtualHost [2001:0db8:100::2]:80 1.2.3.4:80>
        ServerName ipv6andipv4.yourdomain.yourtopleveldomain
        # ...sure more config lines
</VirtualHost>
# netstat -lnptu |grep "httpd2\W*$" 
tcp 0 0 1.2.3.4:80          0.0.0.0:* LISTEN 12345/httpd2 
tcp 0 0 2001:0db8:100::1:80 :::*      LISTEN 12345/httpd2 
tcp 0 0 2001:0db8:100::2:80 :::*      LISTEN 12345/httpd2
interface eth0 { 
        AdvSendAdvert on;
        MinRtrAdvInterval 3; 
        MaxRtrAdvInterval 10;
        prefix 2001:0db8:0100:f101::/64 { 
                AdvOnLink on; 
                AdvAutonomous on; 
                AdvRouterAddr on; 
        };
};
# ip -6 addr show eth0 
3: eth0: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 100 
    inet6 2001:0db8:100:f101:2e0:12ff:fe34:1234/64 scope global dynamic 
       valid_lft 2591992sec preferred_lft 604792sec 
    inet6 fe80::2e0:12ff:fe34:1234/10 scope link
interface eth0 { 
        AdvSendAdvert on;
        MinRtrAdvInterval 3; 
        MaxRtrAdvInterval 10;
        prefix 0:0:0:f101::/64 { 
                AdvOnLink off; 
                AdvAutonomous on; 
                AdvRouterAddr on; 
                Base6to4Interface ppp0;
                AdvPreferredLifetime 20; 
                AdvValidLifetime 30;
        };
};
# /sbin/ip -6 addr show eth0
3: eth0: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 100 
   inet6 2002:0102:0304:f101:2e0:12ff:fe34:1234/64 scope global dynamic 
      valid_lft 22sec preferred_lft 12sec
   inet6 fe80::2e0:12ff:fe34:1234/10 scope link
# /sbin/ip -6 route add 2002:0102:0304:f101::/64 dev eth0 metric 1
# radvdump 
Router advertisement from fe80::280:c8ff:feb9:cef9 (hoplimit 255) 
        AdvCurHopLimit: 64 
        AdvManagedFlag: off 
        AdvOtherConfigFlag: off 
        AdvHomeAgentFlag: off 
        AdvReachableTime: 0 
        AdvRetransTimer: 0 
        Prefix 2002:0102:0304:f101::/64 
                AdvValidLifetime: 30 
                AdvPreferredLifetime: 20 
                AdvOnLink: off 
                AdvAutonomous: on 
                AdvRouterAddr: on 
        Prefix 2001:0db8:100:f101::/64 
                AdvValidLifetime: 2592000 
                AdvPreferredLifetime: 604800 
                AdvOnLink: on 
                AdvAutonomous: on 
                AdvRouterAddr: on 
        AdvSourceLLAddress: 00 80 12 34 56 78
interface eth0 {
        server-preference 255;
        renew-time 60;
        rebind-time 90;
        prefer-life-time 130;
        valid-life-time 200;
        allow rapid-commit;
        option dns_servers 2001:db8:0:f101::1 sub.domain.example;
        link AAA {
                range 2001:db8:0:f101::1000 to 2001:db8:0:f101::ffff/64;
                prefix 2001:db8:0:f101::/64;
        };
};
interface eth0 {
        send rapid-commit;
        request domain-name-servers;
}; 
# service dhcp6s start
# dhcp6c -f eth0
...
# dhcp6c -d -D -f eth0
# ping6 -I eth0 ff02::1:2
# dhcp6c -d -f eth0
Oct/03/2005 17:18:16 dhcpv6 doesn't support hardware type 776 
Oct/03/2005 17:18:16 doesn't support sit0 address family 0 
Oct/03/2005 17:18:16 netlink_recv_rtgenmsg error 
Oct/03/2005 17:18:16 netlink_recv_rtgenmsg error 
Oct/03/2005 17:18:17 status code for this address is: success 
Oct/03/2005 17:18:17 status code: success 
Oct/03/2005 17:18:17 netlink_recv_rtgenmsg error 
Oct/03/2005 17:18:17 netlink_recv_rtgenmsg error 
Oct/03/2005 17:18:17 assigned address 2001:db8:0:f101::1002 prefix len is not in any RAs prefix length using 64 bit instead 
Oct/03/2005 17:18:17 renew time 60, rebind time 9
default-lease-time 600;
max-lease-time 7200; 
log-facility local7; 
subnet6 2001:db8:0:1::/64 {
        # Range for clients
        range6 2001:db8:0:1::129 2001:db8:0:1::254;

        # Range for clients requesting a temporary address
        range6 2001:db8:0:1::/64 temporary;

        # Additional options
        option dhcp6.name-servers fec0:0:0:1::1;
        option dhcp6.domain-search "domain.example";

        # Prefix range for delegation to sub-routers
        prefix6 2001:db8:0:100:: 2001:db8:0:f00:: /56;

        # Example for a fixed host address
        host specialclient {
    		host-identifier option dhcp6.client-id 00:01:00:01:4a:1f:ba:e3:60:b9:1f:01:23:45;
        	fixed-address6 2001:db8:0:1::127;
    	} 
} 
# hexdump -e '"%07.7_ax " 1/2 "%04x" " " 14/1 "%02x:" "\n"' /var/lib/dhcpv6/dhcp6c_duid 0000000 000e 00:01:00:01:4a:1f:ba:e3:60:b9:1f:01:23:45:
# /usr/sbin/dhcpd -6 -d -cf /etc/dhcp/dhcpd6.conf eth1 
Internet Systems Consortium DHCP Server 4.1.0 
Copyright 2004-2008 Internet Systems Consortium. 
All rights reserved. 
For info, please visit http://www.isc.org/sw/dhcp/ 
Not searching LDAP since ldap-server, ldap-port and ldap-base-dn were not specified in the config file 
Wrote 0 leases to leases file. 
Bound to *:547 
Listening on Socket/5/eth1/2001:db8:0:1::/64 
Sending on   Socket/5/eth1/2001:db8:0:1::/64
log-level 8 
log-mode short 
preference 0 
iface "eth1" {
  prefered-lifetime 3600
  valid-lifetime 7200
  class {
    pool 2001:db8:0:1::/64
  }
  option dns-server fec0:0:0:1::1
  option domain domain.example
} 
# dibbler-server run 
| Dibbler - a portable DHCPv6, version 0.7.3 (SERVER, Linux port) 
| Authors : Tomasz Mrugalski<thomson(at)klub.com.pl>,Marek Senderski<msend(at)o2.pl> 
| Licence : GNU GPL v2 only. Developed at Gdansk University of Technology. 
| Homepage: http://klub.com.pl/dhcpv6/ 
2009.05.28 10:18:48 Server Notice    My pid (1789) is stored in /var/lib/dibbler/server.pid 
2009.05.28 10:18:48 Server Notice    Detected iface eth0/3, MAC=54:52:00:01:23:45. 
2009.05.28 10:18:48 Server Notice    Detected iface eth1/2, MAC=54:52:00:67:89:ab. 
2009.05.28 10:18:48 Server Notice    Detected iface lo/1, MAC=00:00:00:00:00:00. 
2009.05.28 10:18:48 Server Debug     Skipping database loading. 
2009.05.28 10:18:48 Server Debug     Cache:server-cache.xml file: parsing started, expecting 0 entries. 
2009.05.28 10:18:48 Server Notice    Parsing /etc/dibbler/server.conf config file... 
18:48 Server Debug     Setting 0 generic option(s). 
18:48 Server Debug     0 per-client configurations (exceptions) added. 
18:48 Server Debug     Parsing /etc/dibbler/server.conf done. 
18:48 Server Info      0 client class(es) defined. 
18:48 Server Debug     1 interface(s) specified in /etc/dibbler/server.conf 
18:48 Server Info      Mapping allow, deny list to class 0:0 allow/deny entries in total. 
18:48 Server Info      Interface eth1/2 configuration has been loaded. 
18:48 Server Notice    Running in stateful mode. 
18:48 Server Info      My DUID is 00:01:00:01:11:aa:6d:a7:54:52:00:67:89:ab. 
18:48 Server Notice    Creating multicast (ff02::1:2) socket on eth1/2 (eth1/2) interface. 
18:48 Server Debug     Cache: size set to 1048576 bytes, 1 cache entry size is 87 bytes, so maximum 12052 address-client pair(s) may be cached. 
18:48 Server Notice    Accepting connections. Next event in 4294967295 second(s).
$ man hosts.allow
sshd:           1.2.3. [2001:0db8:100:200::]/64
daytime-stream: 1.2.3. [2001:0db8:100:200::]/64
ALL: ALL
ALL: ALL: spawn (echo "Attempt from %h %a to %d at `date`" 
 | tee -a /var/log/tcp.deny.log | mail root@localhost)
Jan 2 20:40:44 gate xinetd-ipv6[12346]: FAIL: daytime-stream libwrap
¬ from=::ffff:1.2.3.4
Jan 2 20:32:06 gate xinetd-ipv6[12346]: FAIL: daytime-stream libwrap 
 from=2001:0db8:100:200::212:34ff:fe12:3456
Jan 2 20:24:17 gate sshd[12345]: refused connect from ::ffff:1.2.3.4
¬ (::ffff:1.2.3.4)
Jan 2 20:39:33 gate sshd[12345]: refused connect 
 from 2001:0db8:100:200::212:34ff:fe12:3456
¬ (2001:0db8:100:200::212:34ff:fe12:3456)
Jan 2 20:37:50 gate xinetd-ipv6[12346]: START: daytime-stream pid=0
¬ from=::ffff:1.2.3.4 
Jan 2 20:37:56 gate xinetd-ipv6[12346]: START: daytime-stream pid=0 
 from=2001:0db8:100:200::212:34ff:fe12:3456
Jan 2 20:43:10 gate sshd[21975]: Accepted password for user from ::ffff:1.2.3.4
¬ port 33381 ssh2
Jan 2 20:42:19 gate sshd[12345]: Accepted password for user 
 from 2001:0db8:100:200::212:34ff:fe12:3456 port 33380 ssh2
listen_ipv6=yes
<VirtualHost 192.0.2.1>
        ...
        Bind 2001:0DB8::1
        ...
</VirtualHost>

Versionsgeschichte
Version 0.67.de.1wip	2020-04-04	Geändert durch: PB

Version 0.66.de.1	2014-05-15	Geändert durch: PB

Version 0.65.de.1	2009-12-13	Geändert durch: PB

Version 0.64.de.1	2009-06-11	Geändert durch: PB

Version 0.61.de.1	2007-10-06	Geändert durch: PB

Schwerpunkt	Request e-mail Adresse	Abonnieren	e-mail Adresse der Mailingliste	Sprache	Zugang via WWW
Linux Kernel Networking inkl. IPv6	majordomo (at) vger.kernel.org	netdev	netdev (at) vger.kernel.org	Englisch	Info, Archive
Mobile IP(v6) für Linux	Web-based, see URL	mipl	mipl (at) mobile-ipv6.org	Englisch	Info, Archive
Linux IPv6 User & USAGI	usagi-users-ctl (at) linux-ipv6.org		usagi-users (at) linux-ipv6.org	Englisch	Info / Search, Archive
IPv6 und Debian Linux	Web-based, siehe URL		debian-ipv6 (at) lists.debian.org	Englisch	Info/Subscription/Archive
6bone	majordomo (at) isi.edu	6bone	6bone (at) isi.edu	Englisch	Info, Archive
IPv6 User allgemein	majordomo (at) ipv6.org	users	users (at) ipv6.org	Englisch	Info, Archive
Bugtracking Internet Programme (1)	bugtraq-subscribe (at) securityfocus.com		bugtraq (at) securityfocus.com (3)	Englisch	Info, Archive

Peter Bieringer

Kapitel 1. Allgemein

Kapitel 2. Grundlagen

Kapitel 3. Adress-Typen

Kapitel 4. IPv6 System-Check

Kapitel 5. Interface-Konfiguration

Kapitel 6. IPv6 Adressen konfigurieren