Dom0 enable IPv6 for guests

dom0domuipv6xen

I am looking at deploying IPv6 to my virtual machines. Right now I have v6 working great on the dom0 using a 6in4 provided by Hurricane Electric as I do not have native v6.

However, I would like to distribute some of the /48 I am receiving to the domUs (/64 per machine would be ideal, but I am open to your suggestions). Static configuration on the domU side is fine.

All I want to accomplish is getting the traffic to pass through the dom0 to the domU. To say the least, I'm still trying to wrap my head around all the virtual interfaces and bridges Xen creates.

Yes, I have Googled around for this a bit and have not found anything great. I tried using two "vif-route6" bash scripts with no luck (possibly due to my ignorance with Xen networking).

I am still stuck (mainly in how to configure the dom0). I would like to imagine this problem is relatively easy to solve and I look forward to your suggestions and help!

Edited post to clarify my end goal: getting IPv6 to domU guests. I am completely open to suggestions but am hoping for something other than setting up a tunnel for every guest.

Best Answer

Instead of being a bastard in comments, my suggestion is that you get a firewall that supports ipv6. If a hardware appliance doesn't fit then install it as a guest (domU), and use it to route traffic. That way you can at least protect the dom0 from being visible at all against the internet.

pfsense could probably fit fine.

Related Solutions

Ssh to dom0 and domU at the same time drops connection from dom0

Based on the information you've provided so far I would suggest that problem is with the MAC address duplication and the disconnections may be from the switch you're ethernet port is going through.

That said there will be some MAC address duplication. I just checked on one of my Xen servers that I have been working on and I get the following when I run ifconfig | grep HWaddr

eth0      Link encap:Ethernet  HWaddr 00:E0:81:2D:66:AC  
eth1      Link encap:Ethernet  HWaddr 00:E0:81:2D:66:AD  
peth0     Link encap:Ethernet  HWaddr FE:FF:FF:FF:FF:FF  
peth1     Link encap:Ethernet  HWaddr FE:FF:FF:FF:FF:FF  
vif0.0    Link encap:Ethernet  HWaddr FE:FF:FF:FF:FF:FF  
vif0.1    Link encap:Ethernet  HWaddr FE:FF:FF:FF:FF:FF  
vif31.0   Link encap:Ethernet  HWaddr FE:FF:FF:FF:FF:FF  
vif31.1   Link encap:Ethernet  HWaddr FE:FF:FF:FF:FF:FF  
virbr0    Link encap:Ethernet  HWaddr 00:00:00:00:00:00  
xenbr0    Link encap:Ethernet  HWaddr FE:FF:FF:FF:FF:FF  
xenbr1    Link encap:Ethernet  HWaddr FE:FF:FF:FF:FF:FF

This is on a RHEL5 Xen 3.0.3 server so I am assuming the interface differences are based on changes between 3.0.3 and 3.1.2. That aside you can see that both my eth0 and eth1 interfaces are different MAC addresses whereas yours are both identical. the pethX and vifX.X entries are all virtual interfaces for Xen so the MAC address FE:FF:FF:FF:FF:FF is perfectly fine.

The xenbr0 is the bridge that eth0 is attached to and xenbr1 is the bridge for eth1 and use the same MAC address. The virbr0 interface is the bridge for the internal virtual network and has the 00:00:00:00:00:00 MAC because of having spanning tree protocol enabled. You can confirm the bridging on your system by running brctl show which should give you something like:

bridge name bridge id       STP enabled interfaces
virbr0      8000.000000000000   yes     
xenbr0      8000.feffffffffff   no  vif31.0
                            peth0
                            vif0.0
xenbr1      8000.feffffffffff   no  vif31.1
                            peth1
                            vif0.1

Xen DomU – Xen DomU Root Filesystems Becoming Read-Only on iSCSI Virtual IP Failover

I eventually solved this by using the following advice and settings from the open-iscsi documentation:

8.2 iSCSI settings for iSCSI root
---------------------------------

When accessing the root parition directly through a iSCSI disk, the
iSCSI timers should be set so that iSCSI layer has several chances to try to
re-establish a session and so that commands are not quickly requeued to
the SCSI layer. Basically you want the opposite of when using dm-multipath.

For this setup, you can turn off iSCSI pings by setting:

node.conn[0].timeo.noop_out_interval = 0
node.conn[0].timeo.noop_out_timeout = 0

And you can turn the replacement_timer to a very long value:

node.session.timeo.replacement_timeout = 86400

After setting up the connection to each LUN as described above, the failover works like a charm, even if it takes several minutes to happen.

Related Topic