Firewall – Provide IPv6 to network from OpenBSD firewall

firewallipv6openbsdpf

I have an OpenBSD PF firewall that I have added a IPv6 tunnel to (using HE.net tunnelbroker).

I can ping/traceroute IPv6 addresses from the firewall. Now I want to provide IPv6 services to the servers behind my firewall. They all have public IP addresses (I'm not using any sort of NAT). So I want to be able to give them IPv6 addresses on the routed IPv6 prefix given by the Tunnel and have traffic properly routed through the tunnel (gif0 interface) on OpenBSD.

Some other details. This is basically a transparent firewall, though the external interface does have an IP address for administration. Would I need to add an IPv6 address to the internal interface as well to provide routing or could I just transparently route everything through the tunnel interface? What would PF rules look like for IPv6 traffic and how would they differ from normal IPv4 PF rules?

I've found this page, but it is so old (for OpenBSD 2.9, almost 10 years old). I'm looking for updated instructions that would fit my situation.

Edit: Along with the below accepted answer I needed to add the following PF rule to get incoming traffic to work:

tunnelserveripv4address="xx.xx.xx.xx" # This is the IPv4 HE.net tunnel endpoint
ext_if="em0"
pass in proto 41 from $tunnelserveripv4address to $ext_if keep state
pass out proto 41 from $ext_if to $tunnelserveripv4address keep state

Best Answer

First, you should configure the LAN NIC to an address from the routed(!) /64; the ::1 is an ideal candidate. Then, fire up radvd on the LAN interface---it should not need any configuration.

PF doesn't play any role in it, or rather, make sure that it doesn't get in the way.

Related Solutions

Cisco ASA and static IPv6 tunnel endpoint

I had the same problem, and I've worked it out. Your question helped me greatly, actually. The loopback tunnelling was the trick.

There were significant ASA OS changes, especially with respect to NAT, in the 8.3 release. That's what I'm running, so it's likely the syntax will not work prior to 8.3. I don't know if you could even do this prior to 8.3.

Here's how it's set up. I'll include some configuration snippets below to back this up.

As you, I have an ASA between my edge router and my internal network. I only have one publicly-addressable IPv4 address. I was able to NAT protocol 41 traffic between a specific external host and a specific internal host using the ASA's outside public IP address. The tunnel is terminated on an internal host.

The internal host has two ethernet interfaces. One, connected to the internal network, only runs IPv4. The other, connected to the same segment as the outside interface of the ASA, only runs IPv6. There is also a tunnel interface for the IPv6 tunnel. The configuration of the tunnel came directly from Hurricane Electric's web site. If you have a tunnel configured with them, they can show you detailed configuration instructions for at least 8 different operating systems.

The ASA uses the edge router's IPv4 address as it's default IPv4 route. It uses the IPv6 address of the tunnel endpoint as it's default IPv6 address. Internal hosts use the ASA as their default route for either version, except the tunnel endpoint, which uses its tunnel interface as the default for IPv6.

IPv6 packets go through the ASA twice in each direction. Out, they go through the ASA, to the tunnel endpoint where they are put into the tunnel, and out again through the ASA. Both IPv4 and IPv6 get all of the benefits of the ASA firewall.

The real trick was getting the protocol 41 traffic through the ASA. Here are the pieces that made that work:

object service 6in4
 service 41
object network ipv6_remote_endpoint
 host x.x.x.x
object network ipv6_local_endpoint
 host y.y.y.y

access-list outside_in extended permit object 6in4 object ipv6_remote_endpoint object ipv6_local_endpoint

nat (inside,outside) source static ipv6_local_endpoint interface destination static ipv6_remote_endpoint ipv6_remote_endpoint

Good luck with it!

Rob

OpenBSD pf – implementing the equivalent of an iptables DNAT

I'm not totally sure if that's what you want but I use something likt this to redirect traffic to another IP.

rdr pass on $ext_if proto icmp from any to $OLD_IP -> $NEW_IP

The syntax is not tested but might work

Something similar works on FreeBSD

Edit

After a look into the OpenBSD manpages this syntax might work:

pass in on $ext_if proto icmp from any to $OLD_IP rdr-to $NEW_IP

Best Answer

Related Solutions

Cisco ASA and static IPv6 tunnel endpoint

OpenBSD pf – implementing the equivalent of an iptables DNAT

Related Topic