ayiya tunnel not recovering from IPv4 outage
Shadow Hawkins on Thursday, 03 July 2014 16:09:43
Hi
I have an ayiya tunnel on a Raspberry Pi running FreeBSD 10.0-RELEASE.
The Pi is behind a NAT ADSL router which is not 100% stable. The ADSL router seems to need rebooting every month or so.
When the router is rebooted the ayiya tunnel fails, but once IPv4 connectivity comes back the ayiya tunnel doesn't seem to recover. Or maybe I'm not waiting long enough?
doing
service sixxs-aiccu restart
didn't work
I seem to have to do
service sixxs-aiccu stop
then
service sixxs-aiccu start
as separate commmands
this is the software that is installed on the Pi
# pkg info
bash-4.3.11_2 The GNU Project's Bourne Again SHell
bison-2.7.1,1 Parser generator from FSF, (mostly) compatible with Yacc
ca_root_nss-3.16 The root certificate bundle from the Mozilla Project
dialog4ports-0.1.5_2 Console Interface to configure ports
gettext-0.18.3.1_1 GNU gettext package
gmake-3.82_1 GNU version of 'make' utility
gmp-5.1.3_2 Free library for arbitrary precision arithmetic
gnutls-2.12.23_5 GNU Transport Layer Security library
libffi-3.0.13_1 Foreign Function Interface
libgpg-error-1.13 Common error values for all GnuPG components
libtasn1-3.3 ASN.1 structure parser library
libtool-2.4.2_3 Generic shared library support script
m4-1.4.17_1,1 GNU m4
nettle-2.7.1 Low-level cryptographic library
p11-kit-0.20.2_1 Library for loading and enumerating of PKCS#11 modules
perl5-5.16.3_9 Practical Extraction and Report Language
pkg-1.2.7_2 Package manager
pkgconf-0.9.5 Utility to help to configure compiler and linker flags
sixxs-aiccu-20070115_3 SixXS IPv6 TIC+ tunnel broker heartbeat client
srm-1.2.12 Secure rm, a utility which destroys file contents before unlinking
this is my rc.conf
# less rc.conf
hostname="raspberry-pi"
ifconfig_ue0="DHCP"
sshd_enable="YES"
# Turn off a lot of standard stuff
# for more free memory.
cron_enable="NO"
#devd is necessary for proper DHCP operation;
# don't disable unless you know how to run DHCP manually.
#devd_enable="NO"
sendmail_submit_enable="NO"
sendmail_outbound_enable="NO"
sendmail_msp_queue_enable="NO"
# On first boot, enlarge the root filesystem to fill the SD card
autosize_enable="YES"
syslogd_enable="YES"
syslogd_flags="-s -v -v"
ntpdate_enable="YES"
ntpdate_hosts="pool.ntp.org"
ntpdate_flags="-b pool.ntp.org"
ntpd_enable="YES"
sixxs_aiccu_enable="YES"
ipv6_gateway_enable="YES"
ipv6_interfaces="auto"
ipv6_activate_all_interfaces="YES"
ipv6_cpe_wanif="tun0"
ifconfig_ue0_ipv6="inet6 2a01:xxx:y:zzzz::1 prefixlen 64"
cloned_interfaces="tun0"
rtadvd_enable="YES"
rtadvd_interfaces="ue0"
this is my aiccu.conf
# cat aiccu.conf
# AICCU Configuration
# Login information (defaults: none)
username username
password password
# Protocol and server to use for setting up the tunnel (defaults: none)
protocol tic
server tic.sixxs.net
# Interface names to use (default: aiccu)
# ipv6_interface is the name of the interface that will be used as a tunnel interface.
# On *BSD the ipv6_interface should be set to gifX (eg gif0) for proto-41 tunnels
# or tunX (eg tun0) for AYIYA tunnels.
ipv6_interface tun0
# The tunnel_id to use (default: none)
# (only required when there are multiple tunnels in the list)
tunnel_id T123456
# Be verbose? (default: false)
verbose true
# Daemonize? (default: true)
# Set to false if you want to see any output
# When true output goes to syslog
#
# WARNING: never run AICCU from DaemonTools or a similar automated
# 'restart' tool/script. When AICCU does not start, it has a reason
# not to start which it gives on either the stdout or in the (sys)log
# file. The TIC server *will* automatically disable accounts which
# are detected to run in this mode.
#
daemonize true
#daemonize false
# Automatic Login and Tunnel activation?
automatic true
# Require TLS?
# When set to true, if TLS is not supported on the server
# the TIC transaction will fail.
# When set to false, it will try a starttls, when that is
# not supported it will continue.
# In any case if AICCU is build with TLS support it will
# try to do a 'starttls' to the TIC server to see if that
# is supported.
requiretls false
# PID File
pidfile /var/run/aiccu.pid
# Add a default route (default: true)
defaultroute true
# Script to run after setting up the interfaces (default: none)
#setupscript /usr/local/etc/aiccu-subnets.sh
# Make heartbeats (default true)
# In general you don't want to turn this off
# Of course only applies to AYIYA and heartbeat tunnels not to static ones
#makebeats true
# Don't configure anything (default: false)
#noconfigure true
# Behind NAT (default: false)
# Notify the user that a NAT-kind network is detected
#behindnat true
# Local IPv4 Override (default: none)
# Overrides the IPv4 parameter received from TIC
# This allows one to configure a NAT into "DMZ" mode and then
# forwarding the proto-41 packets to an internal host.
#
# This is only needed for static proto-41 tunnels!
# AYIYA and heartbeat tunnels don't require this.
#local_ipv4_override
thanks
ayiya tunnel not recovering from IPv4 outage
Jeroen Massar on Thursday, 03 July 2014 16:23:06 The Pi is behind a NAT ADSL router which is not 100% stable. The ADSL router seems to need rebooting > every month or so.
Can you define "not 100% stable"? What happens? What model/version modem is it?
When the router is rebooted the ayiya tunnel fails, but once IPv4 connectivity comes back the ayiya tunnel doesn't seem to recover.
What do you mean with "fail"? What happens, any technical details?
Or maybe I'm not waiting long enough?
AYIYA causes endpoint updates with every packet sent next to a regular heartbeat. Hence when a packet is able to pass outbound an inbound packet is able to follow again too (which is also a requirement for most NAT state or even firewalls to pass packets from the Internet, eg the PoP, back to AICCU).
this is the software that is installed on the Pi sixxs-aiccu-20070115_3 SixXS IPv6 TIC+ tunnel broker heartbeat client
Distributions tend to apply patches, you'll have to check what those patches are.
this is my rc.conf
Configuration instructions can mismatch with what is actually running, hence check that everything is actually set up correctly.
Posting is only allowed when you are logged in. |