Forum - ICMP blocked - Unable to get tunnel working :: SixXS

ICMP blocked - Unable to get tunnel working

Shadow Hawkins on Tuesday, 25 October 2011 17:59:35

Hi Everyone, I'm behind a static IPv4 address provided by my university network. Administrator has blocked ICMP for fear of DoS attacks, thus no pinging available and no way to change firewall settings. To my understanding pinging is required in order for Sixxs to check tunnel availability. Is there any way to set up a tunnel under this situation? My tunnel is T79142. Thnks in advance, Marios

ICMP blocked - Unable to get tunnel working

Jeroen Massar SixXS Staff

on Tuesday, 25 October 2011 18:25:26

Administrator has blocked ICMP

If your network policy does not allow certain services, then you should not be bypassing them. Likely if they block ICMP, they also don't want you to run a tunnel. And especially if they filter that kind of stuff, they likely don't want you to get a public IP address which is not filtered under their control. Thus ask your network administration about this first. It is their network, not yours.

To my understanding pinging is required in order for Sixxs to check tunnel availability.

Those checks are performed on IPv6, see the FAQ.

Is there any way to set up a tunnel under this situation?

If policy does not allow it, no. And we are not helping one evade such a policy either.

ICMP blocked - Unable to get tunnel working

Shadow Hawkins on Wednesday, 26 October 2011 14:51:13

Hi again, I agree with you Jeroen, and either way, it was not in my intention to evade any policy of my university. However, I would like to know if there is a way to operate my tunnel without ICMP. (I have already contacted my admin and they won't allow any incoming, neither outgoing ping requests) I have run #aiccu autotest and I post the two checks that fail in case I haven't identified the problem correctly: ####### [2/8] Ping the IPv4 Remote/PoP Outer Endpoint (194.177.211.246) ### These pings should reach the PoP and come back to you ### In case there are problems along the route between your ### host and the PoP this could not return replies ### Check your firewall settings if problems occur PING 194.177.211.246 (194.177.211.246) 56(84) bytes of data. From 150.140.193.129 icmp_seq=1 Packet filtered --- 194.177.211.246 ping statistics --- 3 packets transmitted, 0 received, +1 errors, 100% packet loss, time 2007ms ###### [6/8] Ping the IPv6 Remote/PoP Inner Tunnel Endpoint (2001:648:ff00:2b::1) ### This confirms the reachability of the other side of the tunnel ### If it doesn't reply then check your interface and routing tables ### Don't forget to check your firewall of course ### If the previous test was successful then this could be both ### a firewalling and a routing/interface problem PING 2001:648:ff00:2b::1(2001:648:ff00:2b::1) 56 data bytes --- 2001:648:ff00:2b::1 ping statistics --- 3 packets transmitted, 0 received, 100% packet loss, time 2015ms Also, Traceroute6 to noc.sixxs.net and www.kame.net only prints asterisks. Thanks again for helping me, Marios

ICMP blocked - Unable to get tunnel working

Jeroen Massar SixXS Staff

on Wednesday, 26 October 2011 17:00:51

However, I would like to know if there is a way to operate my tunnel without ICMP

SixXS only cares about IPv6 ICMP for the pingtest and we might use it for latency checking when determining a PoP, but that does not prohibit getting the tunnel in a lot of cases.

I have run #aiccu autotest and I post the two checks that fail in case I haven't identified the problem correctly:

That test will only tell you if in general the connectivity works or not, it does not determine in anyway what is broken. There are too many failure cases to cover them all anyway thus such a thing would be near impossible. As you are behind a restrictive firewall though it is quite likely they do not allow tunneling either.

ICMP blocked - Unable to get tunnel working

Shadow Hawkins on Wednesday, 15 February 2012 13:33:15

Even if you could get an IPv6 tunnel working I would doubt that your administrator would like this, because with the tunnel you are making a big hole in the firewall for yourself. You can do anything with IPv6 unless the firewall is IPv6 Ready and configured. The best thing you can do is talk to him and discuss the problem.

Please note Posting is only allowed when you are logged in.