Ticket ID: SIXXS #872894 Ticket Status: User PoP: deham01 - Easynet (Hamburg)
tunnel up, but looks like routing problem
Shadow Hawkins on Sunday, 07 December 2008 18:28:58
I have read and followed the "Reporting Problems" section on the Contact page and am providing the following details for this report based on the list of items stated there:
Can't connect to ipv6 hosts, like
[root@sixer ~]# ping6 2001:6f8:900:895::1
connect: Network is unreachable
[root@sixer ~]# ping6 noc.sixxs.net
connect: Network is unreachable
[root@sixer ~]#
It worked when I set it up yesterday, but today nothing.
For me it looks like a routing problem. The status page show the pop as UP.
Now open tickets for the POP. Can be setup problem, but I can't see any.
The subnet is not active yet, only the tunnel.
Infos:
System Centos 5.2 (domU) with a DOM0 RHEL5.2
All updates, aiccu from epel-repo.
Router is a pfsense 1.2 Release, doing NAT. Rebooted it, no help.
The Network I'm in has only a any/any Access rule. No limitation.
I disabled iptables and ip6tables on the host temporary.
In tcpdump I can see the tunneltraffic when pinging the default GW.
/etc/aiccu.conf:
username JTK-RIPE
password XXXXXXXXXXX
ipv6_interface sixxs
tunnel_id T11428
verbose false
daemonize true
automatic true
requiretls false
makebeats true
behindnat true
[root@sixer ~]# ip -6 a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 16436
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
3: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qlen 1000
inet6 fe80::216:3eff:fe1f:18b2/64 scope link
valid_lft forever preferred_lft forever
14: sixxs: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1280 qlen 500
inet6 2001:6f8:900:895::2/64 scope global
valid_lft forever preferred_lft forever
inet6 fe80::4f8:900:895:2/64 scope link
valid_lft forever preferred_lft forever
[root@sixer ~]# ip -6 r
unreachable ::/96 dev lo metric 1024 expires 21322985sec error -101 mtu 16436 advmss 16376 hoplimit 4294967295
unreachable ::ffff:0.0.0.0/96 dev lo metric 1024 expires 21322985sec error -101 mtu 16436 advmss 16376 hoplimit 4294967295
2001:6f8:900:895::/64 dev sixxs metric 256 expires 21334360sec mtu 1280 advmss 1220 hoplimit 4294967295
unreachable 2002:a00::/24 dev lo metric 1024 expires 21322985sec error -101 mtu 16436 advmss 16376 hoplimit 4294967295
unreachable 2002:7f00::/24 dev lo metric 1024 expires 21322985sec error -101 mtu 16436 advmss 16376 hoplimit 4294967295
unreachable 2002:a9fe::/32 dev lo metric 1024 expires 21322985sec error -101 mtu 16436 advmss 16376 hoplimit 4294967295
unreachable 2002:ac10::/28 dev lo metric 1024 expires 21322985sec error -101 mtu 16436 advmss 16376 hoplimit 4294967295
unreachable 2002:c0a8::/32 dev lo metric 1024 expires 21322985sec error -101 mtu 16436 advmss 16376 hoplimit 4294967295
unreachable 2002:e000::/19 dev lo metric 1024 expires 21322985sec error -101 mtu 16436 advmss 16376 hoplimit 4294967295
unreachable 3ffe:ffff::/32 dev lo metric 1024 expires 21322985sec error -101 mtu 16436 advmss 16376 hoplimit 4294967295
fe80::/64 dev eth0 metric 256 expires 21322980sec mtu 1500 advmss 1440 hoplimit 4294967295
fe80::/64 dev sixxs metric 256 expires 21334360sec mtu 1280 advmss 1220 hoplimit 4294967295
default via 2001:6f8:900:895::1 dev sixxs metric 1024 expires 21334360sec mtu 1280 advmss 1220 hoplimit 4294967295
Output of aiccu autotest:
#######
####### AICCU Quick Connectivity Test
#######
####### [1/8] Ping the IPv4 Local/Your Outer Endpoint (192.168.12.6)
### This should return so called 'echo replies'
### If it doesn't then check your firewall settings
### Your local endpoint should always be pingable
### It could also indicate problems with your IPv4 stack
PING 192.168.12.6 (192.168.12.6) 56(84) bytes of data.
64 bytes from 192.168.12.6: icmp_seq=1 ttl=64 time=0.030 ms
64 bytes from 192.168.12.6: icmp_seq=2 ttl=64 time=0.038 ms
64 bytes from 192.168.12.6: icmp_seq=3 ttl=64 time=0.046 ms
--- 192.168.12.6 ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2114ms
rtt min/avg/max/mdev = 0.030/0.038/0.046/0.006 ms
######
####### [2/8] Ping the IPv4 Remote/PoP Outer Endpoint (212.224.0.188)
### These pings should reach the PoP and come back to you
### In case there are problems along the route between your
### host and the PoP this could not return replies
### Check your firewall settings if problems occur
PING 212.224.0.188 (212.224.0.188) 56(84) bytes of data.
64 bytes from 212.224.0.188: icmp_seq=1 ttl=57 time=31.5 ms
64 bytes from 212.224.0.188: icmp_seq=2 ttl=57 time=32.9 ms
64 bytes from 212.224.0.188: icmp_seq=3 ttl=57 time=18.6 ms
--- 212.224.0.188 ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2126ms
rtt min/avg/max/mdev = 18.639/27.700/32.933/6.435 ms
######
####### [3/8] Traceroute to the PoP (212.224.0.188) over IPv4
### This traceroute should reach the PoP
### In case this traceroute fails then you have no connectivity
### to the PoP and this is most probably the problem
traceroute to 212.224.0.188 (212.224.0.188), 30 hops max, 40 byte packets
1 192.168.12.1 (192.168.12.1) 0.430 ms 0.609 ms 0.587 ms
2 * * *
3 87.186.249.70 (87.186.249.70) 10.149 ms 11.353 ms 12.308 ms
4 217.239.40.193 (217.239.40.193) 13.733 ms 14.701 ms 16.064 ms
5 217.243.219.82 (217.243.219.82) 16.633 ms 18.070 ms 18.794 ms
6 te0-0-0.gr10.isham.de.easynet.net (87.86.77.65) 34.710 ms 20.979 ms 20.755 ms
7 ge3-8.br3.isham.de.easynet.net (87.86.71.245) 20.732 ms 21.645 ms 23.161 ms
8 ge7-1.cr20.isham.de.easynet.net (212.224.4.89) 24.039 ms 24.773 ms 25.969 ms
9 deham01.sixxs.net (212.224.0.188) 27.695 ms 28.872 ms 30.332 ms
######
###### [4/8] Checking if we can ping IPv6 localhost (::1)
### This confirms if your IPv6 is working
### If ::1 doesn't reply then something is wrong with your IPv6 stack
PING ::1(::1) 56 data bytes
64 bytes from ::1: icmp_seq=0 ttl=64 time=0.022 ms
64 bytes from ::1: icmp_seq=1 ttl=64 time=0.035 ms
64 bytes from ::1: icmp_seq=2 ttl=64 time=0.032 ms
--- ::1 ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2345ms
rtt min/avg/max/mdev = 0.022/0.029/0.035/0.008 ms, pipe 2
######
###### [5/8] Ping the IPv6 Local/Your Inner Tunnel Endpoint (2001:6f8:900:895::2)
### This confirms that your tunnel is configured
### If it doesn't reply then check your interface and routing tables
PING 2001:6f8:900:895::2(2001:6f8:900:895::2) 56 data bytes
64 bytes from 2001:6f8:900:895::2: icmp_seq=0 ttl=64 time=0.034 ms
64 bytes from 2001:6f8:900:895::2: icmp_seq=1 ttl=64 time=0.031 ms
64 bytes from 2001:6f8:900:895::2: icmp_seq=2 ttl=64 time=0.031 ms
--- 2001:6f8:900:895::2 ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2017ms
rtt min/avg/max/mdev = 0.031/0.032/0.034/0.001 ms, pipe 2
######
###### [6/8] Ping the IPv6 Remote/PoP Inner Tunnel Endpoint (2001:6f8:900:895::1)
### This confirms the reachability of the other side of the tunnel
### If it doesn't reply then check your interface and routing tables
### Don't forget to check your firewall of course
### If the previous test was succesful then this could be both
### a firewalling and a routing/interface problem
PING 2001:6f8:900:895::1(2001:6f8:900:895::1) 56 data bytes
64 bytes from 2001:6f8:900:895::1: icmp_seq=0 ttl=64 time=31.8 ms
64 bytes from 2001:6f8:900:895::1: icmp_seq=1 ttl=64 time=39.8 ms
64 bytes from 2001:6f8:900:895::1: icmp_seq=2 ttl=64 time=59.7 ms
--- 2001:6f8:900:895::1 ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2009ms
rtt min/avg/max/mdev = 31.899/43.807/59.720/11.706 ms, pipe 2
######
###### [7/8] Traceroute6 to the central SixXS machine (noc.sixxs.net)
### This confirms that you can reach the central machine of SixXS
### If that one is reachable you should be able to reach most IPv6 destinations
### Also check http://www.sixxs.net/ipv6calc/ which should show an IPv6 connection
### If your browser supports IPv6 and uses it of course.
traceroute to noc.sixxs.net (2001:838:1:1:210:dcff:fe20:7c7c), 30 hops max, 40 byte packets
connect: Das Netzwerk ist nicht erreichbar
######
###### [8/8] Traceroute6 to (www.kame.net)
### This confirms that you can reach a Japanese IPv6 destination
### If that one is reachable you should be able to reach most IPv6 destinations
### You should also check http://www.kame.net which should display
### a animated kame (turtle), of course only when your browser supports and uses IPv6
traceroute to www.kame.net (2001:200:0:8002:203:47ff:fea5:3085), 30 hops max, 40 byte packets
connect: Das Netzwerk ist nicht erreichbar
######
###### ACCU Quick Connectivity Test (done)
tunnel up, but looks like routing problem
Shadow Hawkins on Sunday, 07 December 2008 18:42:50
Please delete.
It's working again! Don't know why, just rebooted host and FW.
thanks anyway! Greate serivce.
CU
Jens
State change: user
Jeroen Massar on Sunday, 07 December 2008 19:58:33
The state of this ticket has been changed to user
Posting is only allowed when you are logged in. |