Problema ao conectar um sistema Ubuntu ao túnel IPv6 sobre NAT

Question

Estou tentando configurar um túnel IPv6, através do serviço de corretores de túneis da Hurricane Electric. Eu configurei meu sistema usando seus comandos de exemplo:

# $ipv4a = tunnel server's IPv4 IP
# $ipv4b = user's IPv4 IP
# $ipv6a = tunnel server's side of point-to-point /64 allocation
# $ipv6b = user's side of point-to-point /64 allocation

ip tunnel add he-ipv6 mode sit remote $ipv4a local $ipv4b ttl 255
ip link set he-ipv6 up
ip addr add $ipv6b dev he-ipv6
ip route add ::/0 dev he-ipv6

E configurei minha área de trabalho para estar na DMZ do meu roteador NAT. O roteador está executando o firmware do Tomato.

Mas não consigo fazer ping em nenhum serviço IPv6:

$ ping6 -I he-ipv6 '2001:470:1f04:454::1'
PING 2001:470:1f04:454::1(2001:470:1f04:454::1) from 2001:470:1f04:454::2 he-ipv6: 56 data bytes
From 2001:470:1f04:454::2 icmp_seq=1 Destination unreachable: Address unreachable
From 2001:470:1f04:454::2 icmp_seq=2 Destination unreachable: Address unreachable

Eu posso pingar meu endereço local:

$ ping6 -I he-ipv6 '2001:470:1f04:454::2'
PING 2001:470:1f04:454::2(2001:470:1f04:454::2) from 2001:470:1f04:454::2 he-ipv6: 56 data bytes
64 bytes from 2001:470:1f04:454::2: icmp_seq=1 ttl=64 time=0.037 ms
64 bytes from 2001:470:1f04:454::2: icmp_seq=2 ttl=64 time=0.039 ms

Não sei muito sobre roteamento, mas os resultados encontrados on-line sugeriram que a saída de ip -6 route e ip addr poderia ser útil:

$ ip -6 route
2001:470:1f04:454::/64 via :: dev he-ipv6  proto kernel  metric 256  mtu 1480 advmss 1420 hoplimit 4294967295
fe80::/64 dev virbr0  proto kernel  metric 256  mtu 1500 advmss 1440 hoplimit 4294967295
fe80::/64 dev eth1  proto kernel  metric 256  mtu 1500 advmss 1440 hoplimit 4294967295
fe80::/64 via :: dev he-ipv6  proto kernel  metric 256  mtu 1480 advmss 1420 hoplimit 4294967295
default dev he-ipv6  metric 1024  mtu 1480 advmss 1420 hoplimit 4294967295

$ ip addr
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 16436 qdisc noqueue state UNKNOWN 
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 100
    link/ether 00:1c:c0:a1:98:b2 brd ff:ff:ff:ff:ff:ff
    inet 192.168.1.10/24 brd 192.168.1.255 scope global eth1
    inet6 fe80::21c:c0ff:fea1:98b2/64 scope link 
       valid_lft forever preferred_lft forever
3: virbr0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UNKNOWN 
    link/ether 36:4c:33:ab:0d:c6 brd ff:ff:ff:ff:ff:ff
    inet 192.168.122.1/24 brd 192.168.122.255 scope global virbr0
    inet6 fe80::344c:33ff:feab:dc6/64 scope link 
       valid_lft forever preferred_lft forever
4: vboxnet0: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN qlen 1000
    link/ether 00:76:62:6e:65:74 brd ff:ff:ff:ff:ff:ff
5: pan0: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN 
    link/ether 7e:29:5e:7c:ba:93 brd ff:ff:ff:ff:ff:ff
6: sit0: <NOARP> mtu 1480 qdisc noop state DOWN 
    link/sit 0.0.0.0 brd 0.0.0.0
7: he-ipv6@NONE: <POINTOPOINT,NOARP,UP,LOWER_UP> mtu 1480 qdisc noqueue state UNKNOWN 
    link/sit 24.130.225.239 peer 72.52.104.74
    inet6 2001:470:1f04:454::2/64 scope global 
       valid_lft forever preferred_lft forever
    inet6 fe80::1882:e1ef/128 scope link 
       valid_lft forever preferred_lft forever

    

Answer 1

Você verificou suas ip6tables? Eu tive um problema assim e acabou que meu ip6tables estavam prontos para baixar.

Se você não está executando um firewall ip6, você pode limpá-los assim:

ip6tables -P INPUT ACCEPT
ip6tables -P OUTPUT ACCEPT
ip6tables -P FORWARD ACCEPT

Observe que isso desativa completamente o seu firewall IPv6.