O túnel elétrico Hurrican começa a funcionar somente depois que um traceroute é feito

0

Dou-lhe uma pequena descrição da Estrutura da rede e o que gostaria de fazer e porquê! Infelizmente o meu ISP (um dos principais na Itália) fornece o IPv6, mas apenas para navegar, se você tentar acessar um serviço (câmera IP, área de trabalho remota ou o que mais) sobre IPv6 você simplesmente não pode no tráfego é bloqueado pelo ISP roteador. Eu não poderia mudar o roteador do ISP porque eu tenho a tecnologia FTTH e o ISP não libera os detalhes técnicos para a fibra do conversor para Ethernet. Então, eu experimento com a solução que você pode ver na imagem, use o IPv6 / IPv4 do ISP para navegar e um túnel do Hurricane Electric para ser acessado do lado de fora.

O único problema que encontrei ao atingir meu objetivo é que o NAS começa a se comunicar com o mundo externo somente depois de eu realizar um traceroute, depois disso até que eu mantenha uma conexão ativa tudo funciona perfeitamente; depois de um tempo sem comunicação no túnel HE, novamente a conexão parece quebrada e não se comunica, depois traceroute novamente ok!

Eu realmente não tenho ideia do que poderia causar esse problema, é estranho para mim : (

Mais alguns detalhes de configuração da rede OpenWRT:

        config interface 'loopback'
            option ifname 'lo'
            option proto 'static'
            option ipaddr '127.0.0.1'
            option netmask '255.0.0.0'

    config globals 'globals'

    config interface 'lan'
            option type 'bridge'
            option ifname 'eth0.1'
            option proto 'static'
            option ipaddr '172.xx.x.x'
            option netmask '255.255.255.0'
            option ip6addr '2001:b07:x:x:x:3/64' | ISP IPv6
            option ip6gw '2001:b07:x:x:x:2'

    config interface 'wan'
            option ifname 'eth1.2'
            option proto 'dhcp'

    config interface 'wan6'
            option ifname 'eth1.2'
            option proto 'static'
            option ip6addr '2001:b07:x:x:x:2/126'
            option ip6gw '2001:b07:x:x:x:1'

    config switch
            option name 'switch0'
            option reset '1'
            option enable_vlan '1'

    config switch_vlan
            option device 'switch0'
            option vlan '1'
            option ports '1 2 3 5t'
            option vid '1'

    config switch_vlan
            option device 'switch0'
            option vlan '2'
            option ports '4 6t'
            option vid '2'

    config switch_vlan
            option device 'switch0'
            option vlan '3'
            option vid '3'
            option ports '0 5t 6'

    config interface 'WAN6HE'
            option proto '6in4'
            option peeraddr '216.66.80.98'
            option ip6addr '2001:470:x:x:x:2/64'
            option tunnelid 'idoftunnel'
            option username 'heusername'
            option password '!IdVjKBYouSSADMEe!'
            option ip6prefix '2001:470:x:x:x/48'

config interface 'LAN6HE'                   
        option proto 'static'                
        option type 'bridge'
        option stp '1'   
        option igmp_snooping '1'
        option ifname 'eth0.3'
        option ip6assign '64'
        option ip6hint '2001:470:x:x:x:'

Configuração do firewall do OpenWRT (regras e zonas):

    config rule #Test rule will delete
            option target 'ACCEPT'         
            option family 'ipv6'          
            option proto 'all'       
            option name 'Permit all traffic from LAN to LAN6HE'
            option src 'lan'        
            option dest 'LAN6HE'           

    config rule                            
            option name 'Allow-DHCP-Renew'
            option src 'wan'         
            option proto 'udp'           
            option dest_port '68'   
            option target 'ACCEPT'         
            option family 'ipv4'    

    config rule                          
            option name 'Allow-Ping' 
            option src 'wan'             
            option proto 'icmp'     
            option icmp_type 'echo-request'
            option family 'ipv4'    
            option target 'ACCEPT'   

    config rule                      
            option name 'Allow-IGMP'     
            option src 'wan'          
            option proto 'igmp'       
            option family 'ipv4'    
            option target 'ACCEPT'   

    config rule                       
            option name 'Allow-DHCPv6'   
            option src 'wan'          
            option proto 'udp'       
            option src_ip 'fc00::/6'
            option dest_ip 'fc00::/6'       
            option dest_port '546'       
            option family 'ipv6'      
            option target 'ACCEPT'       

    config rule                                     
            option target 'ACCEPT'         
            option src 'WAN6HE'             
            option name 'Allow-DHCPv6-HE'
            option family 'ipv6'                
            option proto 'udp'                      
            option src_ip 'fc00::/6'               
            option dest_ip 'fc00::/6'               
            option dest_port '546'                  

    config rule                                 
            option name 'Allow-MLD'                
            option src 'wan'                        
            option proto 'icmp'                     
            option src_ip 'fe80::/10'               
            list icmp_type '130/0'                  
            list icmp_type '131/0'              
            list icmp_type '132/0'              
            list icmp_type '143/0'                 
            option family 'ipv6'                    
            option target 'ACCEPT'
    config rule                                                
        option target 'ACCEPT'                             
        option src 'WAN6HE'                                
        option name 'Allow-MLD-HE'                         
        list icmp_type '130/0'                             
        list icmp_type '131/0'                  
        list icmp_type '132/0'                  
        list icmp_type '143/0'                  
        option family 'ipv6'                    
        option proto 'icmp'                     
        option src_ip 'fe80::/10'               

config rule                                     
        option name 'Allow-ICMPv6-Input'        
        option src 'wan'                        
        option proto 'icmp'                     
        list icmp_type 'echo-request'           
        list icmp_type 'echo-reply'             
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'         
        list icmp_type 'time-exceeded'          
        list icmp_type 'bad-header'             
        list icmp_type 'unknown-header-type'    
        list icmp_type 'router-solicitation'    
        list icmp_type 'neighbour-solicitation' 
        list icmp_type 'router-advertisement'   
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'                 
        option family 'ipv6'                    
        option target 'ACCEPT'                  

config rule                                     
        option name 'Allow-ICMPv6-Input-HE'     
        option src 'WAN6HE'                     
        option proto 'icmp'                     
        list icmp_type 'echo-request'           
        list icmp_type 'echo-reply'             
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'         
        list icmp_type 'time-exceeded'          
        list icmp_type 'bad-header'             
        list icmp_type 'unknown-header-type'    
        list icmp_type 'router-solicitation'    
        list icmp_type 'neighbour-solicitation' 
        list icmp_type 'router-advertisement'   
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'                 
        option family 'ipv6'                    
        option target 'ACCEPT'

config rule                                                
        option name 'Allow-ICMPv6-Forward'                 
        option src 'wan'                                   
        option dest '*'                                    
        option proto 'icmp'                                
        list icmp_type 'echo-request'                      
        list icmp_type 'echo-reply'             
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'         
        list icmp_type 'time-exceeded'          
        list icmp_type 'bad-header'             
        list icmp_type 'unknown-header-type'    
        option limit '1000/sec'                 
        option family 'ipv6'                    
        option target 'ACCEPT'                  

config rule                                     
        option name 'Allow-ICMPv6-Forward-HE'   
        option src 'WAN6HE'                     
        option proto 'icmp'                     
        option limit '1000/sec'                 
        option family 'ipv6'                    
        option target 'ACCEPT'                  
        option dest '*'                         
        list icmp_type 'echo-request'           
        list icmp_type 'echo-reply'             
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'         
        list icmp_type 'time-exceeded'          
        list icmp_type 'bad-header'             
        list icmp_type 'unknown-header-type'    

config rule                                     
        option name 'Allow-IPSec-ESP'           
        option src 'wan'                        
        option dest 'lan'                       
        option proto 'esp'                      
        option target 'ACCEPT'                  

config rule                                     
        option target 'ACCEPT'                  
        option name 'Allow IPSec-ESP on HE'     
        option proto 'esp'                      
        option src 'WAN6HE'                     
        option dest 'LAN6HE'                    

config rule                                     
        option name 'Allow-ISAKMP'              
        option src 'wan'                        
        option dest 'lan'                       
        option dest_port '500'                  
        option proto 'udp'                      
        option target 'ACCEPT'                  

config rule                                     
        option target 'ACCEPT'                  
        option name 'Allow-ISAKMP on HE'        
        option family 'ipv6'                    
        option proto 'udp'                      
        option src 'WAN6HE'                     
        option dest 'LAN6HE'                    
        option dest_port '500'
config defaults                                 
        option syn_flood '1'                    
        option input 'ACCEPT'                   
        option output 'ACCEPT'                  
        option forward 'REJECT'                 

config zone                                     
        option name 'lan'                       
        option input 'ACCEPT'                   
        option output 'ACCEPT'                  
        option network 'lan'                    
        option forward 'REJECT'                 

config zone                                     
        option name 'wan'                       
        option input 'REJECT'                   
        option output 'ACCEPT'                  
        option forward 'REJECT'                 
        option masq '1'                         
        option mtu_fix '1'                      
        option network 'wan wan6'               

config forwarding                               
        option src 'lan'                        
        option dest 'wan'                       

config include                                  
        option path '/etc/firewall.user'        

config zone                                     
        option input 'ACCEPT'                   
        option output 'ACCEPT'                  
        option name 'LAN6HE'                    
        option network 'LAN6HE'                 
        option forward 'REJECT'                 

config zone                                     
        option output 'ACCEPT'                  
        option name 'WAN6HE'                    
        option input 'REJECT'                   
        option network 'WAN6HE'                 
        option masq '1'                         
        option mtu_fix '1'                      
        option forward 'REJECT'                 
        option family 'ipv6'                    

config forwarding                               
        option dest 'WAN6HE'                    
        option src 'LAN6HE'

Configuração do servidor DHCP para as interfaces LAN e LAN6HE:

...
config dhcp 'lan'
        option interface 'lan'
        option start '100'
        option limit '150'
        option leasetime '12h'
        option dhcpv6 'server'
        option ra_management '1'
        option ra 'server'
        option ra_default '1'
        option ndp 'relay'
        list domain 'vmhome.ml'
...
config dhcp 'wan6'
        option interface 'wan6'
        option ignore '1'
        option dhcpv6 'relay'
        option ra 'relay'
        option ndp 'relay'
...
config dhcp 'LAN6HE'
        option interface 'LAN6HE'
        list domain 'vmhome.ml'
        option ignore '1'
        option ra 'server'
        option ndp 'hybrid'
        option ra_default '1'
...

Configuração de rede NAS:

# This file describes the network interfaces available on your system
# and how to activate them. For more information, see interfaces(5).

source /etc/network/interfaces.d/*

# The loopback network interface
auto lo
iface lo inet loopback
iface lo inet6 loopback

# The primary network interface
auto enp4s0
allow-hotplug enp4s0
iface enp4s0 inet dhcp
# This is an dhcp configured IPv6 interface
iface enp4s0 inet6 dhcp

# The secondary newtwork interface IPv6 only config
auto enp5s0
iface enp5s0 inet6 static
    address 2001:470:x:x:x:x
    netmask 64

Todos os outros computadores da rede são configurados como dhcp e não causam problemas.

Tabela de rotas IPv6 do OpenWRT:

ip -6 route
default from 2001:470:x:x:x:x/64 dev 6in4-WAN6HE  metric 1024 
default from 2001:470:x:x:x/48 dev 6in4-WAN6HE  metric 1024 
2001:470:x:x:x:x/64 dev 6in4-WAN6HE  metric 256 
2001:470:x:x:x:x/64 dev br-LAN6HE  metric 1024 
unreachable 2001:470:x:x:x/48 dev lo  metric 2147483647  error -113
2001:b07:x:x:x:x/126 dev eth1.2  metric 256 
2001:b07:x:x:x:147 dev br-lan  metric 1024 
2001:b07:x:x::34f dev br-lan  metric 1024 
2001:b07:x:x::ad9 dev br-lan  metric 1024 
2001:b07:x:x::c51 dev br-lan  metric 1024 
2001:b07:x:x::e8b dev br-lan  metric 1024 
2001:b07:x:x:x:x:x:8807 dev br-lan  metric 1024 
2001:b07:x:x:x:x:x:aa0 dev br-lan  metric 1024 
2001:b07:x:x:x:x:x:97f3 dev br-lan  metric 1024 
2001:b07:x:x:x:x:X:be1d dev br-lan  metric 1024 
2001:b07:x:X:x:X:x:227e dev br-lan  metric 1024 
2001:b07:x:x:x:x:x:e061 dev br-lan  metric 1024 
2001:b07:x:x:x:x:x:b53d dev br-lan  metric 1024 
2001:b07:X:x::/64 dev br-lan  metric 256 
fe80::/64 dev br-lan  metric 256 
fe80::/64 dev eth1.2  metric 256 
fe80::/64 dev eth0  metric 256 
fe80::/64 dev eth1  metric 256 
fe80::/64 dev 6in4-WAN6HE  metric 256 
fe80::/64 dev br-LAN6HE  metric 256 
fe80::/64 dev wlan1  metric 256 
fe80::/64 dev wlan0  metric 256 
default via 2001:b07:5d2b:f916::1 dev eth1.2  metric 1024 
anycast 2001:470:x:x:x:x dev 6in4-WAN6HE  metric 0 
anycast 2001:470:x:x:x:x dev br-LAN6HE  metric 0 
anycast 2001:b07:x:x:x:x dev br-lan  metric 0 
anycast 2001:b07:X:x:x:x dev eth1.2  metric 0 
anycast fe80:: dev 6in4-WAN6HE  metric 0 
anycast fe80:: dev eth1.2  metric 0 
anycast fe80:: dev eth1  metric 0 
anycast fe80:: dev br-lan  metric 0 
anycast fe80:: dev eth0  metric 0 
anycast fe80:: dev br-LAN6HE  metric 0 
anycast fe80:: dev wlan1  metric 0 
anycast fe80:: dev wlan0  metric 0 
ff00::/8 dev br-lan  metric 256 
ff00::/8 dev eth1.2  metric 256 
ff00::/8 dev eth0  metric 256 
ff00::/8 dev eth1  metric 256 
ff00::/8 dev 6in4-WAN6HE  metric 256 
ff00::/8 dev br-LAN6HE  metric 256 
ff00::/8 dev wlan1  metric 256 
ff00::/8 dev wlan0  metric 256

Tabela de rotas IPv6 do NAS:

sudo ip -6 route
2001:470:x:x:x:x/64 dev enp5s0 proto kernel metric 256  pref medium
2001:b07:x:x:x:147 dev enp4s0 proto kernel metric 256  pref medium
2001:b07:x:X:x:x/64 dev enp4s0 proto kernel metric 256  pref medium
fe80::/64 dev enp4s0 proto kernel metric 256  pref medium
fe80::/64 dev enp5s0 proto kernel metric 256  pref medium
default via fe80::24f5:a2ff:fe25:21eb dev enp4s0 proto ra metric 1024  expires 1691sec hoplimit 64 pref medium
default via fe80::24f5:a2ff:fe25:21eb dev enp5s0 proto ra metric 1024  expires 1529sec hoplimit 64 pref medium

A questão:

ping -I enp5s0 ipv6.google.com
PING ipv6.google.com(mrs08s01-in-x0e.1e100.net (2a00:1450:4006:801::200e)) from 2001:470:x:x:x:x enp5s0: 56 data bytes
64 bytes from mrs08s01-in-x0e.1e100.net (2a00:1450:4006:801::200e): icmp_seq=1 ttl=54 time=59.0 ms
^C
--- ipv6.google.com ping statistics ---
6 packets transmitted, 1 received, 83% packet loss, time 5096ms
rtt min/avg/max/mdev = 59.092/59.092/59.092/0.000 ms

A solução sem sentido (para mim no momento):

sudo traceroute -i enp5s0 ipv6.google.com -n
traceroute to ipv6.google.com (2a00:1450:4006:801::200e), 30 hops max, 80 byte packets
 1  2001:470:x:x:x:1  0.335 ms  0.293 ms  0.271 ms
 2  * * *
 3  * * *
 4  * * *
 5  * * *
 6  * * *
 7  * * *
 8  * * *
 9  * * *
10  * * *
11  * * *
12  * * 2a00:1450:4006:801::200e  43.135 ms # ipv6.google.com

Ping após traceroute:

ping -I enp5s0 ipv6.google.com
PING ipv6.google.com(mrs08s01-in-x0e.1e100.net (2a00:1450:4006:801::200e)) from 2001:470:x:x:x:c2c enp5s0: 56 data bytes
64 bytes from mrs08s01-in-x0e.1e100.net (2a00:1450:4006:801::200e): icmp_seq=1 ttl=54 time=43.0 ms
64 bytes from mrs08s01-in-x0e.1e100.net (2a00:1450:4006:801::200e): icmp_seq=2 ttl=54 time=43.0 ms
64 bytes from mrs08s01-in-x0e.1e100.net (2a00:1450:4006:801::200e): icmp_seq=3 ttl=54 time=43.0 ms
64 bytes from mrs08s01-in-x0e.1e100.net (2a00:1450:4006:801::200e): icmp_seq=4 ttl=54 time=42.9 ms
64 bytes from mrs08s01-in-x0e.1e100.net (2a00:1450:4006:801::200e): icmp_seq=5 ttl=54 time=43.0 ms
64 bytes from mrs08s01-in-x0e.1e100.net (2a00:1450:4006:801::200e): icmp_seq=6 ttl=54 time=42.8 ms
64 bytes from mrs08s01-in-x0e.1e100.net (2a00:1450:4006:801::200e): icmp_seq=7 ttl=54 time=42.8 ms
64 bytes from mrs08s01-in-x0e.1e100.net (2a00:1450:4006:801::200e): icmp_seq=8 ttl=54 time=43.5 ms
64 bytes from mrs08s01-in-x0e.1e100.net (2a00:1450:4006:801::200e): icmp_seq=9 ttl=54 time=42.8 ms
64 bytes from mrs08s01-in-x0e.1e100.net (2a00:1450:4006:801::200e): icmp_seq=10 ttl=54 time=43.1 ms
64 bytes from mrs08s01-in-x0e.1e100.net (2a00:1450:4006:801::200e): icmp_seq=11 ttl=54 time=43.6 ms
64 bytes from mrs08s01-in-x0e.1e100.net (2a00:1450:4006:801::200e): icmp_seq=12 ttl=54 time=42.8 ms
64 bytes from mrs08s01-in-x0e.1e100.net (2a00:1450:4006:801::200e): icmp_seq=13 ttl=54 time=42.9 ms
64 bytes from mrs08s01-in-x0e.1e100.net (2a00:1450:4006:801::200e): icmp_seq=14 ttl=54 time=43.0 ms
64 bytes from mrs08s01-in-x0e.1e100.net (2a00:1450:4006:801::200e): icmp_seq=15 ttl=54 time=42.8 ms
64 bytes from mrs08s01-in-x0e.1e100.net (2a00:1450:4006:801::200e): icmp_seq=16 ttl=54 time=43.4 ms
64 bytes from mrs08s01-in-x0e.1e100.net (2a00:1450:4006:801::200e): icmp_seq=17 ttl=54 time=42.8 ms
64 bytes from mrs08s01-in-x0e.1e100.net (2a00:1450:4006:801::200e): icmp_seq=18 ttl=54 time=42.8 ms
64 bytes from mrs08s01-in-x0e.1e100.net (2a00:1450:4006:801::200e): icmp_seq=19 ttl=54 time=42.9 ms
64 bytes from mrs08s01-in-x0e.1e100.net (2a00:1450:4006:801::200e): icmp_seq=20 ttl=54 time=42.9 ms
64 bytes from mrs08s01-in-x0e.1e100.net (2a00:1450:4006:801::200e): icmp_seq=21 ttl=54 time=43.5 ms
^C
--- ipv6.google.com ping statistics ---
21 packets transmitted, 21 received, 0% packet loss, time 20033ms
rtt min/avg/max/mdev = 42.812/43.065/43.602/0.254 ms
    
por AtomiX84 09.09.2018 / 00:56

0 respostas