Hurricane Electric's IPv6 Tunnel Broker Forums

General IPv6 Topics => IPv6 on Routing Platforms => Topic started by: crobertp on June 26, 2009, 09:55:55 AM

Title: configuring speedstream 4200 tobe a lan router
Post by: crobertp on June 26, 2009, 09:55:55 AM
this adsl modem has a builtin dhcp server
and do auto login on my isp

thus the modem cable is connected on a 40 port switch instead of on a pc .

in turn each lan pc has a cable to the switch box

this setup is working well on ipv4 ...
via dhcp each pc gets a  different ip. eg:192.168.254.1 ... 192.168.254.2  and on and on ...
the adsl modem (gateway) has a ip 192.168.254.254
and a public ipv4 eg:    189.24.143.137

*however this setup is not working with ipv6

eg: my pc is running windws xp sp3
Code: [Select]
C:\>ipconfig

Windows IP Configuration


Ethernet adapter Local Area Connection 2:

        Connection-specific DNS Suffix  . : cp3
        IP Address. . . . . . . . . . . . : 192.168.254.1
        Subnet Mask . . . . . . . . . . . : 255.255.255.0
        IP Address. . . . . . . . . . . . : fe80::20c:6eff:fe03:e29%4
        Default Gateway . . . . . . . . . : 192.168.254.254

Ethernet adapter aiccu:

        Media State . . . . . . . . . . . : Media disconnected

Tunnel adapter Teredo Tunneling Pseudo-Interface:

        Connection-specific DNS Suffix  . :
        IP Address. . . . . . . . . . . . : fe80::ffff:ffff:fffd%6
        Default Gateway . . . . . . . . . :

Tunnel adapter Automatic Tunneling Pseudo-Interface:

        Connection-specific DNS Suffix  . : cp3
        IP Address. . . . . . . . . . . . : fe80::5efe:192.168.254.1%2
        Default Gateway . . . . . . . . . : ::209.51.161.58

C:\>

C:\>ping ipv6.google.com

Pinging ipv6.l.google.com [2001:4860:0:2001::68] with 32 bytes of data:

Request timed out.
Request timed out.
Request timed out.
Request timed out.

Ping statistics for 2001:4860:0:2001::68:
    Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),

C:\>


any clues on gettig ipv6 working on my pc ?
 
ps: i did this on my pc

 
Code: [Select]
ipv6 install
ipv6 rtu ::/0 2/::209.51.161.58 pub
ipv6 adu 2/2001:470:4:c4::2

thanks
Title: Re: configuring speedstream 4200 tobe a lan router
Post by: jimb on June 26, 2009, 02:49:21 PM
The firewall on your speedstream needs to be configured to pass 6in4 traffic (IP protocol 41), and static destination NAT it to your windows box.
Title: Re: configuring speedstream 4200 tobe a lan router
Post by: crobertp on June 28, 2009, 08:27:49 AM
Still dont works

I did this ...

ipv6 uninstall

then C:\>netsh interface ipv6 install
Ok.
and then
Code: [Select]
C:\>netsh interface ipv6 show teredo
Teredo Parameters
---------------------------------------------
Type                    : default
Server Name             : default
Client Refresh Interval : default
Client Port             : default
State                   : offline
Error                   : none


C:\>#netsh interface ipv6 add v6v4tunnel IP6Tunnel 189.24.143.137 216.66.22.2
'#netsh' is not recognized as an internal or external command,
operable program or batch file.

C:\>netsh interface ipv6 add v6v4tunnel IP6Tunnel 192.168.254.1 216.66.22.2
Ok.


C:\>netsh interface ipv6 add address IP6Tunnel 2001:470:7:ff::2
Ok.


C:\>netsh interface ipv6 add route ::/0 IP6Tunnel 2001:470:7:ff::1
Ok.


C:\>ping ipv6.google.com

Pinging ipv6.l.google.com [2001:4860:0:2001::68] with 32 bytes of data:

Request timed out.
Request timed out.
Request timed out.
Request timed out.

Ping statistics for 2001:4860:0:2001::68:
    Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),

C:\>ping ipv6.google.com

Pinging ipv6.l.google.com [2001:4860:0:2001::68] with 32 bytes of data:

Request timed out.
Request timed out.
Request timed out.
Request timed out.

Ping statistics for 2001:4860:0:2001::68:
    Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),

C:\>



my windows box at ip 192.168.254.1 is running DMZ with windows firewall off
Code: [Select]
Firewall DMZ Configuration
 
Current DMZ Status: Enabled
Current DMZ Host IP Address: 192.168.254.1
 
current speedstream firewall
Code: [Select]
nbound IP Filter Rules
 
Rule
No. Status Access Protocol Source
Interface Source
Address Source
Mask Source
Port Op Destination
Interface Destination
Address Destination
Mask Destination
Port Op Log Enable
Disable Delete
2202 P,E,N permit TCP any any any any any 192.168.254. 1 host = 23 no Protected Protected
2204 E permit GRE any any any N/A any any any N/A no
2206 E deny TCP any any any any any 127. 0. 0. 1 host = 53 no
2206 E permit 50 any any any N/A any any any N/A no
2207 E permit 41 any any any N/A any any any N/A no
2208 E,S permit UDP any any any any any 127. 0. 0. 1 host = 53 no
2210 E deny UDP any any any any any 127. 0. 0. 1 host = 53 no
2212 P,E,N permit UDP any any any any any 192.168.254. 1 host = 4627 no Protected Protected
2214 E,N permit UDP any any any any any 192.168.254. 1 host = 4371 no
2216 P,E,N permit UDP any any any any any 192.168.254. 1 host = 3990 no Protected Protected
2220 P,E,N permit UDP any any any any any 192.168.254. 1 host = 3614 no Protected Protected


I running DMZ with firewall off , thus I should receive ALL traffic that does not belongs to other user
however still not working ...

any recomendations ?

Thanks
Title: Re: configuring speedstream 4200 tobe a lan router
Post by: jimb on June 28, 2009, 08:39:49 AM
Try baby steps.  Can you ping the other side of the tunnel with v6?  Try to ping 2001:470:7:ff::1 .

If the DMZ functionality forwards all unsolicited traffic to your windows box, then it should be working, although I don't know speedstreams.  Does it have a firewall log?  Can you tell if it's dropping the traffic or not?

EDIT:  It looks like it has options for logging.  Turn on some logging rules.  Have it log dropped packets so you know what it's dropping.

If you're sure it's configured right and should be passing IP 41 traffic to your inside box, then perhaps your ISP is dropping IP proto 41.  In that case, you're only real choice is to try Teredo.

Also, you may want to RTFM:  http://service.sympatico.ca/img_gallery/SpeedStream4200_EN.pdf (http://service.sympatico.ca/img_gallery/SpeedStream4200_EN.pdf)

If you are "turning off" the firewall, you are turning off NAT.
Title: Re: configuring speedstream 4200 tobe a lan router
Post by: crobertp on June 28, 2009, 09:25:41 AM
the other side is  not pingable 

Code: [Select]
C:\>ping 2001:470:7:ff::1

Pinging 2001:470:7:ff::1 with 32 bytes of data:

Request timed out.
Request timed out.
Request timed out.
Request timed out.

Ping statistics for 2001:470:7:ff::1:
    Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),

C:\>ping 2001:470:7:ff::2

Pinging 2001:470:7:ff::2 with 32 bytes of data:

Reply from 2001:470:7:ff::2: time<1ms
Reply from 2001:470:7:ff::2: time<1ms
Reply from 2001:470:7:ff::2: time<1ms
Reply from 2001:470:7:ff::2: time<1ms

Ping statistics for 2001:470:7:ff::2:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 0ms, Maximum = 0ms, Average = 0ms

C:\>

speedstream firewall log
Code: [Select]
Firewall Log

0000-00-00 246:15:18     E |Firewall             |D:19:0 TCP 70.37.129.165:80 -> 192.168.254.3:55293  len=852  id=43708  DF=1 MF=0  byte-off=0

0000-00-00 246:15:37     E |Firewall             |D:19:0 TCP 70.37.129.165:80 -> 192.168.254.3:55293  len=852  id=10155  DF=1 MF=0  byte-off=0

0000-00-00 246:16:13     E |Firewall             |D:19:0 TCP 70.37.129.165:80 -> 192.168.254.3:55293  len=852  id=55913  DF=1 MF=0  byte-off=0

0000-00-00 246:17:16     E |Firewall             |D:19:0 TCP 70.37.129.165:80 -> 192.168.254.3:55293  len=852  id=54611  DF=1 MF=0  byte-off=0

0000-00-00 246:18:20     E |Firewall             |D:19:0 TCP 70.37.129.165:80 -> 192.168.254.3:55293  len=852  id=44098  DF=1 MF=0  byte-off=0

0000-00-00 246:19:24     E |Firewall             |D:19:0 TCP 70.37.129.165:80 -> 192.168.254.3:55293  len=852  id=35091  DF=1 MF=0  byte-off=0

0000-00-00 257:21:44     E |Attack Detected      |TCP packet fragmented - 92.72.194.77:33120 -> 189.24.143.137:563  len=40  id=0


btw: if instead of using he-ipv6 I set teredo client ,
then all ipv6 things works ,
however I cannot run a ipv6 web server on my pc ,
cause then, my ipv6 ip keeps changing.

thanks
 
Title: Re: configuring speedstream 4200 tobe a lan router
Post by: jimb on June 28, 2009, 10:21:28 AM
Take a look at the edits in my last message.

Basically, what you need to get that speedstream to do is:


However one gets a speedstream to do that, that's what you need to do.

You may also want the put a deny-all rule at the bottom of your rule list which logs, just so you can see what traffic your firewall is dropping, unless it logs dropped traffic automatically.

If worse comes to worse, and you can't get the speedstream to do a simple NAT like that, you may want to see if you have the options of simply bridging all your traffic through the speedstream, and using another more capable router/firewall behind it.

Also, do you realize that if your IP changes, you'll need to reconfigure you tunnel w/ HE every time?

It may be better to use some sort of DynDNS (if there's one out there that does v6) and use Teredo or 6to4 for your IPv6 servers.