Open a ticket, have HE check routing on their side  ipv6@he.net

Thanks cholzhauer,

I can confirm that the tunnel is up and I had disabled the firewall (Firewalld).

Correct that I am using the routed /64 address and not the /48 and so have no routing on my Linux box that is setting up the tunnel.

The code section in my original post is my friend's traceroute for all three ip addresses (tunnel HE end, my end and my local ip). In neither of the latter two cases did the route get to the HE end of the tunnel.

Thanks

Well, the differentiation here is you;  the 06whatever::1 is the HE side, so it makes sense that someone else could reach them.  The 06whatever::2 is your side, so either the tunnel isn't up or you're firewalling something. We see above that your tunnel is up, so that means it must be a firewall issue.  I suppose it could be a routing issue on HE's side...what does a traceroute from your friend look like?

If you're using your routed /48, you would need a routing rule on your router to pass the entire /48 to the next hop, but I suspect that's not the case here.

I have a machine without IPv6 connectivity (openSUSE linux) and have a tunnel working fine to the outside IPv6 world. My tunnel is 2001:470:**06:****::2 locally.

I want to set up a local IPv6 network using the "Routed IPv6 Prefixes". To that end I have created an interface and given it an address 2001:470:**07:****::100 as per the reference page and enabled IPv6 routing on the machine.

I have then asked someone to access my machine and network from outside of my system. He can ping 2001:470:**06:****::1 as expected. But not 2001:470:**06:****::2 or 2001:470:**07:****::100 which I am supprised about.

Traceroute for the three addresses is as follows:

Code: [Select]

C:\WINDOWS\system32>TRACERT 2001:470:**06:****::1

Tracing route to tunnelXXXXXX.tunnel.tserv4.nyc4.ipv6.he.net [2001:470:**06:****::1]
over a maximum of 30 hops:

  1    22 ms    <1 ms    <1 ms  broadband.bt.com [2a00:23c5:b39e:****:21d:****:****:****]
  2     5 ms     5 ms     5 ms  2a00:2302::1100:203:209
  3     *        9 ms     9 ms  2a00:2302::1102:100:36
  4     *        *        *     Request timed out.
  5     9 ms     9 ms     9 ms  2a00:2380:3014:8000::1c
  6     9 ms     9 ms     *     core3-hu0-1-0-0.faraday.ukcore.bt.net [2a00:2380:14::9]
  7    11 ms     *        *     core4-l2.faraday.ukcore.bt.net [2a00:2380:3000:c::b]
  8     9 ms     8 ms     8 ms  2a00:2000:2066::84
  9     9 ms     9 ms     9 ms  40ge1-3.core1.lon2.he.net [2001:7f8:4::1b1b:1]
 10    96 ms    91 ms    76 ms  100ge13-2.core1.nyc4.he.net [2001:470:0:2cf::2]
 11    76 ms    76 ms    76 ms  tunnelXXXXXX.tunnel.tserv4.nyc4.ipv6.he.net [2001:470:**06:****::1]

Trace complete.

C:\WINDOWS\system32>TRACERT 2001:470:**06:****::2

Tracing route to tunnelXXXXXX-pt.tunnel.tserv4.nyc4.ipv6.he.net [2001:470:**06:****::2]
over a maximum of 30 hops:

  1    <1 ms    <1 ms    <1 ms  broadband.bt.com [2a00:23c5:b39e:****:21d:****:****:****]
  2     5 ms     5 ms     5 ms  2a00:2302::1100:203:209
  3     *        9 ms     9 ms  2a00:2302::1102:100:32
  4    10 ms    10 ms    10 ms  2a00:2302::1102:100:33
  5    10 ms    10 ms    10 ms  2a00:2380:3014:8000::1e
  6    10 ms     *        *     core3-hu0-7-0-7.faraday.ukcore.bt.net [2a00:2380:c::338]
  7     *       10 ms     *     core4-l2.faraday.ukcore.bt.net [2a00:2380:3000:c::b]
  8     9 ms     9 ms     8 ms  2a00:2000:2066::84
  9    10 ms    10 ms    26 ms  40ge1-3.core1.lon2.he.net [2001:7f8:4::1b1b:1]
 10    76 ms    76 ms    76 ms  100ge13-2.core1.nyc4.he.net [2001:470:0:2cf::2]
 11    79 ms    78 ms    78 ms  tserv1.nyc4.he.net [2001:470:0:5d::2]
 12     *        *        *     Request timed out.
 13  ^C

C:\WINDOWS\system32>TRACERT 2001:470:**07:****::100

Tracing route to 2001:470:**07:****::2 over a maximum of 30 hops

  1    <1 ms    <1 ms    <1 ms  broadband.bt.com [2a00:23c5:b39e:****:21d:****:****:****]
  2     5 ms     5 ms     5 ms  2a00:2302::1100:203:209
  3     *        *        *     Request timed out.
  4    10 ms    11 ms    15 ms  2a00:2302::1102:100:3f
  5     9 ms    10 ms     9 ms  2a00:2380:3014:8000::12
  6     *        9 ms     *     core3-hu0-7-0-7.faraday.ukcore.bt.net [2a00:2380:c::338]
  7     *        *        *     Request timed out.
  8     8 ms     8 ms     8 ms  2a00:2000:2066::84
  9    31 ms     9 ms     9 ms  40ge1-3.core1.lon2.he.net [2001:7f8:4::1b1b:1]
 10    76 ms    76 ms    76 ms  100ge13-2.core1.nyc4.he.net [2001:470:0:2cf::2]
 11    78 ms    78 ms    78 ms  tserv1.nyc4.he.net [2001:470:0:5d::2]
 12     *        *        *     Request timed out.
 13  ^C

Surprised that the HE end of the tunnel 2001:470:**06:****::1 does not appear to be reached. Is there an issue with the routing or am I missing something.

Thanks

https://pastebin.com/UsDCfjpF

My zone based firewall config

Do you have "ipv6 unicast routing" enabled on your router?  (or something close to that)

"ipv6 unicast-routing"
Yes.

Do you have "ipv6 unicast routing" enabled on your router?  (or something close to that)

NASA#show ipv6 cef switching stati                                                                                                   
                                                                                                                                     
       Reason                          Drop       Punt  Punt2Host                                                                     
RP LES Packet destined for us             0       7398          0                                                                     
RP LES Bad hop, TTL expired               0        244          0                                                                     
RP LES Features                       47099          0          0                                                                     
RP LES Link-local source address          1       1612          0                                                                     
RP LES Neighbor resolution req           39          0          0                                                                     
RP LES Total                          47139       9254          0

still struggling

Hello everybody.

I would like to point out that I finally received my t-shirt.
It was sent on January 08, 2020 from SAN RAMON CA.
And I received it, in France, on January 17, 2020.
The price of mail is $5.
The t-shirt conforms to the photos I saw on google.

I am Happy !!! 

Cordially.
Artemus24.
@+

Update. I can also ping my tunnel ip from my dhcp hosts.