This is a user-space IPv6 tunnel with ip6tables-compatible user-space firewall that runs on OpenVZ/Virtuozzo guests. The project is a continuation of Luca Bertoncello's ustun (http://www.lucabert.de/ipv6/?lang=en) with some improvements including:
- Ability to run and control multiple tunnel instances on a single host
- Stateful firewall shared across all running tunnels, aiming to be fully compatible with ip6tables (WIP)
Config files allowing to run stateful ufw-based firewall on OpenVZ/Virtuozzo guests are in ufw folder, together with a script emulating ip6tables-restore functionality.
To use the tunnel and firewall (with UFW on Ubuntu):
- make
- copy ustun, usctrl, us6tables and ufw/us6tables-restore to /usr/local/sbin
- relink /sbin/ip6tables to /usr/local/sbin/us6tables
- relink /sbin/ip6tables-restore to /usr/local/sbin/us6tables-restore
- relink /sbin/ip6tables-save to /bin/true - WARNING - this will disable ip6tables-save as ufw does not require it
- backup after6.rules and before6.rules in /etc/ufw
- copy after6.rules and before6.rules to /etc/ufw
- disable ufw logging (sudo ufw logging off) - ip6tables -m limit is not supported yet
NOTE: Some of the rules have slightly different syntax. See /usr/local/sbin/us6tables-restore for info on how ip6tables rules are rewritten.
To create tunnel interface add the following to /etc/network/interfaces:
iface NAME_CHANGEME inet6 static
address IPv6_ADDR_CHANGEME
netmask NETMASK_CHANGEME
pre-up /usr/local/sbin/ustun -n NAME_CHANGEME -r REMOTE_END -l LOCAL_END -m tunnelbroker -p /run/ustun-NAME_CHANGEME.pid
post-up /sbin/ip -6 addr add MORE_IPs_CHANGEME dev NAME_CHANGEME
pre-down /sbin/ip -6 addr del MORE_IPs_CHANGEME dev NAME_CHANGEME
post-up /sbin/ip -6 route add ::/0 dev NAME_CHANGEME
post-down /bin/kill `cat /run/ustun-NAME_CHANGEME.pid` > /dev/null 2>&1 || /bin/true
mtu 1480
WARNING: Most OpenVZ/Virtuozzo hosts overwrite /etc/network/interfaces upon reboot. It's best to put your tunnel interface into /etc/network/interfaces.ipv6 and add the following to /etc/rc.local:
cat /etc/network/interfaces.ipv6 >> /etc/network/interfaces
ifup NAME_CHANGEME
NOTE: You can have multiple tunnels running. They will share the firewall rules, but can be controlled via usctrl separately.
To get info about your tunnel, use:
usctrl -p `cat /run/ustun-NAME_CHANGEME.pid` -i
Providing PID (option -p or --pid) to usctrl is mandatory!