IPv6 tunnel broker setup - ArchWiki

Jump to content

# IPv6 tunnel broker setup

From ArchWiki

This article introduces a method for obtaining an IPv6 address using 6in4, also known as SIT.

The following sections will use the tunnel service provided by Hurricane Electric as a setup example. Hurricane Electric offers a free tunnel broker service to add IPv6 connectivity to an IPv4-only host. Read the "Tunnel Broker" section of their FAQ for a list of prerequisites.

## Registering for a tunnel

Registering for a tunnel on its website.

## Setting up Hurricane Electric tunnel

There is some ways you can achieve this, such as using the ip command to test the tunnel manually, a custom systemd unit, or using a network manager like #systemd-networkd.

### Custom systemd unit

Create the following systemd unit, replacing bold text with the IP addresses you got from Hurricane Electric:

Note If you are behind a NAT (typical home router setup), use your local IPv4 address for `client_IPv4_address`, e.g. `192.168.0.2`.

    /etc/systemd/system/he-ipv6.service

    [Unit]
    Description=he.net IPv6 tunnel
    After=network.target

    [Service]
    Type=oneshot
    RemainAfterExit=yes
    ExecStart=/usr/bin/ip tunnel add he-ipv6 mode sit remote server_IPv4_address local client_IPv4_address ttl 255
    ExecStart=/usr/bin/ip link set he-ipv6 up mtu 1480
    ExecStart=/usr/bin/ip addr add client_IPv6_address dev he-ipv6
    ExecStart=/usr/bin/ip -6 route add ::/0 dev he-ipv6
    ExecStop=/usr/bin/ip -6 route del ::/0 dev he-ipv6
    ExecStop=/usr/bin/ip link set he-ipv6 down
    ExecStop=/usr/bin/ip tunnel del he-ipv6

    [Install]
    WantedBy=multi-user.target

Then start/enable `he-ipv6.service`.

Tip To test you can run the above commands following `ExecStart` manually to setup a temporary tunnel. It will not persist after reboot.

### systemd-networkd

If systemd-networkd handles your network connections, it is probably a better idea to let it handle tunnel broker too (instead of using a .service file).

    /etc/systemd/network/he-tunnel.netdev

    [Match]

    [NetDev]
    Name=he-ipv6
    Kind=sit
    MTUBytes=1480

    [Tunnel]
    # IPv6 Tunnel Endpoints|Server IPv4 Address
    Remote=216.66.80.30
    # Local IPv4 | NAT-Address
    Local=192.168.0.2
    TTL=255

    /etc/systemd/network/he-tunnel.network

    [Match]
    Name=he-ipv6

    [Network]
    # IPv6 Tunnel Endpoints|Client IPv6 Address>/64
    Address=2001:470:NNNN:NNNN::2/64
    # IPv6 Tunnel Endpoints|Server IPv6 Address
    Gateway=2001:470:NNNN:NNNN::1
    DNS=2001:4860:4860::8888
    DNS=2001:4860:4860::8844

    [Route]
    # IPv6 Tunnel Endpoints|Server IPv6 Address
    Gateway=2001:470:NNNN:NNNN::1
    Destination=::/0

    [RoutingPolicyRule]
    # IPv6 Tunnel Endpoints|Client IPv6 Address>/64
    From=2001:470:NNNN:NNNN::2/64

    [RoutingPolicyRule]
    # Routed IPv6 Prefixes|Routed 64>/64 - OR - Routed IPv6 Prefixes|Routed 48>/48
    From=2001:470:NNNN::/48

Replace all NNNN to your own address.

And, add this line to `[Network]` section of your default Internet connection .network file:

    /etc/systemd/network/DEVICE.network

    Tunnel=he-ipv6

## Using the tunneling with dynamic IPv4 IP

### Updating via cron job

The simplest way of using tunnelling with a dynamic IPv4 IP is to set up a cron job that is going to periodically update your current address. The example URL and an Update Key can be found in the Advanced tab of the Tunnel Details page.

To check if the update works, run the following command (replace `USERNAME`, `UPDATEKEY` and `TUNNELID` by the details of your account and tunnel):

    $ wget -O - https://USERNAME:UPDATEKEY@ipv4.tunnelbroker.net/nic/update?hostname=TUNNELID

If it works, create a cron job by opening `crontab -e` and adding a new line:

    */10 * * * * wget -q -O /dev/null https://USERNAME:UPDATEKEY@ipv4.tunnelbroker.net/nic/update?hostname=TUNNELID

### Updating via ddclient

Alternatively this can be configured by installing ddclient and configuring `/etc/ddclient.conf`:

    protocol=dyndns2
    use=web
    web=checkip.dns.he.net
    server=ipv4.tunnelbroker.net
    ssl=yes
    login=USERNAME
    password=UPDATEKEY
    TUNNELID

And finally start/enable `ddclient.service`.

## See also

- Wikipedia:6in4

Category:

- Networking

IPv6 tunnel broker setup
Add topic