The article describes how to configure a 6in4 service using your own VPS host. Tunnelling is done using protocol 41 which encapsulates IPv6 inside IPv4.
Unfortunately my broadband provider does not offer IPv6. To work around that I tunnel to my VPS host over IPv4 and use IPv6 that way. I could use a tunnel broker such as Hurricane Electric, however their closest endpoint is far enough away that the additional latency makes it a pretty unattractive option. My VPS provider is close enough that latency over the tunnel is actually not much different to native IPv4!
For this example, the VPS host public IP is
x.x.x.x and the home broadband public IP is
My VPS has allocated a /56 prefix to my host -
aaaa:bbbb:cccc:5b00::/56. From that I’m going to sub allocate
aaaa:bbbb:cccc:5b10::/60 to the tunnel, as follows:
aaaa:bbbb:cccc:5b10::b/127- each end of the tunnel
aaaa:bbbb:cccc:5b11::/64- subnet for use on the home network
# Create sit interface 'sittun' ip tunnel add sittun mode sit local x.x.x.x remote y.y.y.y ttl 64 dev eth0 # Allocate an IPv6 address to the local end (remote end will be ::b) ip addr add dev sittun aaaa:bbbb:cccc:5b10::a/127 # Route a /64 prefix down the tunnel for use on the home network ip -6 route add aaaa:bbbb:cccc:5b11::/64 via aaaa:bbbb:cccc:5b10::b # Bring the interface up ip link set dev sittun up
ip tunnel add sittun mode sit local y.y.y.y remote x.x.x.x ttl 64 dev enp1s0 ip adddr add dev sittun aaaa:bbbb:cccc:5b10::b/127 # VPS host IP is the default route for all IPv6 traffic ip -6 route add default via aaaa:bbbb:cccc:5b10::a ip link set dev sittun up
If the router does not have a public IP (behind a NAT device), then it is necessary to specify the private IP for the local end rather than the public IP e.g.
ip tunnel add sittun mode sit local 192.168.0.8 remote x.x.x.x ttl 64 dev enp1s0The NAT device will then need to forward 6in4 traffic to
Firewalling / Routing
The VPS host needs to have routing enabled for IPv6:
sysctl -w net.ipv6.conf.all.forwarding=1 sysctl -w net.ipv6.conf.eth0.accept_ra=2
The second command is required if eth0 has a SLAAC assigned IP (most likely).
The VPS host needs to allow protocol 41 packets from the client IP. The following iptables command will do:
iptables -I INPUT -p 41 -s y.y.y.y -j ACCEPT
The following rules are required in the ip6tables
FORWARD chain to permit connectivity between the home network and the Internet:
ip6tables -I FORWARD -i sittun -j ACCEPT ip6tables -I FORWARD -o sittun -j ACCEPT
We need v6 ip forwarding:
sysctl -w net.ipv6.conf.all.forwarding=1
Allow protocol 41 from our VPS host:
iptables -I INPUT -p 41 -s x.x.x.x -j ACCEPT
The home network needs some basic firewall rules to protect it from unrestricted access from the IPv6 Internet. The following is a suggested minimal ruleset:
# Allow return traffic from the internet iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT # ICMPv6 is required for IPv6 to operate properly iptables -A FORWARD -p ipv6-icmp -j ACCEPT # Allow all from your LAN interface iptables -A FORWARD -i <lan interface> -j ACCEPT # Reject all else iptables -A FORWARD -j REJECT --reject-with icmp6-adm-prohibited