ipv6 and vpn client issues

[amoney]

Hi All

Router: RT-AC88U, Firmware: Merlin 384.9

I am running into an issue with IPV6 and vpn client. Followed the following guide to setup my router.

My policy rules (strict) are setup to send 192.168.1.0/24 to VPN.

When i have ipv6 setup as native. VPN client is up and running but none of my clients end up going through the vpn. I used am.i.mullvad.net to determine if i was conncted. It showed an ipv6 IP as the ip connected on the page. Do the policy rules have to change for ipv6?

If i change ipv6 setup to passthrough all clients do end up going through vpn. The page above shows client is connected to vpn and ipv4 ip shows up on that page.

So i am not sure what is the correct/appropriate setup for ipv6. For now i have disabled ipv6 completely.

Here is my vpn client conf

client
dev tun
proto udp




remote us-ca.mullvad.net 1196


cipher AES-256-CBC
resolv-retry infinite
nobind
persist-key
persist-tun
verb 3
remote-cert-tls server
ping 10
ping-restart 60
sndbuf 524288
rcvbuf 524288

fast-io



auth-user-pass
reneg-sec 0
tun-ipv6
<ca>
-----BEGIN CERTIFICATE-----
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
-----END CERTIFICATE-----
</ca>





tls-cipher TLS-DHE-RSA-WITH-AES-256-GCM-SHA384:TLS-DHE-RSA-WITH-AES-256-CBC-SHA

Any suggestions/recommendations on how should ipv6 native + vpn client work?

 

[RMerlin]

Asuswrt's OpenVPN implementation does not support IPv6 tunnels.

Also check your System Log for any error message.

 

[amoney]

Asuswrt's OpenVPN implementation does not support IPv6 tunnels.

Also check your System Log for any error message.

Will do. In this case should the vpn client fail to come up or will it not follow the policy rules?

 

[RMerlin]

Will do. In this case should the vpn client fail to come up or will it not follow the policy rules?

If you enabled the option to block Internet traffic while the tunnel is down then it could explain your problem.

 

[amoney]

If you enabled the option to block Internet traffic while the tunnel is down then it could explain your problem.

Yes that option is enabled but traffic was never blocked.

IPv6 = Native, VPN Client is up but none of the clients connected are going through the VPN
IPv6 = passthrough, VPN Client is up and all the clients are going through the VPN.

For both these my vpn client config did not change. My assumption is that tun-ipv6 option means that the it would be an ipv6 tunnel.

 

[john9527]

https://www.snbforums.com/threads/turning-on-vpn-disables-native-ipv6.37028/#post-471247

 

[amoney]

Ah thats good to know.

I did some more debugging on my end. I enabled ipv6 native and added tun-ipv6 in vpn client.

On the router if i issue

curl -s --interface tun11 http://ipv4.icanhazip.com/

It goes through the VPN. My raspberry pi is still going thorugh the VPN. However my mac and and android phone are not.

I dont see any related messages in syslog that might shed a light as to what might have happened.