If your hosting provider gives out an entire /48 for every hosted server, your syslog may get overwhelmed with messages concerning the subnet mask:

1 Time(s): [705959.619704] IPv6 addrconf: prefix with wrong length 48

To solve this temporarily you can disable auto-configuration and router advertisements:

echo 0 > /proc/sys/net/ipv6/conf/eth0/accept_ra
echo 0 > /proc/sys/net/ipv6/conf/eth0/autoconf

This seems to suppress the annoying log messages on my Ubuntu based environment. If you would like to make this persistent through reboots, add the following lines to /etc/sysctl.conf:

net.ipv6.conf.all.accept_ra = 0
net.ipv6.conf.all.autoconf = 0

IPv6, Linux, Networking IPv6, Linux, Networking, Ubuntu

Arch Linux uses a BSD-style network interface configuration located in /etc/rc.conf, which can make exotic network configurations interesting, to say the least. The following rc.d script is meant to help remedy the situation by providing a configurable wrapper to sanely manage a 6in4 link interface.

• This script uses the route2 method; make sure that the iproute2 package is installed.

As root, write the following rc.d init script to /etc/rc.d/6in4-tunnel:

#!/bin/bash

### begin user configuration

##############################################
#                                            #
#  Stop this script before you reconfigure!  #
#                                            #
##############################################

# if_name     - interface name that is to be created for the 6in4 link
if_name=6in4

# server_ipv4 - ipv4 address of the server that is providing the 6in4 tunnel
server_ipv4=127.0.0.1

# client_ipv4 - ipv4 address of the client that is receiving the 6in4 tunnel
client_ipv4=127.0.0.1

# client_ipv6 - ipv6 address of the client 6in4 tunnel endpoint
client_ipv6=2001:feed:face:beef::2/64

# link_mtu    - set the mtu for the 6in4 link
link_mtu=1480

# tunnel_ttl  - set the ttl for the 6in4 tunnel
tunnel_ttl=64

### end user configuration

daemon_name=6in4-tunnel

. /etc/rc.conf
. /etc/rc.d/functions

case "$1" in
  start)
    stat_busy "Starting $daemon_name daemon"

    ifconfig $if_name &>/dev/null
    if [ $? -eq 0 ]; then
      stat_busy "Interface $if_name already exists"
      stat_fail
      exit 1
    fi

    ip tunnel add $if_name mode sit remote $server_ipv4 local $client_ipv4 ttl $tunnel_ttl
    ip link set $if_name up mtu $link_mtu
    ip addr add $client_ipv6 dev $if_name
    ip route add ::/0 dev $if_name

    add_daemon $daemon_name
    stat_done
    ;;

  stop)
    stat_busy "Stopping $daemon_name daemon"

    ifconfig $if_name &>/dev/null
    if [ $? -ne 0 ]; then
      stat_busy "Interface $if_name does not exist"
      stat_fail
      exit 1
    fi

    ip link set $if_name down
    ip tunnel del $if_name

    rm_daemon $daemon_name
    stat_done
    ;;

  *)
    echo "usage: $0 {start|stop}"
esac
exit 0

You will need to provide your 6in4 link configuration between the following sections of /etc/rc.d/6in4-tunnel:

### begin user configuration

### end user configuration

Once /etc/rc.d/6in4-tunnel has been configured properly, give it permission to be executed:

# chmod +x /etc/rc.d/6in4-tunnel

To create the 6in4 tunnel link and bring up the interface:

# /etc/rc.d/6in4-tunnel start

To delete the 6in4 tunnel link and remove the interface:

# /etc/rc.d/6in4-tunnel stop

The following method allows /etc/rc.d/6in4-tunnel to start automatically at system startup.

• Verify that the 6in4 tunnel link is configured and working properly before doing this!

As root, insert 6in4-tunnel right after network in the DAEMONS line of /etc/rc.conf.

After this addition, the DAEMONS line in /etc/rc.conf should look something like this:

...

#
# -----------------------------------------------------------------------
# DAEMONS
# -----------------------------------------------------------------------
#
# Daemons to start at boot-up (in this order)
#   - prefix a daemon with a ! to disable it
#   - prefix a daemon with a @ to start it up in the background
#
DAEMONS=(syslog-ng iptables ip6tables network 6in4-tunnel openntpd ...

...

IPv6, Linux, Networking 6in4, IPv6, Linux, Networking

Here is an easy way to make use of IPv4 GRE tunnels in Ubuntu, or any other Debian based distro. You will need to edit /etc/network/interfaces.

Here is a template with the information you will need to add:

auto tun1
iface tun1 inet static
    address <tunnel IP>
    netmask <tunnel subnet mask>
    pre-up iptunnel add tun1 mode gre local <local IP> remote <remote IP> ttl 255
    up ifconfig tun1 multicast
    pointopoint <remote tunnel IP>
    post-down iptunnel del tun1

As with the previous post about 6in4 tunnels in Ubuntu, lets take a brief look at each line.

auto tun1 is used by the /etc/init.d/networking script. Just like the 6in4 tunnel, the auto parameter will instruct the script to automatically start or stop the interface. The script will get called during startup and will bring up this interface automatically. This line is entirely optional and depends on your personal preference.

iface tun1 inet static starts the configuration block for a new IPv4 interface. This is the interface of the tunnel we are about to create that will encapsulate traffic destined for the other side of the tunnel.

address <tunnel IP> is the IP address you wish to assign to this machine’s side of the GRE tunnel.

netmask <tunnel subnet mask> is the subnet mask of the tunnel. I highly suggest using a 255.255.255.252 subnet mask as this tunnel will be point-to-point and there is no reason to waste address space, even if it is private addressing. If you are unfamiliar with how subnet masks are used, please refer to Subnetwork on Wikipedia.

pre-up iptunnel add tun1 mode gre local <local IP> remote <remote IP> ttl 255 – The pre-up parameter tells the init script to run the iptunnel command prior to bringing up the interface. This is where we are actually creating the tunnel and telling it to use GRE mode. <local IP> is this machine’s IP address of an interface on which you want to run this tunnel. For example, if eth0 had the address of 71.31.47.23, you could set the local IP address above to that address in order to have this tunnel use eth0. <remote IP> is the global IP address where the other side of the tunnel exists.

up ifconfig tun1 multicast – The up parameter tells the init script to run ifconfig tun1 multicast once the interface is up. In this case, we are enabling multicast on this interface. This is particularly useful if you wish to run a routing protocol over this tunnel, such as OSPF.

pointopoint <remote tunnel IP> – The remote IP here is the IP address of the other side of the GRE tunnel. For example, if your side of the tunnel is 172.31.10.1 and their side is 172.31.10.2, then 172.31.10.2 would be the IP address to specify here.

post-down iptunnel del tun1 – Just like pre-up, post-down tells the init script to run this command after the interface has been shutdown. In this case, we are deleting the tunnel we created earlier with the pre-up command.

As with the with the 6in4 tunnel, you can name this tunnel interface something that is more meaningful than tun1.

Linux, Networking GRE, IPv4, Linux, Networking, Tunnels, Ubuntu

The simplest way to create a static 6in4 tunnel in Ubuntu, or any other Debian based distro, is to edit /etc/network/interfaces.

Here is a template with the information you will need to add:

auto tun1
iface tun1 inet6 v4tunnel
        address <your IPv6 address>
        netmask 64
        ttl 64
        endpoint <remote IPv4 tunnel address>
        up ip link set mtu 1280 dev tun1
        up ip route add 2000::/3 dev tun1

Lets take a brief look at what each line does.

auto tun1 is used by the /etc/init.d/networking script. The auto parameter will instruct the script to automatically start or stop the interface. The script will get called during startup and will bring up this interface automatically. This line is entirely optional and depends on your personal preference.

iface tun1 inet6 v4tunnel starts the configuration block for a 6in4 tunnel. That is, IPv6 traffic encapsulated in IPv4 packets. This is extremely similar to how GRE works with purely IPv4 traffic.

address <your IPv6 address> is where you need to specify the IPv6 address assigned to your machine. This is typically ends in ::2.

netmask 64 specifies the subnet mask for the IPv6 address you entered above. 64 is the smallest recommended subnet (see RFC3627 for why they no longer use numbers such as 127). 64 is what you should normally expect to use.

ttl 64 specifies the Time to Live value set for packets sent by your tunnel endpoint. This only affects the IPv4 packet that is used to encapsulate your v6 traffic. It does not change the original IPv6 packet. Time to Live is a number of iterations a packet can live through before it should be discarded. This number is reduced by one on every router it passes enroute to its destination. 64 is used here because it restricts the packet to roughly the same region.

Here is a quick break down of default TTL values:

• 0 – restricted to same host
• 1 – restricted to same subnet
• 32 – restricted to same site
• 64 – restricted to same region
• 128 – restricted to same continent
• 255 – unrestricted

endpoint <remote IPv4 tunnel address> is the IPv4 address to send encapsulated IPv6 traffic to. Your IPv6 provider will provide you with their IPv4 tunnel endpoint address.

up ip link set mtu 1280 dev tun1. This statement reconfigures the interface from the default MTU to 1280 bytes. This is desirable to prevent fragmentation because of the IPv6 packet being encapsulated in an IPv4 packet.
NOTE: SixXS seems to use 1280 as their default for tunnels, other providers likely use 1480 (which is default). If you leave this line out of your configuration, it should default to 1480.

up ip route add 2000::/3 dev tun1. This last statement adds a default route for all IPv6 traffic to be sent through device tun1 which in turn would be encapsulated in an IPv4 packet and sent to the endpoint address of your IPv6 provider which would send it on its way through the IPv6 network.

After you have saved the file, the next step is to up the interface using ifup tun1 or if you decided to put in the auto tun1 line you can restart your networking services using the init script: /etc/init.d/networking restart.

One final note. You can name this tunnel interface anything you want. For example, every time tun1 was used above it could have been replaced with something more meaningful. For example, in SIXXS documentation, they usually call the interface sixxs.

IPv6, Linux 6in4, IPv6, Linux, Networking, Ubuntu

To create a self-signed certificate for use with a webserver such as Apache follow the following steps:

Generate a server key:

openssl genrsa -aes128 -out server.key 4096

Next, create a certificate signing request with it. This will prompt for several things such as country, state, etc. Make certain that “Common Name (eg, YOUR name)” matches the fully qualified domain name of your server (or IP address if you do not have one). You may create a challenge password at this point, however it will mean more typing for you.

Create the certificate signing requests:

openssl req -new -key server.key -out server.csr

Next, sign the certificate signing request. The following example expires the key in 365 days:

openssl x509 -req -days 365 -in server.csr -signkey server.key -out server.crt

Now, make a version of the server.key which does not require a password:

openssl rsa -in server.key -out server.key.insecure
mv server.key server.key.secure
mv server.key.insecure server.key

Be careful with these files as they are quite sensitive and permissions should set very carefully. Chown them to root (if you are not already root). Some of the sites I have found say that you can chmod 000 them and it does seem to work in my experiments. Root always retains an effective 600 (read) rights on everything.

You now have the following files which are suitable for use on your self-signed certificate site:

server.crt: The self-signed server certificate
server.csr: Server certificate signing request
server.key: The private server key
            (does not require a password when starting Apache
server.key.secure: The private server key
            (it will require a password when starting Apache)

NOTE: These instructions have been paraphrased for my use. The original site can be found here.

Linux Apache, Linux, SSL

To make use of IEEE 802.1Q VLAN tagging capabilities in Ubuntu you must first install the user mode programs for Virtual LAN support:

sudo apt-get install vlan

Next the 8021q kernel module must be loaded to enable VLAN support on a kernel level:

sudo modprobe 8021q

A quick review of lsmod will ensure the kernel module was loaded:

lsmod | grep 8021q

The output of the command should look similar to this:

8021q                  26896  0

Next we can create a tagged interface in /etc/network/interfaces. The following example configures eth1 for VLAN 10 to use DHCP to obtain its IP address:

iface eth1.10 inet dhcp

The new VLAN 10 interface can now be initialized using:

ifup eth1.10

The usual nomenclature for making your interface come up automatically during the boot process is the same for your existing interfaces, just use eth1.10.

Once the interface is initialized you may want to refer to the following proc locations for configuration information:

/proc/net/vlan/config
/proc/net/vlan/[vlan-device]

Linux, Networking 802.1Q, Linux, Ubuntu, VLAN