Trouble with LCX and ipv6

[phil89]

Hello,

Short background: I currently have an npmplus running on docker inside a VM, which works perfectly. Now I'm trying to migrate the npmplus inside a LCX to make it independent from the VM.
But I have trouble with the ipv6 connection and cant't find out why. I need ipv6, as I have a dslite ISP.

IP configuration of my pve host:

auto lo
iface lo inet loopback

iface nic0 inet manual

auto vmbr0
iface vmbr0 inet static
        address 172.27.26.10/23
        gateway 172.27.26.1
        bridge-ports nic0
        bridge-stp off
        bridge-fd 0

iface vmbr0 inet6 dhcp
        autoconf 1
        accept_ra 2

Here it all works, I can access pve over ipv6 and can ping LAN and external addresses (like google.com).
So far so good.

The LCX runs a apline linux with docker. In the GUI under "Network, I see ipv6 addresses:


In the IP configuration of the LCX, I put

auto lo
iface lo inet loopback
iface lo inet6 loopback

auto eth0
iface eth0 inet static
        address 172.27.26.12/23
        gateway 172.27.26.1

and set
sysctl net.ipv6.conf.eth0.autoconf=1
sysctl net.ipv6.conf.eth0.accept_ra=1
which seems the way to go for alpine [https://www.krython.com/post/configuring-ipv6-networking].

I also have an ipv6 address:

NPMplus:~# ip -6 addr show
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 state UNKNOWN qlen 1000
    inet6 ::1/128 scope host
       valid_lft forever preferred_lft forever
2: eth0@if20: <BROADCAST,MULTICAST,UP,LOWER_UP,M-DOWN> mtu 1500 state UP qlen 1000
    inet6 fdf6:xxxx:xxxx:x:xxxx:xxxx:xxxx:a2d2/64 scope global dynamic flags 100
       valid_lft 5358sec preferred_lft 1758sec
    inet6 2a02:xxx:xxxx:xxxx:xxxx:xxxx:xxxx:a2d2/64 scope global dynamic flags 100
       valid_lft 5358sec preferred_lft 1758sec
    inet6 fe80::xxxx:xxxx:xxxx:a2d2/64 scope link
       valid_lft forever preferred_lft forever
3: docker0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 state DOWN
    inet6 2001:db8:1::1/64 scope global flags 02
       valid_lft forever preferred_lft forever

and I can also reach the npmplus instance by this address.

BUT:
I can only reach it in LAN, not from outside.
Inside the LCX, I can ping hosts inside my LAN, but not outside:

NPMplus:~# ping -c 2 -6 fritz.box
PING fritz.box (2a02:560:xxxx:xxxx:xxxx:xxxx:xxxx:37c4): 56 data bytes
64 bytes from 2a02:560:xxxx:xxxx:xxxx:xxxx:xxxx:37c4: seq=0 ttl=64 time=1.300 ms
64 bytes from 2a02:560:xxxx:xxxx:xxxx:xxxx:xxxx:37c4: seq=1 ttl=64 time=0.593 ms

NPMplus:~# ping -c 2 -6 google.com
PING google.com (2a00:1450:4001:81e::200e): 56 data bytes
ping: sendto: Network unreachable

I am also not able to create TLS certificates via certbot - of course, as the server is not reachable by letsencrypt.

So it seems like the lcx is not able to communicate outside the LAN.
Ports in my router are opened.

Any idea how to proceed and find the problem?

Thank you in advance and best regards,
Phil

edit: posted the whole ip config, incl. ip4, as it may be also interesting.

 

[ggoller]

Hi!
could you paste the lxc configuration cat /etc/pve/lxc/<vmid>.conf? Do you have ipv6 forwarding enabled on the lxc container? How do your routes look like: ip -6 route?

 

[phil89]

Sure:

root@pve:~# cat /etc/pve/lxc/200.conf
arch: amd64
cores: 1
features: nesting=1
hostname: NPMplus
memory: 512
net0: name=eth0,bridge=vmbr0,firewall=1,gw=172.27.26.1,hwaddr=BC:XX:XX:XX:67:8A,ip=172.27.26.12/23,ip6=auto,type=veth
ostype: alpine
rootfs: local-zfs:subvol-200-disk-0,size=3G
swap: 512
unprivileged: 1

NPMplus:~# ip -6 route
2a02:560:XXXX:XXXX::/64 dev eth0  metric 256  expires 0sec
fdf6:XXXX:XXXX::/64 dev eth0  metric 256  expires 0sec
fe80::/64 dev eth0  metric 256
default via fe80::XXXX:XXX:XXXX:37c4 dev eth0  metric 1024  expires 0sec

Do you have ipv6 forwarding enabled on the lxc container?

You mean in my router? Yes, I opened ports to the LCX (ipv6 address ending with a2d2).

 

[ggoller]

You mean in my router? Yes, I opened ports to the LCX (ipv6 address ending with a2d2).

no, on the proxmox ve host. So try sysctl net.ipv6.conf.all.forwarding=1. If this works you can make it permanent by creating a file at /etc/sysctl.d/.

 

[phil89]

That was the point. With forwarding=1, it works now.
Thank you a lot!