Configuring OpenWrt Backfire 10.03.1-rc4 for a static tunnel from SixXS to get IPv6 connectivity I was looking for information about configuring my router (originally Netgear WNDR3700) for supporting a static 6in4 tunnel from SixXS for getting the IPv6 connectivity. The router is currently running OpenWrt Backfire 10.03.1-rc4, published in November 2010, the rc4 version of the forthcoming Backfire Interim Release 1. Current OpenWrt Backfire 10.03.1-rc4 has an installable package for supporting the 6in4 tunnels, which should make the process relatively easy. However, finding the exactly correct configuration is not that easy. I found useful information in internet, but it was scattered around and to some extent also outdated or incomplete. I write this article to summarize my findings and to list my configuration as an example for others trying to do the same. Additionally, the rc4 version does not enable configuring some of the required steps through the Luci GUI, so some tasks have to be done by editing configuration files manually. Background assumptions: you have a "Static" 6in4 tunnel with a fixed tunnel endpoint from SixXS. You also have a subnet, which is routed through that tunnel. You also have installed the OpenWrt to the router. Main steps in the process: Configuring the tunnel Configuring iptables to make sure that the tunnel stays up Configuring IPv6 address autoconfiguration inside local LAN by using RADVD Configuring ipv6 firewall - ip6tables 1) Configuring the tunnel The main steps are explained pretty well in http://wiki.openwrt.org/doc/howto/ipv6 , which is mostly up-to-date. However, it does not discuss SixXS specific issues. First you need to make sure that the IPv6 support modules and the 6in4 tunnel module have been installed either by using Luci GUI or by running the following command: opkg install kmod-ipv6 radvd ip kmod-ip6tables ip6tables 6in4 The file '/etc/config/network' needs to be manually edited to include a new interface for the tunnel that will be called 'sixxs': (peeraddr is the remote PoP tunnel endpoint IPv4 address, ip6addr is the IPv6 tunnel endpoint address at your end, ipaddr is the router's IPv4 WAN address.) Additionally, the IPv6 address in the local subnet is added to the router's LAN interface either through Luci (Network/Interfaces/LAN) or by editing the file '/etc/config/network' : (ip6addr is the router's IPv6 address in the new local subnet.) Third step is to add the new 'sixxs' interface to the 'wan' zone of the firewall. Either use Luci (Network/Firewall/Zones) or edit '/etc/config/network' : Fourth task is to make sure that the following line in '/etc/sysctl.conf' is uncommented: net.ipv6.conf.all.forwarding=1 2) Making sure that the tunnel stays up - iptables SixXS pings the static tunnel every 30 minutes and the router needs to respond to that ping, otherwise the tunnel gets turned off. With the default iptables configuration, the router may forget the tunnel connection in the NAT table if there is no IPv6 traffic for a while. You have to make sure that the incoming IPv6 pings from SixXS get accepted even then. The suggested entry in the SixXS FAQ does not work properly in the OpenWRT 10.03.1-rc4 ( https://www.sixxs.net/faq/connectivity/?faq=conntracking ). Instead you need an iptables rule for enabling the IPv4 firewall to accept IPv6 connections (protocol 41) from the PoP tunnel endpoint even if they are not related to existing connections. Good discussion e.g. here: https://www.sixxs.net/forum/?msg=setup-2860037 The following line needs to be added to file '/etc/firewall.user' : In my case: iptables -I INPUT 1 -s 62.78.96.38 -p 41 -j ACCEPT Alternatively, you can add an accept rule through Luci (Network/Firewall/Traffic Control): add there a new advanced rule (you need to add the additional field for the source IPv4 address and set custom protocol as 41). 3) Configuring IPv6 address autoconfiguration inside local LAN by using RADVD As explained in http://wiki.openwrt.org/doc/howto/ipv6#radvd , the file ' /etc/config/radvd' is edited to contain the prefix for the local IPv6 subnet. Key fields there: See also: https://www.sixxs.net/wiki/Aiccu/Installing_on_OpenWRT#Kamikaze_2 To make sure that RADVD get started after the next reboot of the router, run the command: /etc/init.d/radvd enable You can also check from Luci (Services/Initscripts), that all services like RADVD are enabled so that they are started automatically afetr reboots. 4) Configuring ipv6 firewall - ip6tables Good overview in: https://www.sixxs.net/wiki/IPv6_Firewalling#Example_IPv6_firewall_script_.28with_state.29 Regarding ip6tables rules in the router, the key is to understand that the main configuration is related to the FORWARD chain that handles connectivity to clients in LAN, while INPUT and OUTPUT concern direct traffic to the router itself and remain mostly unused. INPUT and OUTPUT practically handle only the ICMPv6 traffic (at least the SixXS pings). Note: although you named the tunnel interface as just 'sixxs', it got automatically prefixed with '6in4-', so the name to be used in ip6tables rules is '6in4-sixxs'. The rules get set in file '/etc/firewall.user' that is edited manually. The FORWARD rules should allow all traffic with existing connections, new connections from inside and then selected connections from outside. I simplified the FORWARD rule regarding new connections from the version presented in Wiki (see below). Additionally my rules allow incoming packets to port 49001 to get accepted for forwarding to clients in local LAN. Key part: (See the full '/etc/firewall.user' below.) That is practically all the necessary steps to get a static 6in4 IPv6 tunnel from SixXS configured in OpenWrt Backfire 10.03.1-rc4. Finally you need to reboot the router to get it to read the configuration in and to start the tunnel. You might first test connectivity from router's command prompt, e.g. just ping ipv6.google.com from there. ------------------------- The full contents of '/etc/firewall.user' file: