WIP: Streisand IPv6 support #1471

alimakki · 2018-10-21T16:47:34Z

Adds IPv6 support to all of the provided VPNs Streisand has to offer.
Based off of PR #1361 by @nopdotcom

clenga · 2018-11-09T20:52:10Z

ok so last night i ran into an issue that i will try to explain as best as possible. Yesterday i created a new linode because the original had been deleted for overdue balance. I booted a new linode and used a saved disk image to restore my original VPS config. I found the /streisand folder within and went through the procedure to generate a new localhost.html doc... heres where the problem happened. Although my linode settings were saved, the IP address changed for this linode... so the generated doc shows the new IP ADDRESS but in fact when i pulled up the localhost.html and tried downloading the certificate to access the nginx user profiles, the old IP address is imbedded in the certificate, causing my web browser to block me from proceeding forward... im sure if i just reinstall the ipv6 streisand fork this would fix the problem, but maybe there is another solution so that if a users VPS ip address changes, then streisand will clear out any old addresses from previous configs

clenga · 2018-11-09T22:16:33Z

Also, i just did an updated clone of the ipv6 branch, and im back at the nginx user instructions, and when i select to login via the ipv6 captive portal the browser gives me this... https://drive.google.com/file/d/17IxOPctRQSboRNQvshxnPKEeVWzYlnbY/view?usp=drivesdk

clenga · 2018-11-09T22:19:47Z

as you can see in this next screenshot, the ipv4 nginx url, brings me to a captive portal no issue . https://drive.google.com/file/d/1ZwD0dqG0nF0ekM_4eAzntS92tOpPQgP1/view?usp=drivesdk

although this is minor and a user can select the advanced option to proceed anyway, i figured ide point it out. Ill continue messing around and reporting any other needed adjustments. Besides this , it seems that your ipv6 branch @alimakki runs VERY smooth and efficient during the command line setup, much improved from when i originally started using streisand back in 2016

alimakki · 2018-11-13T13:42:21Z

@clenga thank you for the very detailed feedback. As you have experienced, it is not possible to copy and paste a streisand install from one machine to another, as distinct ssl certificates are generated for the streisand host in question and are not portable; if they did somehow work that would be a cause of concern. Your best best is to re-deploy to a new server.

Also, i just did an updated clone of the ipv6 branch, and im back at the nginx user instructions, and when i select to login via the ipv6 captive portal the browser gives me this... https://drive.google.com/file/d/17IxOPctRQSboRNQvshxnPKEeVWzYlnbY/view?usp=drivesdk

The IPv6 address could be missing from the gateway certificate's SANs, thanks for pointing that out, it should be easily addressable.

clenga · 2018-11-16T19:24:58Z

ok so ive been continuing testing with the ipv6 branch @alimakki, and one of the websites that i use to test quality of the ipv6 connection stated this..

"Danger! IPv6 sorta works - however, large packets appear to fail, giving the appearance of a broken website. If a publisher publishes to IPv6, you will believe their web site to be broken. Ask your ISP about MTU issues; possibly with your tunnel. Check your firewall to make sure that ICMPv6 messages are allowed (in particular, Type 2 or Packet Too Big"

maybe this is a specific issue with linodes ipv6 or maybe this is simply fixed by adjusting ipv6 firewall rules within my VPS ... honestly im not sure because im still new to ipv6... but let me know what you think

alimakki · 2018-11-17T15:38:55Z

@clenga could you share the the site you used which gave the danger message?

nopdotcom · 2018-11-17T17:33:32Z

I don't think we're doing anything that will break Path MTU Discovery. See http://test-ipv6.com/faq_pmtud.html for a technical explanation.

clenga · 2018-11-17T17:37:59Z

@alimakki the url that @nopdotcom listed above^^ is the site that gave me that message... i will run another test and screenshot the results so you can see what i see... again, im new to ipv6 so this problem may not be with streisand but rather linode

clenga · 2018-11-17T17:45:30Z

heres the test results so you can see what I see...
https://drive.google.com/file/d/1GRoxM8jSpPI1TppcclCHXP4BzmPk95Qj/view?usp=drivesdk

clenga · 2018-11-17T17:58:23Z

im currently running the following setup:
~Galaxy S9 9.0 Pie Beta ZRK1 build
*T-Mobile US LTE
~OpenVPN by Arne ipv4/ipv6 dual stack config
*Tested dual stack ipv4/ipv6 with HTTP
tinyproxy (successfully)
~Ubuntu 16.04 LTS Linode VPS
~Connectivity to various URLs and Apps
(successfull)

Im going to try proxy.sh security check tool next and see what is produced

nopdotcom · 2019-03-16T20:25:04Z

I don't think we should block this PR on it, but It Might Be Nice someday to generate, for example, WireGuard profiles that specify the server's IPv6 address as the VPN endpoint.

nopdotcom

Nothing major. Remaining work:

We have to get rid of 2001:db8::. That's a documentation-only prefix, and will cause confusion. I don't think this is mergeable without that change.
I added the notion of a "service" network at 10.10.10.10, for stuff all authenticated users should be able to get at. Should we create a similar fixed ULA for IPv6? fd10:1010:10::/64?
Aside from well-known addresses, it's generally considered bad form to hard-wire ULAs. Although there's an official way to generate them, OpenWrt just grabs some bits out of /dev/urandom and calls it a day.

Not sure how much time I have to work on this right now, but since I've been running this a bunch of places, I'd like to get it into mainline.

nopdotcom · 2019-09-16T19:24:07Z

playbooks/roles/openconnect/templates/ocserv-ipv6tables.service.j2

+ExecStart=/sbin/{{ ocserv_firewall_rule_v6 }}
+
+[Install]
+WantedBy=multi-user.target


Missing a trailing newline.

nopdotcom · 2019-09-16T19:32:01Z

playbooks/roles/openconnect/templates/config.j2

+{% for item in upstream_dns_servers_v6 %}
+dns = {{ item }}
+{% endfor %}
+ipv6-subnet-prefix = 64


Would using ipaddr, make life easier here? {{ ocserv_ipv6_network | ipaddr('prefix') }}

nopdotcom · 2019-09-16T19:35:14Z

playbooks/roles/openconnect/vars/main.yml

+ocserv_firewall_rule_v6: "ip6tables --wait {{ streisand_iptables_wait }} -t nat -A POSTROUTING -j MASQUERADE"
+
+ocserv_ipv4_network: "192.168.1.0/24"
+ocserv_ipv6_network: "fda9:4efe:7e3b:03ea::/48"


Ideally, we should generate a ULA per Streisand system. For ocserv we'd only want a /64, though?

nopdotcom · 2019-09-16T19:38:00Z

playbooks/roles/openvpn/templates/client-common.j2

@@ -1,4 +1,4 @@
-dev tun
+dev tun-ipv6


Should this be conditional on having IPv6 enabled, or do we want this always-on because it will catch IPv6 leaks or something?

I'll have to test this scenario to check for leaks, thanks for pointing it out

nopdotcom · 2019-09-16T19:40:43Z

playbooks/roles/openvpn/templates/etc_openvpn_server.conf.j2

+proto tcp6
+
+{% if streisand_ipv6_address is defined %}
+server-ipv6 2001:db8:0:124::/64


We can't use 2001:db8:: for anything. Do we want a second ULA for now, or to separate subnets inside our "main" ULA?

nopdotcom · 2019-09-16T19:41:35Z

playbooks/roles/openvpn/templates/etc_openvpn_server_udp.conf.j2

-proto udp
+
+{% if streisand_ipv6_address is defined %}
+server-ipv6 2001:db8:0:123::/64


Similarly, we can't use 2001:db8::; needs to be a ULA, I think.

nopdotcom · 2019-09-16T19:43:09Z

playbooks/roles/openvpn/vars/main.yml

+dnsmasq_openvpn_udp_ipv6: "2001:db8:0:123::1001"
+
+openvpn_server_tcp_ipv6_address: "2001:db8:0:124::/64"
+openvpn_server_udp_ipv6_address: "2001:db8:0:123::/64"


No 2001:db8::.

nopdotcom · 2019-09-16T19:45:20Z

playbooks/roles/openvpn/templates/etc_openvpn_server_common.j2

@@ -6,6 +6,10 @@ dh none
 ifconfig-pool-persist ipp.txt
 push "redirect-gateway def1"

+{% if streisand_ipv6_address is defined %}
+push "route-ipv6 ::/0"


As a side note, do we want to push IPv6 routes to people all the time anyway, to avoid IPv6 leaks?

Agreed, we definitely should. It's being done for WireGuard as is so others should follow suite

nopdotcom · 2019-09-16T19:48:26Z

playbooks/roles/wireguard/vars/main.yml

@@ -6,9 +6,14 @@ wireguard_server_private_key_file: "{{ wireguard_path }}/server.key"
 wireguard_server_public_key_file: "{{ wireguard_path }}/server.pub"

 dnsmasq_wireguard_ip: "10.192.122.1"
+dnsmasq_wireguard_ipv6: "fde9:7496:c3d7:a47f::1001"


Just another ULA reminder.

If a system has *existing* IPv6 connectivity, support some services over it. sslh: Adding another listen line opens up the gateway (and ssh). shadowsocks: Adding another listen address opens the service; obfs works too. gateway: Adding the IPv6 address to the self-signed gateway SSL cert works. Note that systems with IPv6 ingress get IPv6 egress for connection-oriented services for free; check with https://ipv6.google.com/

@nopdotcom

- branch based off of @nopdotcom's PR StreisandEffect#1361 - initial commit for supporting all VPNs over IPv6

- add IPv6 status

alimakki requested review from jlund, cpu and nopdotcom October 21, 2018 16:47

alimakki mentioned this pull request Nov 8, 2018

Explicit IPv6 config option: sslh/shadowsocks/gateway, plus DO IPv6 #1382

Open

alimakki force-pushed the streisand_ipv6 branch from 07b36af to b41e2d2 Compare March 16, 2019 22:43

nopdotcom suggested changes Sep 16, 2019

View reviewed changes

nopdotcom and others added 5 commits September 19, 2019 18:11

Checkpoint: include the IPv6 addresses on the welcome sheet.

a4651b7

Include the enable variable in testing too

dd16cc7

Defaults hiding everywhere

088b400

- branch based off of @nopdotcom's PR StreisandEffect#1361 - initial commit for supporting all VPNs over IPv6

- default to disabling IPv6

af78894

- add IPv6 status

alimakki force-pushed the streisand_ipv6 branch from cd17cd9 to af78894 Compare September 19, 2019 22:17

alimakki and others added 4 commits September 19, 2019 18:20

new line

deed63c

ansible_default_ipv4.interface -> ansible_default_ipv6.interface

49c081f

Merge branch 'master' into streisand_ipv6

f1f6f8b

Merge branch 'master' into streisand_ipv6

7403067

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

WIP: Streisand IPv6 support #1471

WIP: Streisand IPv6 support #1471

alimakki commented Oct 21, 2018

clenga commented Nov 9, 2018

clenga commented Nov 9, 2018

clenga commented Nov 9, 2018 •

edited

alimakki commented Nov 13, 2018

clenga commented Nov 16, 2018

alimakki commented Nov 17, 2018

nopdotcom commented Nov 17, 2018

clenga commented Nov 17, 2018

clenga commented Nov 17, 2018

clenga commented Nov 17, 2018 •

edited

nopdotcom commented Mar 16, 2019

nopdotcom left a comment

nopdotcom Sep 16, 2019

nopdotcom Sep 16, 2019

nopdotcom Sep 16, 2019

nopdotcom Sep 16, 2019

alimakki Sep 19, 2019

nopdotcom Sep 16, 2019

nopdotcom Sep 16, 2019

nopdotcom Sep 16, 2019

nopdotcom Sep 16, 2019

alimakki Sep 19, 2019

nopdotcom Sep 16, 2019

WIP: Streisand IPv6 support #1471

Are you sure you want to change the base?

WIP: Streisand IPv6 support #1471

Conversation

alimakki commented Oct 21, 2018

clenga commented Nov 9, 2018

clenga commented Nov 9, 2018

clenga commented Nov 9, 2018 • edited

alimakki commented Nov 13, 2018

clenga commented Nov 16, 2018

alimakki commented Nov 17, 2018

nopdotcom commented Nov 17, 2018

clenga commented Nov 17, 2018

clenga commented Nov 17, 2018

clenga commented Nov 17, 2018 • edited

nopdotcom commented Mar 16, 2019

nopdotcom left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

clenga commented Nov 9, 2018 •

edited

clenga commented Nov 17, 2018 •

edited