gmane.network.ipv6.miredo.devel

Re: [PATCH] portability fix

Rémi Denis-Courmont — 2011-12-02T13:05:05

On Wed, 16 Nov 2011 16:04:43 +0900 (JST), Munechika SUMIKAWA / 角川宗近
<sumikawa-MtgL8ddIsZd3+QwDJ9on6Q< at >public.gmane.org> wrote:

Yeah that should work, though it's a little less optiomal.

Sorry for the delay.

[PATCH] Add more including files for complation on FreeBSD

Munechika SUMIKAWA / 角川宗近 — 2011-11-16T07:10:23

libteredo/discovery.c needs more including files for FreeBSD (and
maybe other *BSD).

[PATCH] portability fix

Munechika SUMIKAWA / 角川宗近 — 2011-11-16T07:04:43

In the below commit,

------------------
commit 336549f1ae686c62746140ce1da921372ec67640
Author: Rémi Denis-Courmont <remi-AzDNUFsAnHasTnJN9+BGXg< at >public.gmane.org>
Date:   Wed Jan 20 19:47:59 2010 +0200

    Fix aliasing violations
    Unfortunately, I am not sure how portable this code is.
------------------

This isn't portable.  How is the attached?  "s6_addr" is defined in
RFC3493 but s6_addr{16,32} is not.

Re: [PATCH] systemd service file for miredo

Rémi Denis-Courmont — 2011-07-28T19:42:34

Hello,

Le jeudi 28 juillet 2011 17:08:13 Michael Stapelberg, vous avez écrit :

It's not that easy. The correct paths need to be substituted. Debian can 
assume Miredo is installed in /usr but the source tarball cannot.
Also the file should probably not be installed on non-Linux hosts.

In any case, this requires some Makefile magic. I'll see what I can do.

[PATCH] systemd service file for miredo

Michael Stapelberg — 2011-07-28T14:08:13

Hello,

I created a systemd service file for miredo.
systemd is a sysvinit replacement (see [1] for more information).
One of the goals of systemd is to encourage standardization between different
distributions. This means, while I also submitted a ticket in Debian GNU/Linux,
I would like to ask you to accept this service file as the upstream
distributor, so that other distributions can use the same service file and
don’t have to ship their own.

Please include this file in your next release (just like in init script).

If you have any questions, please do not hesitate to contact me.

Best regards,
Michael

[1] http://en.wikipedia.org/wiki/Systemd

Re: Miredo on Android OS?

Michael H. Warfield — 2011-07-15T00:27:59

On Tue, 2011-07-12 at 01:30 -0400, hideyoshi baka wrote: 





I haven't tried Miredo on Android yet but OpenVPN is running so the
"Join Project" scripts should work if you have a "Join server" with
appropriate address space you can use.  I'm not advocating it, by no
means.  The Join Project out of Germany was dismantled years ago even
before the 6-Bone was deprecated and I may be one of the last keepers of
those packages, having a personal Join server for myself.  You would
need a /48 to make allocations out of and set up your own CA.  You gotta
really want it.  I too would like to see Miredo on Android but it will
require rooting and possibly mod-roming the phone to do it.  Since
OpenVPN is already available on Android, that might not be required in
that case.

Regards,
Mike

Re: Miredo on Android OS?

Rémi Denis-Courmont — 2011-07-12T06:52:38

    Hideyoshi-san,

On Tue, 12 Jul 2011 01:30:48 -0400, hideyoshi baka
<hideyoshibaka-Re5JQEeQqe8AvxtiuMwx3w< at >public.gmane.org> wrote:

This has not happened that I know of. It should be feasible but would be
quite involved.


The Teredo protocol is not very well suited for portable 3G devices. It
requires sending a keep-alive UDP packet every few tens of seconds. This
can impact the battery live time quite badly, especially if 3GPP Continuous
Packet Connectivity is _not_ available.

Miredo on Android OS?

hideyoshi baka — 2011-07-12T05:30:48

Hello,

Has anyone here had any luck/attempts at porting Miredo to Android OS?

I wish to have IPv6 access on my Android phone (rooted), but ISP
(telephone provider Verizon Wireless) doesn't have IPv6 access on 3G
(only 4G/LTE).

6to4 etc is all out of the question due to the NAT that VZW uses.

Thanks for any ideas or suggestions.

Re: Miredo relay performance

Rémi Denis-Courmont — 2011-07-01T10:29:27

On Fri, 1 Jul 2011 12:44:42 +0300 (EEST), Pekka Savola <pekkas-UjJjq++bwZ7HOG6cAo2yLw< at >public.gmane.org>
wrote:

It should be more or less able to use two CPU's asymmetrically: one
down-link and one up-link. But otherwise, yeah, there has not been any
effort to support SMP, though it should not be terribly hard to implement.

Re: Miredo relay performance

Pekka Savola — 2011-07-01T09:44:42

We did significantly more, I recall some 600 Mbit/s and an order of 
magnitude more packets, but it required some tuning.  I recall that at 
that point the bottleneck was that miredo could not effectively use 
more than one CPU.

Check in particular EX ring buffer (ethtool -G ethX rx 4096).  In our 
case, the default was 256 and we increased it to 4096.  This was a 
significant contributor.  Some sysctl parameters were also needed. 
Some of the ones used are below. Txqueuelen for teredo interface 
should be at least 10000.

Depending on what's causing the bottleneck, you could see drops or get 
some further ideas with 'ip ntable show dev teredo' (neighbor counts), 
'tc -s -d qdisc show dev teredo' and ethtool -S (see 
rx_no_buffer_count)

==================
# icmp ratelimits
net.ipv6.icmp.ratelimit = 2000
net.ipv4.icmp_ratelimit = 2000

# (teredo) increase neighbour discovery thresholds
net.ipv6.neigh.default.gc_thresh1=128000
net.ipv6.neigh.default.gc_thresh2=512000
net.ipv6.neigh.default.gc_thresh3=102400

Miredo relay performance

2011-07-01T09:04:10

 Hi,
 does anyone have any real-life experience with miredo relay 
 performance?
 I have tried:

  * Debian 6/Ubuntu 11.04 (kernel 2.6.38, miredo 1.2.3)
  * Cent 5.6 (kernel 2.6.18, miredo 1.2.3)
  * FreeBSD 8.2 (miredo 1.2.3)

 I have used different hardware: Dell, HP servers 2(4)GB RAM, Intel Xeon 
 processors, Broadcom, Intel network adapters ...

 I have reached 60kpps in testing - single stream from native IPv6 host 
 to miredo IPv6 host, but when I tried "real" traffic (announcing 
 2001::/32 to the BGP) the servers start to drop packets when the traffic 
 reaches 10kpps ... all the combinations of OS and HW behave similarly - 
 received packets are dropped ... I have also tried some "network card 
 drivers and OS" tunning - increasing buffer size, setting coalesce 
 parameters ...

 Thanks
 Regards

 Marian Kadziolka

Re: Behind the NAT and firewall

Rémi Denis-Courmont — 2011-02-28T08:47:51

On Mon, 28 Feb 2011 00:21:03 +0100, Visgean Skeloru <visgean-Re5JQEeQqe8AvxtiuMwx3w< at >public.gmane.org>
wrote:

This really is not useful at all. You should run miredo in the foreground
if you want to see what goes wrong.


I'm not sure you can bind miredo to a privileged port, and it definitely is
not a good idea to do so.


The Teredo traffic rule is UDP from the local 'BindPort' and to any remote
port and vice versa.

Behind the NAT and firewall

Visgean Skeloru — 2011-02-27T23:21:03

Hi, I have installed miredo two days ago at home, everything worked
perfectly until I arrived to school (college), miredo stop working, it´s
giving me following errors:
for the following configuration:

ServerAddress   83.170.6.76
BindPort        22

it´s giving this:


In the school we are behind firewall which is blocking almost everything but
I know I have enabled port for ssh, it seems to me that the port for ssh is
already used, but I have my ssh configured to be hanging on port 443, and it
seems to be there, also I have set my firewall (vuurmuur) to allow all
conections. Is there any way how to run miredo on the port 22 or something
like that?

btw: default configuration was not working neither. I can talk to the school
administrator to enable certain portrange, what shoudl it be? (Google did
not answered me...)

Re: Why two IPs for miredo-server - NS

Michael H. Warfield — 2010-12-13T15:42:16

On Fri, 2010-12-10 at 02:13 +0200, Rémi Denis-Courmont wrote: 


Just to elaborate on this a little bit.  You may think it's working fine
when, in fact, there are circumstances in which it's going to fail and
you may not understand why.



The protocol uses two addresses as part of its NAT traversal logic.
That logic will not work with certain kinds or configurations of NAT if
it only has one address, even though it may look like it's working fine
under other circumstances such as simple firewall traversal.  Some of
the very circumstances for which you would chose the Teredo transport as
opposed to a simpler transport such as 6in4 or 6to4 are some of those
circumstances in which it will fail with only one address.

The original specification (and the original Microsoft implementation)
also required that the two addresses be consecutive and the lower of the
two was your primary.  I don't believe that Miredo has that requirement
even though I believe it would still be required for Microsoft
compatibility, tho

Re: Why two IPs for miredo-server - NS

Rémi Denis-Courmont — 2010-12-10T00:13:27

   Hello,

On Thursday 09 December 2010, Milan Mihajlovic wrote:

No, it does not.


The protocol has been designed that way. See RFC4380 for further details.


You assign the DNS name to the first IP address of the pair.

Why two IPs for miredo-server - NS

Milan Mihajlovic — 2010-12-09T13:48:47

Hi,

I've installed a miredo-server. It works fine with one IP. 
I don't unterstand why I have to use two IPs for the miredo-server.

And how I have to set the forward and reverse record for my name server 
when I like to use teredo.example.com?

When I use only one IP than it's clear. 
But When I have to use two IPs I'm unsure.

Sorry, my English is bad.

Thanks!

Re: How to make miredo prefer IPv6 DNS records?

Matija Nalis — 2010-10-23T16:00:54

Thanks, we really do want that - the point is to test for some of the
possible problems before "real" IPv6 deployment comes (the infrastructure
for native IPv6 is being prepared, but since it is really getting late these
days to do IPv6 deployment before IPv4 starts to run out, we'd prefer to
test and gain some experience before that...

And installing and enabling miredo to do the job seems the fastest and
simplest way to promote dozens of remote users to beta-testers.


Yes, that was indeed the case. Uncommenting all labels in /etc/gai.conf
except "label 2001:0::/32 7" indeed make miredo prefer IPv6. 

Thanks!

Re: How to make miredo prefer IPv6 DNS records?

Rémi Denis-Courmont — 2010-10-23T12:45:09

Le samedi 23 octobre 2010 14:38:16 Matija Nalis, vous avez écrit :

That's the default behaviour from glibc. You need to delete the Teredo label 
from the configuration if you really want to prefer Teredo over native IPv4.


No. Native IPv6 is prefered by default, not just any IPv6.


You need to remove the Teredo label, i.e. the 7th one.

How to make miredo prefer IPv6 DNS records?

Matija Nalis — 2010-10-23T11:38:16

Sorry for the IPv6-newbie question, but I hope someone can shed some light.

I'm using recent Debian Squeeze, with default miredo 1.2.3-1 installation
(kernel 2.6.32-25, and libc6 2.11.2-6+squeeze1).  It works just fine out of
the box as far as IPv6 connectivity itself is concerned (great!!). The
system is just a workstation connected via etherenet to cable router, which
does IPv4-only PPTP tunnel to the ISP.

I can ping6, telnet etc to any manually specified IPv6 address, or to DNS
name that has only AAAA record.

However, when I try to connect to a DNS name that has both AAAA and A
records, "A" record always gets tried first. I would like to reverse that,
that is for "AAAA" record to always be tried first.

for example:

# host ipv6.google.com  
ipv6.google.com is an alias for ipv6.l.google.com.
ipv6.l.google.com has IPv6 address 2a00:1450:8006::93
# telnet ipv6.google.com 80
Trying 2a00:1450:8006::93...
Connected to ipv6.l.google.com.

works ok, but:

# host www.ipv6.org
www.ipv6.org is an alias for shake

Re: Feature-request: server-hook script

Rémi Denis-Courmont — 2010-10-23T06:54:43

Le jeudi 21 octobre 2010 01:38:07 Norman Rasmussen, vous avez écrit :

There is no fundamental reasons why this could not be implemented with a 
patch. But given that the relay routing configuration is completely static, it 
is much less useful than for the client.

Feature-request: server-hook script

Norman Rasmussen — 2010-10-20T22:38:07

I have policy rules to route my ipv6 traffic, which means that the default
route that miredo installed in the main table is ignored :-(

Any chance that miredo could run a server-hook script that could set up the
rules for my other tables?

Cheers