gmane.network.ipv6.miredo.devel

Re: miredo 1.1.6 release?

Rémi Denis-Courmont — 2008-11-16T17:03:41

Hmm yeah. There has been so few changes since 1.1.5... but it could be done.

Re: Questions and implementation advice about Miredo

Mark van Herpen — 2008-10-14T12:35:01

Hello, Rémi Denis-Courmont wrote: I 'matched' these bits and I have some things running now. I've used our /32 prefix in the relay and server configuration. All ip addresses are 'delegated' in a /64 subnet, as you mentioned. After 'ip route del xxxx:xxxx::/32 dev teredo' and 'ip route add xxx:xxxx:xxxx:xxxx::/64 add teredo' on the miredo relay, and routing this /64 subnet to the miredo relay from our core network, some things are working :) I can access all ipv6 hosts outside our /32 network, for instance ipv6.google.com. Also, the clients can be reached from outside our /32 network, via the relay etc. But... I can't access an address within our /32 subnet. So all hosts and servers which have a native ipv6 address, and are routed via our core network can not be reached. Also, from within our /32 subnet, I can't reach any miredo clients from the /64 mentioned above. Miredo clients can reach each other though.. After playing with routes on the miredo relay, I guess there is something which says that '

Re: Questions and implementation advice about Miredo

Mark van Herpen — 2008-10-14T20:09:58

>> So, can I fix this? Or am I wrong, and should I Ok, almost clear to me. But I don't get the part 'on the clients'... From my point of view, the client sends everything through the teredo interface. Routing is done on the relay server. So if I change the prefix to a smaller subnet, I should change this in the code running on the relay. But you mentioned that this must be changed on the clients.. I don't get it.. Grtz, Mark van Herpen

Re: Questions and implementation advice about Miredo

Rémi Denis-Courmont — 2008-10-14T20:23:47

Le mardi 14 octobre 2008 23:09:58 Mark van Herpen, vous avez écrit : Teredo is like a gigantic local area network. All nodes within the /32 are assumed to be on-link. Of course, you could simply hack the client shell script to configure a /64 prefix instead of /32. But the userland tunnel driver won't know about that -kernel stuff-, and will continue to assume the prefix is 32-bits.

Re: problem pinging teredo address over switch (bug report?)

Rémi Denis-Courmont — 2008-10-14T20:00:09

Hello, Le lundi 13 octobre 2008 22:46:22 Eric Anopolsky, vous avez écrit : Many NATs do not support hair-pinning - sending packets from the inside to another host behind the NAT. In principle, Teredo has a link-local multicast discovery mechanism to work around this. But it's only implemented in Windows as yet, not in Miredo. Best regards,

Re: Questions and implementation advice about Miredo

Rémi Denis-Courmont — 2008-10-14T19:34:29

Le mardi 14 octobre 2008 15:35:01 Mark van Herpen, vous avez écrit : Yep. You can only fix this by modifying the code running on the clients to match the /64 prefix instead of the /32.

Re: problem pinging teredo address over switch (bugreport?)

Eric Anopolsky — 2008-10-13T19:46:22

I think we have miscommunicated. The server is an "ssh server" and an "apache server" but it is not a "teredo server." I suppose I should say that I have two teredo clients behind the same NAT router (on the same link) that can't ping6 eachother using their teredo IPv6 addresses. Cheers, Eric

Re: Questions and implementation advice about Miredo

Rémi Denis-Courmont — 2008-10-13T15:39:35

Hello, Le lundi 13 octobre 2008 15:41:45 Mark van Herpen, vous avez écrit : The Teredo prefix would normally contain the IPv4 address of the Teredo server at bits 32-63 (counting from 0 as the highest-order). If you can "match" these bits, then you can use a smaller prefix. Then Windows XP hard-codes bits 0-31 (normally 0x20010000) in the Windows registry - it would need to be overriden. As for Vista, I don't know how. A fairly "obvious" extension to the protocol would allow any /64 prefix to be used. But this is not currently supported by the Microsoft Windows nor the Miredo implementations. All in all, the feasibility depends on the requirement (or non-requirement) to support existing Teredo-capable hosts, namely Windows. More exactly, the Teredo _relay_ must advertise the prefix (with your internal routing protocol) to your BGP routers. Then your border routers will export it to the rest of world, possibly after aggregation within a larger IPv6 prefix of yours. The Teredo _server_ has

Re: problem pinging teredo address over switch (bug report?)

Rémi Denis-Courmont — 2008-10-13T15:26:11

Le vendredi 10 octobre 2008 23:33:32 Eric Anopolsky, vous avez écrit : Seems wrong. You should use a relay if you want to talk to your client, not a server.

problem pinging teredo address over switch (bug report?)

Eric Anopolsky — 2008-10-10T20:33:32

Hi, I'm having a problem involving two hosts using miredo. The first is a home server that is connected via ethernet to a wireless/wired router, which is connected to the Internet via DSL. The second host is a laptop that is sometimes connected to the same wireless/wired router and is sometimes connected to a similar setup at work (laptop---wireless/wired router---cable modem). Both wireless/wired routers do NAT for IPv4. When at work, the laptop can ping6 the server's teredo IP. However, at home, I get the following result when I try to ping6 the server from the laptop: eric< at >telesto:~$ ping6 SERVER_IP PING SERVER_IP(SERVER_IP) 56 data bytes From LAPTOP_IP icmp_seq=11 Destination unreachable: Address unreachable From LAPTOP_IP icmp_seq=12 Destination unreachable: Address unreachable From LAPTOP_IP icmp_seq=13 Destination unreachable: Address unreachable From LAPTOP_IP icmp_seq=14 Destination unreachable: Address unreachable From LAPTOP_IP icmp_seq=15 Destination unreachable: Address unreachable From LAPT

Questions and implementation advice about Miredo

Mark van Herpen — 2008-10-13T12:41:45

Hallo, Last week I found Miredo for implementing the Toredo protocol. And I find it very interesting, but I still have some questions. I'm working for a small internet provider based in the Netherlands. We mostly have DSL costumers. We want to implement a IPv6 solutions for those customers, but we aren't able to deliver them native IPv6 due to our DSL-network suppliers. Because most of the DSL modem/routers don't understand tunneling with ipv6, we would like to implement a solution which works with NAT. I've tested your Miredo software, and it works great :). But, now I've got some implementation questions. We want to have our customers a IPv6 address of ours, and not an address from the Toredo pool. I've read in the mailing list archive that this is possible, but there is no answer given on how this is done, except that it's not a standard solution. We want to use a /64 or /48 subnet for this. But when I use a /48 prefix in the configuration, the miredo software keeps assigning an address which isn't i

Re: Intermittent connectivity

Rémi Denis-Courmont — 2008-09-26T13:16:36

Hello, Le vendredi 26 septembre 2008 04:12:38 Adam MacBeth, vous avez écrit : This message means miredo has not received any response from the Teredo server after 3 retransmits. I can think of three reasons: - your NAT expires UDP mappings too fast, - you have found an horrible unidentified bug, - your connection is too congested/lossy. If this is caused by NAT bindings expiration, you can try to lower the refresh interval (30 seconds by default), but this requires a rebuild at the moment (grep for RefreshDelay in libteredo/maintain.c). In fact, if the NAT expires at exactly 30 seconds, you may have a race condition between the NAT timer and the Miredo one. The default value should probably be lowered to 20-25 seconds.

Intermittent connectivity

Adam MacBeth — 2008-09-26T01:12:38

I'm running the Miredo client 1.1.5-2 on Debian (installed the .deb) and I'm seeing regular connectivity problems. Every so often (somewhere between 2 and 20 minutes, usually about 5) I see "Lost Teredo connectivity" in the logs. After a minute or two connectivity is regained. If I restart miredo, it immediately regains connectivity. This is wreaking havoc on my ability to connect to this machine. IPv4 connectivity does not appear to be affected. The client is configured to use Microsoft's servers right now, but I see the same problems with remlab.net. These servers appear to be responsive at all times. Any thoughts on what might be going on here? Are there any timeout parameters I can tune to improve this situation? Thanks, Adam

Re: difficulty with XP SP2 and Vista SP0

Rémi Denis-Courmont — 2008-09-14T15:51:22

Le jeudi 11 septembre 2008 19:54:30 Carlos Rendon, vous avez écrit : I cannot find any meaningful difference. The "broken" clients appear to ignore the server advertisements, and retransmit the solicitation until the timeout (we can clearly see the clients using exponential retransmission delay). My best guess is that the client have been updated to require something new or stricter from the server responses. The only way to check this would be to run the clients against the official Microsoft servers and check the difference.

Re: difficulty with XP SP2 and Vista SP0

Carlos Rendon — 2008-09-11T16:54:30

I still have the problem under the new scenario. Now the primary server address is 193.168.1.4 (EVEN) and the secondary 193.168.1.5 (ODD). Under this scenario Vista SP0 works and XP SP2 and Vista SP1 do not. The pcap files are attached. -Carlos -----Original Message----- From: Rémi Denis-Courmont [mailto:rdenis-uaTwlBVGafag2h7rfAr7Vg< at >public.gmane.org] Sent: Thursday, September 11, 2008 7:52 AM To: Carlos Rendon Cc: miredo-devel-AzDNUFsAnHasTnJN9+BGXg< at >public.gmane.org; Kanak Biscuitwala Subject: Re: [miredo-devel] difficulty with XP SP2 and Vista SP0 Le jeudi 11 septembre 2008 00:46:00 Carlos Rendon, vous avez écrit : Could you try with an EVEN primary server address, and the next odd secondary address? A libpcap dump file would be much easier to disect than text.

Re: difficulty with XP SP2 and Vista SP0

Rémi Denis-Courmont — 2008-09-11T14:52:00

Le jeudi 11 septembre 2008 00:46:00 Carlos Rendon, vous avez écrit : Could you try with an EVEN primary server address, and the next odd secondary address? A libpcap dump file would be much easier to disect than text.

Re: difficulty with XP SP2 and Vista SP0

Anand Kumria — 2008-09-11T09:47:38

Hi, On Wed, Sep 10, 2008 at 10:46 PM, Carlos Rendon public.gmane.org> wrote: Do you have a packet capture of a successful Vista SP0 Teredo request as well? Cheers, Anand

difficulty with XP SP2 and Vista SP0

Carlos Rendon — 2008-09-10T21:46:00

Greetings- I'm running miredo-server 1.1.5 on Fedora 9. I haven't been able to get XP SP2 or Vista SP1 to work. However Vista SP0 works perfectly fine and the miredo client running on a separate Fedora 9 machine also works fine. The network setup is the same in all scenarios. The clients are behind a Linksys router and get addresses in 192.168.1.x, the server is 193.168.1.1 and 193.168.1.2. For the Windows firewall setups UDP ports 3544 and 11111 are opened and I've forced Windows to use 11111 for teredo. I've included packet captures of both scenarios below (just ICMPv6 packets). Please let me know if additional information would be useful in diagnosing the problem. Thanks, Carlos Here is the XP SP2 capture: No. Time Source Destination Protocol Info 10 5.018549 fe80::8000:5445:5245:444f ff02::2 ICMPv6 Router solicitation 0000 00 0f 66 08 64 9b 00 14 22 53 42 93 08 00 45

Re: miredo-server on FreeBSD and vista teredo

Rémi Denis-Courmont — 2008-08-24T11:16:38

Le dimanche 24 août 2008 00:02:33 Jason DiCioccio, vous avez écrit : I meant the full packet capture files. The text dump hides all the interesting bits. Also, what happens if you (try to) use teredo.remlab.net as the Teredo server?

Re: miredo-server on FreeBSD and vista teredo

Jason DiCioccio — 2008-08-23T21:17:57

Scratch that. Just got it using port 3544 as the client port and it shows it using 3544 both from the bsd side and the vista side. Still no luck.

Re: miredo-server on FreeBSD and vista teredo

Jason DiCioccio — 2008-08-23T21:02:33

Ah ok.. Here you go.. One thing I just noticed while capturing these is that the router is doing PAT. Not sure if that matters in this case, but it very well might... It's a Juniper SSG 5 and I don't think there is a way to disable it in its current configuration (its external IP is dynamic). Thanks! Jason DiCioccio No. Time Source Destination Protocol Info 1 0.000000 fe80::ffff:ffff:fffe ff02::2 ICMPv6 Router solicitation Frame 1 (103 bytes on wire, 103 bytes captured) Ethernet II, Src: JuniperN_9d:24:00 (00:90:69:9d:24:00), Dst: Intel_e9:a5:2f (00:0c:f1:e9:a5:2f) Internet Protocol, Src: 75.101.10.11 (75.101.10.11), Dst: 64.247.11.248 (64.247.11.248) User Datagram Protocol, Src Port: pciarray (1552), Dst Port: teredo (3544) Teredo IPv6 over UDP tunneling Teredo Authentication header Client identifier length: 0 Authentication value length: 0 Nonce value: 2BA9361D91C21EAB Confirmation byte: 00 Internet P