Tutorial: Assign Public IPv6 IP Addresses to VPN Clients⁠

Overview⁠

This tutorial explains enabling and configuring IPv6 routing in Access Server. Although Access Server requires IPv4 for incoming connections, it supports IPv6 routing inside the VPN tunnel. This means that clients connected over IPv4 can send and receive IPv6 packets through the VPN.

Prerequisites⁠

An installed Access Server.
An IPv6 interface with an IPv6 default gateway configured on the Linux machines hosting Access Server.
A valid IPv6 address range to assign to VPN clients (can be from a public, private global, or group-specific access pool).
Console access.

Connect to the console and get root privileges:
```
sudo su
```
Switch to the scripts directory:
```
cd /usr/local/openvpn_as/scripts/
```

Turn on IPv6 routing:

./sacli --key "vpn.routing6.enable" --value "true" ConfigPut

Specify the IPv6 subnet you'll use to assign addresses to VPN clients:

./sacli --key "vpn.server.daemon.vpn_network6.0" --value "2001:db8:XXXX:963:0001::/116" ConfigPut

Use the following configuration keys to work with IPv6 in Access Server.

Configuration Key	Type	Description
vpn.routing6.enable	bool	Enable IPv6 routing.
vpn.server.nat6	bool	Enable IPv6 NAT.
vpn.server.nat6.masquerade	bool	Enable IPv6 masquerade.
vpn.client.routing6.reroute_gw	bool	Route all IPv6 traffic through the tunnel.
vpn.server.daemon.vpn_network6	list of subnets	Default IPv6 VPN subnets to be subdivided among OpenVPN daemons: These are used by clients as VPN routing gateways and allocated to non-group clients.
vpn.client.routing6.inter_client	bool	Enable client-to-client IPv6 traffic.
vpn.server.routing6.private_access	string	Controls how to route private traffic: nat route none
vpn.server.routing6.gateway_access	bool (default=true)	If true, clients may access the server-side tun gateway IPv6 address.
vpn.server.routing6.allow_private_nets_to_clients	bool	If true, all IPv6 addresses in vpn.server.routing6.private_network will be allowed to initiate client connections.
vpn.server.routing6.private_network	list of subnets	Access granted to private server-side subnets.
vpn.server.routing6.incoming_network	list of subnets	IPv6 addresses within this range may initiate connections with VPN clients.
vpn.server.routing6.routed_subnets	list of subnets	Subnets that should be routed rather than NATed (when NAT is enabled).
vpn.server.group_pool6	list of subnets	Optional pool of VPN IPv6 addresses to be subdivided across groups that don't define group_subnets6 or group_range6.
vpn.server.routing6.snat_source.N	list of interface and IPv6 address mappings	This defines how to perform Source Network Address Translation (SNAT) for outgoing IPv6 packets. When NAT is enabled, SNAT ensures that VPN client traffic uses a specific IPv6 address or range for outgoing traffic. Specify a range of IPv6 addresses for SNAT on each outgoing network interface. The `N` suffix (e.g., `.0`, `.1`, `.2`, etc.) is required for the configuration to work. The command will not function properly if the `.N` suffix is omitted.
vpn.server.custom_snat6_chain	string	Define a custom ip6tables chain to handle all outgoing NAT.

Can't find what you're looking for?

Our support team will be happy to assist you.

Contact Support Schedule a Demo

Tutorial: Assign Public IPv6 IP Addresses to VPN Clients⁠

Overview⁠

Prerequisites⁠

Was this information helpful?