--- title: 'Tutorial: Assign IPv6 IP Addresses to VPN Clients From A Global Pool' canonical: https://openvpn.net/as-docs/tutorials/tutorial--assign-ipv6-from-global-pool/ product: Access Server Docs description: Assign IPv6 IP addresses to your Access Server VPN clients from a global pool. OpenVPN tutorial --- # Tutorial: Assign IPv6 IP Addresses to VPN Clients From A Global Pool ## Overview This tutorial explains enabling and configuring IPv6 in Access Server to assign IP addresses to VPN clients from a global IPv6 pool. Although Access Server requires IPv4 for incoming connections, it [supports IPv6 routing](https://openvpn.net/as-docs/ipv6-support.md) inside the VPN tunnel. This means that clients connected over IPv4 can send and receive IPv6 packets through the VPN. > **Note** > > The IPv6 address `2001:db8` used in our examples is [reserved for documentation use](https://en.wikipedia.org/wiki/Reserved_IP_addresses#IPv6). > > Replace it with a valid IPv6 address for your network. ## Prerequisites - An installed Access Server. - An IPv6 interface and IPv6 default gateway configured on your Access Server host machine. - A valid IPv6 address range to assign to VPN clients. ## Step 1: Enable IPv6 routing 1. Connect to the console and get root privileges. 2. Switch to the scripts directory: ``` cd /usr/local/openvpn_as/scripts/ ``` 3. Turn on IPv6 routing: ``` ./sacli --key "vpn.routing6.enable" --value "true" ConfigPut ``` ## Step 2: Route all IPv6 traffic through the tunnel (full tunnel) 1. Turn on full tunneling to route all IPv6 traffic through the tunnel: ``` ./sacli --key "vpn.client.routing6.reroute_gw" --value "true" ConfigPut ``` ## Step 3: Define the default IPv6 address pool 1. Create a default IPv6 address pool to assign to your VPN clients: ``` ./sacli --key "vpn.server.daemon.vpn_network6.0" --value "2001:db8:b84b:2::/112" ConfigPut ``` - In this example, we use "2001:db8:b84b:2::/112". This is a unique local IPv6 address (IPv4 private IP equivalent), which means this IP is not routable over the internet. ## Step 4: Configure SNAT for IPv6 internet traffic 1. Configure SNAT so IPv6 traffic from the VPN client uses it to go to the internet: ``` ./sacli --key "vpn.server.routing6.snat_source.0" --value "eth0:2001:db8:0:963::1" ConfigPut ``` ## Step 5: Save and apply the configuration 1. Save and apply the settings by restarting the server: ``` ./sacli start ``` ## Step 6: Test the setup 1. From a client machine, connect to the VPN (we recommend using OpenVPN Connect). - The client should receive an IPv6 address, such as 2001:db8:b84b:2:://112, from the global pool. 2. Ping an external IPv6 site: ``` ping ipv6.google.com ``` - Output from a Windows PC: ``` PS C:\Users\AUser> ping ipv6.google.com Reply from 2607:f8b0:4006:81f::200e: bytes=1500 time=30ms TTL=54 Reply from 2607:f8b0:4006:81f::200e: bytes=1500 time=30ms TTL=54 Reply from 2607:f8b0:4006:81f::200e: bytes=1500 time=29ms TTL=54 Reply from 2607:f8b0:4006:81f::200e: bytes=1500 time=30ms TTL=54 Reply from 2607:f8b0:4006:81f::200e: bytes=1500 time=31ms TTL=54 Ping statistics for 2607:f8b0:4006:81f::200e: Packets: Sent = 5, Received = 5, Lost = 0 (0% loss), Approximate round trip times in milli-seconds: Minimum = 29ms, Maximum = 31ms, Average = 30ms ``` 3. Monitor the traffic on the server using `tcpdump`: ``` tcpdump -eni any host ipv6.google.com ``` - Here's an example output showing how the IPv6 traffic is processed and redirected using SNAT: ``` root@openvpn-access-server-AUser:/usr/local/openvpn_as/scripts# tcpdump -eni any host ipv6.google.com tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on any, link-type LINUX_SLL (Linux cooked), capture size 262144 bytes 10:47:31.114998 In ethertype IPv6 (0x86dd), length 96: 2001:db8:b84b:2::8002 > 2607:f8b0:4006:81f::200e: ICMP6, echo request, seq 9, length 40 10:47:31.115031 Out d6:77:ce:97:8c:7c ethertype IPv6 (0x86dd), length 96: 2604:a880:400:d0::189e:6005 > 2607:f8b0:4006:81f::200e: ICMP6, echo request, seq 9, length 40 10:47:31.116589 In fe:00:00:00:01:01 ethertype IPv6 (0x86dd), length 96: 2607:f8b0:4006:81f::200e > 2604:a880:400:d0::189e:6005: ICMP6 echo reply, id 1, seq 9, length 40 10:47:31.116610 Out ethertype IPv6 (0x86dd), length 96: 2607:f8b0:4006:81f::200e > 2001:db8:b84b:2::8002: ICMP6 echo reply, id 1, seq 9, length 40 ``` ### IPv6 configuration keys Use the following configuration keys to work with IPv6 in Access Server. | Configuration Key | Type | Description | | --- | --- | --- | | ``` vpn.routing6.enable ``` | bool | Enable IPv6 routing. | | ``` vpn.server.nat6 ``` | bool | Enable IPv6 NAT. | | ``` vpn.server.nat6.masquerade ``` | bool | Enable IPv6 masquerade. | | ``` vpn.client.routing6.reroute_gw ``` | bool | Route all IPv6 traffic through the tunnel. | | ``` vpn.server.daemon.vpn_network6 ``` | list of subnets | Default IPv6 VPN subnets to be subdivided among OpenVPN daemons: These are used by clients as VPN routing gateways and allocated to non-group clients. | | ``` vpn.client.routing6.inter_client ``` | bool | Enable client-to-client IPv6 traffic. | | ``` vpn.server.routing6.private_access ``` | string | Controls how to route private traffic: nat route none | | ``` vpn.server.routing6.gateway_access ``` | bool (default=true) | If true, clients may access the server-side tun gateway IPv6 address. | | ``` vpn.server.routing6.allow_private_nets_to_clients ``` | bool | If true, all IPv6 addresses in vpn.server.routing6.private\_network will be allowed to initiate client connections. | | ``` vpn.server.routing6.private_network ``` | list of subnets | Access granted to private server-side subnets. | | ``` vpn.server.routing6.incoming_network ``` | list of subnets | IPv6 addresses within this range may initiate connections with VPN clients. | | ``` vpn.server.routing6.routed_subnets ``` | list of subnets | Subnets that should be routed rather than NATed (when NAT is enabled). | | ``` vpn.server.group_pool6 ``` | list of subnets | Optional pool of VPN IPv6 addresses to be subdivided across groups that don't define group\_subnets6 or group\_range6. | | ``` vpn.server.routing6.snat_source.N ``` | list of interface and IPv6 address mappings | This defines how to perform Source Network Address Translation (SNAT) for outgoing IPv6 packets. When NAT is enabled, SNAT ensures that VPN client traffic uses a specific IPv6 address or range for outgoing traffic. Specify a range of IPv6 addresses for SNAT on each outgoing network interface. The `N` suffix (e.g., `.0`, `.1`, `.2`, etc.) is required for the configuration to work. The command will not function properly if the `.N` suffix is omitted. | | ``` vpn.server.custom_snat6_chain ``` | string | Define a custom ip6tables chain to handle all outgoing NAT. | --- Prev: [Tutorial: Assign Public IPv6 IP Addresses to VPN Clients](https://openvpn.net/as-docs/tutorials/tutorial--assign-ipv6-addresses.md) Next: [Tutorial: Assign IPv6 Addresses to VPN Clients from a Group Pool](https://openvpn.net/as-docs/tutorials/tutorial--assign-ipv6-from-group-pool.md) Index: https://openvpn.net/as-docs/llms.txt