Page tree

Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

Prior name: Tornevall Networks RaspTunnel.

What is it?

Tornevall Networks RaspTunnel was an experimental project where we're adding micro servers into in a DMZ-controlled environment is hosting the primary IPv6 connectivity. Main purpose is ipv6 GRE-tunneling with the help from your primary router, which should be configured to route traffic to a DMZ-address, where this micro server, known as Raspberry pi, are the tunnel gateway.

The tunnel project has a primary goal: To configure ipv6 tunnels, where they are normally not reachable (ISP's that for example have no idea of what they are doing), or where the ip range is weakly configured without proper reverse PTR'sTornevall Tunneling is a semi-production project where we were adding microservers into a DMZ-controller environments. The main purpose was to get full IPv6 connectivity through GRE tunneling. The backside of GRE tunneling usually is that it is REQUIRED to put such tunnels primarily as an external first-connection device (by means: The device hosting the GRE tunnel must be your primary inbound connection, which is where the DMZ comes in).

For the moment, to create more stability, we instead build all solutions on OpenVPN which also gives the possibility to aquire local IPv4 addresses if necessary . Or if you like, LAN access.

What is the goal?

There are a few top providers that support IPv6 connectivity already. For example Spacedump AB and Hurricane Electric. Many providers offers connectivity through SIT/GRE/TUN/TAP drivers. One of the goals is to be a in-between layer of the regular tunnels, as they are required to be (like described above) located un-NAT'ed to work. Besides, we offer a reverse-PTR-DNS editor at https://auth.tornevall.net, specifically written to make DNS editing easier.

How does it work?

An installer injects required data into a raspberry pi, which is configured with a static ip address matching the network that needs it. It should be installed at the same ip range as your DHCP server and your incoming gateway shoud be configured with a DMZ-pointer to this machine.

With Tornevall Networks API, the pi will download data required for a controller to connect to the service, since the gateway should (unless the user have full control by themselves) be able to administered from an external point (Tornevall Networks IP-ranges). The API will also be used to configure dynamic tunnels.

As this is based on Linux (Raspian for pi 1, and Ubuntu 16 for pi 2 and pi 3), not only ipv6 tunnels may be considered. However, if there is ipv4 included here, we should make sure that the primary gateway are really routing networks properly. A recommended path for ipv4 tunnels should be somewhere at 10.0.0.0/8

This is a infrastructure issue, so the primary location of the ongoing project issue is located here:

Jira
serverTornevall Networks
columnskey,summary,type,created,updated,due,assignee,reporter,priority,status,resolution
serverIdef1f2374-e58a-319f-9d38-10348dbac859
keyINFRA-15

Usage

Basically, everything is going to be handled through the pi. There are however an interface that automatically reconfigures the local tunnel ip address in case that is changing. The link looks like this:

https://api.tornevall.net/2.0/vpn/update/auth/tunnelUserName/key/tunnelUserKey/ip/auto/

One issue with the above address is that it is resolving to both ipv4 networks and ipv6 networks. If there are connection problems, you may want to try the pure ipv4-address instead, like this:

TorneAPI ipv4 only: https://api-4.tornevall.net/2.0/vpn/update/auth/tunnelUserName/key/tunnelUserKey/ip/auto/

To identify the current ip address http://identifier.tornevall.net/ip.php

Configuring the tunnel may be done manually with regular commands:

Code Block
languagebash
titleip tunnel manually
ip tunnel add <name> mode gre remote <addr>
ip addr <prefix> dev <name>

On the preinstalled raspberry pi there is however scripts that is making thing for you in /usr/local/sbin

...

Automatically configures a tunnel based on the data entered at pi-tunnel.run, so this goes with two parameters:

<remote-connection-address> <your-prefix>

Visual

 

Firewalls

Yes. They will be there in a new future, since we are not focused on this part. The important thing is that everything is blocked when the pi fires up in production mode, and somehow, some base services only, will be allowed to connect to the DMZ-address.

 

The project itself

Jira
serverTornevall Networks
columnskey,summary,type,created,updated,due,assignee,reporter,priority,status,resolution
maximumIssues20
jqlQueryproject = INFRA AND (component = RaspberryVPN OR component = RaspTunnel)
serverIdef1f2374-e58a-319f-9d38-10348dbac859

 

The project itself

JiraserverTornevall Networkscolumnskey,summary,type,created,updated,due,assignee,reporter,priority,status,resolutionmaximumIssues20jqlQueryproject = INFRA AND (component = RaspberryVPN OR component = RaspTunnel) serverIdef1f2374-e58a-319f-9d38-10348dbac859No prior configuration or ip rule settings are required anymore. You only need OpenVPN and permission. Then it is up to you how your local endpoint are configured. Either we give you a simple IPv4/32 or IPv6/128 address, or we give you a /64 IPv6 subnet, as this is the smalles required size of a IPv6 subnet for DHCPv6 to work properly.

IPv6 Networks

DHCP delegation is normally installed clientside. It is also recommended to run dhcp on a /64-prefix. On prefixes higher (65 and up), it may not work properly.

Hurricane electric assigns prefixes by automation. The tunnel types there are based on the SIT-protocol. By requesting directly from them, there won't be any slowdowns in the routing.

Protocols

Supporting GRE but prefers OpenVPN. See below.

Remote Servers

Remote HostDescription
tunnel-prd.tornevall.netRound robin based remote server
tunnel02.tornevall.net
tunnel03.tornevall.net

Networks

Network/PrfLenHost PrflenPrefix/Length*Inbound AddressOpenVPN Tunnel AssignmentsLocal Prflen DelegationsLocationif-gw

2a01:299:a0::/48

Status
colourGreen
title48

Status
colourGreen
titlelocal

Status
colourGreen
titlelocal

Status
subtletrue
colourGreen
title64+

Status
colourGreen
title64

Status
colourGreen
titlePrimary

Status
colourBlue
titleSP

2001:470:dcb5::/48

Status
colourGreen
title48

Status
colourGreen
titleLocal

Status
colourGreen
titlelocal

Status
subtletrue
colourGreen
title>64

Status
colourGreen
title64

Status
colourGreen
titleSE


Status
colourBlue
titlehe

2001:470:83e7::/48

Status
colourGreen
title48

Status
colourGreen
titleLocal

Status
colourGreen
titlelocal

Status
subtletrue
colourGreen
title>64

Status
colourGreen
title64

Status
colourGreen
titlefremont/US


Status
colourBlue
titlehe

2607:5500:3000:78a::2/48

Status
colourGreen
title64

Status
colourGreen
title68

2607:5500:3000:78a:2000::1/68

Status
colourRed
title80

Status
colourBlue
titleTX/US

Status
colourBlue
titlehw

2a02:348:83:cc06::1/48

Status
colourGreen
title64

Status
colourGreen
title68

2a02:348:83:cc06:2000::1/68

Status
colourRed
title80

Status
colourBlue
titlenl

Status
colourBlue
titleti

2a01:4f9:c010:3142::1/64

Status
colourGreen
title64

Status
colourGreen
title68

2a01:4f9:c010:3142:2000::1/68

Status
subtletrue
colourYellow
title96+

2a02:c207:2042:5731:2a01:21a0:35ff::/112

Status
colourYellow
title96

Status
colourBlue
titlefi

Status
colourBlue
titlehz

2a02:c207:2042:5731::1/64

Status
colourGreen
title64

Status
colourGreen
title68

2a02:c207:2042:5731:2000::1/68

Status
colourYellow
title80

Status
colourBlue
titlede

Status
colourBlue
titlecb

* If prefix/length is set to 

Status
colourGreen
titlelocal
, the uplink is assigned directly at Tornevall Networks. If the networks are defined other ways for example 
Status
colourGreen
title68
, the entry point assignment is not set at Tornevall Networks SE-level. It is probably assigned elsewhere as a tunnel or similar.

Red marked ip ranges is networks that is not ready for assignments yet.

Visual view

Gliffy Diagram
nametornevall-openvpn
pagePin3