Tunnelbroker.net - IPv6 via Hurricane Electric

Setting up IPv6 connectivity via Hurricane Electric Tunnelbroker.net using a SIT (Simple Internet Transition) tunnel on VyOS.

Scenario Overview

Use Case

Obtaining IPv6 connectivity for networks where the ISP does not provide native IPv6. Tunnelbroker.net offers free IPv6 tunnels to anyone who wants one.

Applicability:

Home networks without native IPv6
Small offices without IPv6 from the ISP
Cloud VMs (Yandex Cloud, VK Cloud) for IPv6 connectivity
Testing and development of IPv6 applications
Dual-stack deployments

Advantages of Hurricane Electric Tunnelbroker

Free: Free IPv6 tunnel service
Global network: Tunnel endpoints worldwide
/48 IPv6 block: Enough addresses for any network
BGP option: For advanced users (your own ASN)
Stability: Hurricane Electric is a tier 1 IPv6 provider

Network Topology

                 Internet (IPv4)
                        │
                        │
                 ┌──────▼──────┐
                 │   VyOS      │
                 │   Router    │
                 │             │
      WAN ───────┤ eth0        │  Public IPv4: 203.0.113.1
                 │             │  (Dynamic DHCP)
                 │             │
                 │ tun0        │◄──── SIT Tunnel (6in4)
                 │             │      Local: 2001:470:1f1c:c8f::2/64
                 └──────┬──────┘      Remote: 2001:470:1f1c:c8f::1
                        │
                 ┌──────▼──────┐
                 │  LAN (IPv6) │
      eth1 ──────┤             │  2001:470:1f1d:c8f::1/64
                 │ Router Adv  │  (Routed /64)
                 └─────────────┘
                        │
                 ┌──────▼──────────┐
                 │  IPv6 Clients   │
                 │  (SLAAC)        │
                 └─────────────────┘

Configuration Parameters

You receive these parameters after registering a tunnel at https://tunnelbroker.net/

Parameter	Value (example)	Description
Server IPv4	216.66.86.114	HE tunnel endpoint
Client IPv4	203.0.113.1	Your public IPv4
Server IPv6	2001:470:1f1c:c8f::1/64	Tunnel remote address
Client IPv6	2001:470:1f1c:c8f::2/64	Tunnel local address
Routed /64	2001:470:1f1d:c8f::/64	For your LAN
Routed /48	2001:470:c8f::/48	Optional

Registering on Tunnelbroker.net

1. Creating an Account

Go to https://tunnelbroker.net/
Click Register → Fill out the form
Confirm your email

2. Creating a Tunnel

After logging in, click Create Regular Tunnel

Fill out the form:

IPv4 Endpoint (Your side): 203.0.113.1
(Your public IPv4 address)

Available Tunnel Servers: Choose the nearest one
(For example: Moscow, Russia for Russia)

Once created, you will receive:
- Server IPv4 Address: 216.66.86.114
- Server IPv6 Address: 2001:470:1f1c:c8f::1/64
- Client IPv6 Address: 2001:470:1f1c:c8f::2/64
- Routed IPv6 Prefixes:
  - Routed /64: 2001:470:1f1d:c8f::/64
  - Routed /48: 2001:470:c8f::/48 (optional)
On the Example Configurations tab → select VyOS for reference

3. Important Notes

Dynamic IP: If your IPv4 is dynamic (DHCP), use the Update button or the API to refresh the endpoint
Firewall: Make sure Protocol 41 (IPv6-in-IPv4) is allowed
MTU: 1480 is recommended for the tunnel interface

VyOS Configuration

Scenario 1: Single LAN (Simple Configuration)

Full Configuration

configure

# System settings
set system host-name vyos-ipv6-gateway
set system time-zone Europe/Moscow

# ===== WAN Interface (receives IPv4 from the ISP) =====

# DHCP client on WAN
set interfaces ethernet eth0 address dhcp
set interfaces ethernet eth0 description 'WAN'

# ===== Hurricane Electric IPv6 Tunnel =====

# SIT tunnel (6in4)
set interfaces tunnel tun0 encapsulation 'sit'
set interfaces tunnel tun0 description 'HE.NET IPv6 Tunnel'
set interfaces tunnel tun0 source-address '203.0.113.1'
set interfaces tunnel tun0 remote '216.66.86.114'
set interfaces tunnel tun0 address '2001:470:1f1c:c8f::2/64'
set interfaces tunnel tun0 mtu '1480'

# ===== IPv6 Routing =====

# Default IPv6 route via the tunnel
set protocols static route6 ::/0 interface tun0

# ===== LAN Interface (IPv6 for the local network) =====

# LAN with IPv6 from the routed /64
set interfaces ethernet eth1 address '2001:470:1f1d:c8f::1/64'
set interfaces ethernet eth1 description 'LAN'

# IPv4 for dual-stack (optional)
set interfaces ethernet eth1 address '192.168.1.1/24'

# ===== IPv6 Router Advertisement =====

# Enable Router Advertisement on the LAN
set service router-advert interface eth1 prefix 2001:470:1f1d:c8f::/64

# DNS servers (HE and Google)
set service router-advert interface eth1 name-server '2001:470:20::2'
set service router-advert interface eth1 name-server '2001:4860:4860::8888'

# RA parameters
set service router-advert interface eth1 default-lifetime '10800'
set service router-advert interface eth1 max-interval '600'
set service router-advert interface eth1 reachable-time '0'
set service router-advert interface eth1 retrans-timer '0'

# ===== System DNS =====

# Add IPv6 DNS for the router itself
set system name-server '2001:470:20::2'
set system name-server '2001:4860:4860::8888'

# IPv4 DNS (for dual-stack)
set system name-server '8.8.8.8'

# ===== IPv6 Firewall (recommended) =====

# Allow established/related
set firewall ipv6 name WAN6_LOCAL default-action 'drop'
set firewall ipv6 name WAN6_LOCAL rule 10 action 'accept'
set firewall ipv6 name WAN6_LOCAL rule 10 state established
set firewall ipv6 name WAN6_LOCAL rule 10 state related

# Allow ICMPv6
set firewall ipv6 name WAN6_LOCAL rule 20 action 'accept'
set firewall ipv6 name WAN6_LOCAL rule 20 protocol 'ipv6-icmp'

# Apply firewall
set interfaces tunnel tun0 firewall local ipv6-name 'WAN6_LOCAL'

# Firewall for WAN (allow Protocol 41)
set firewall name WAN_LOCAL default-action 'drop'
set firewall name WAN_LOCAL rule 10 action 'accept'
set firewall name WAN_LOCAL rule 10 state established
set firewall name WAN_LOCAL rule 10 state related
set firewall name WAN_LOCAL rule 20 action 'accept'
set firewall name WAN_LOCAL rule 20 protocol '41'
set firewall name WAN_LOCAL rule 20 description 'IPv6-in-IPv4'

set interfaces ethernet eth0 firewall local name 'WAN_LOCAL'

commit
save

Scenario 2: Multiple VLANs (Several Networks)

Using the /48 for multiple subnets:

configure

# Tunnel configuration (same as above)
set interfaces tunnel tun0 encapsulation 'sit'
set interfaces tunnel tun0 source-address '203.0.113.1'
set interfaces tunnel tun0 remote '216.66.86.114'
set interfaces tunnel tun0 address '2001:470:1f1c:c8f::2/64'
set protocols static route6 ::/0 interface tun0

# ===== VLAN 10 - Office Network =====
set interfaces ethernet eth1 vif 10 address '2001:470:c8f:10::1/64'
set interfaces ethernet eth1 vif 10 description 'Office VLAN'

set service router-advert interface eth1.10 prefix 2001:470:c8f:10::/64
set service router-advert interface eth1.10 name-server '2001:470:20::2'

# ===== VLAN 20 - Guest Network =====
set interfaces ethernet eth1 vif 20 address '2001:470:c8f:20::1/64'
set interfaces ethernet eth1 vif 20 description 'Guest VLAN'

set service router-advert interface eth1.20 prefix 2001:470:c8f:20::/64
set service router-advert interface eth1.20 name-server '2001:4860:4860::8888'

# ===== VLAN 30 - DMZ =====
set interfaces ethernet eth1 vif 30 address '2001:470:c8f:30::1/64'
set interfaces ethernet eth1 vif 30 description 'DMZ VLAN'

set service router-advert interface eth1.30 prefix 2001:470:c8f:30::/64
set service router-advert interface eth1.30 name-server '2001:470:20::2'

commit
save

Scenario 3: Dual-Stack (IPv4 + IPv6)

configure

# IPv6 tunnel (as above)
set interfaces tunnel tun0 encapsulation 'sit'
set interfaces tunnel tun0 source-address '203.0.113.1'
set interfaces tunnel tun0 remote '216.66.86.114'
set interfaces tunnel tun0 address '2001:470:1f1c:c8f::2/64'
set protocols static route6 ::/0 interface tun0

# ===== Dual-Stack LAN =====

# IPv4
set interfaces ethernet eth1 address '192.168.1.1/24'

# IPv6
set interfaces ethernet eth1 address '2001:470:1f1d:c8f::1/64'

# IPv4 DHCP Server
set service dhcp-server shared-network-name LAN subnet 192.168.1.0/24 default-router '192.168.1.1'
set service dhcp-server shared-network-name LAN subnet 192.168.1.0/24 name-server '192.168.1.1'
set service dhcp-server shared-network-name LAN subnet 192.168.1.0/24 range 0 start '192.168.1.100'
set service dhcp-server shared-network-name LAN subnet 192.168.1.0/24 range 0 stop '192.168.1.200'

# IPv6 Router Advertisement (SLAAC)
set service router-advert interface eth1 prefix 2001:470:1f1d:c8f::/64
set service router-advert interface eth1 name-server '2001:470:20::2'

# IPv4 NAT
set nat source rule 100 outbound-interface name 'eth0'
set nat source rule 100 source address '192.168.1.0/24'
set nat source rule 100 translation address 'masquerade'

# DNS Forwarding (dual-stack)
set service dns forwarding listen-address '192.168.1.1'
set service dns forwarding listen-address '2001:470:1f1d:c8f::1'
set service dns forwarding name-server '8.8.8.8'
set service dns forwarding name-server '2001:4860:4860::8888'

commit
save

Dynamic IP Update

The Problem

If your WAN IPv4 changes (DHCP), the tunnel will stop working.

Solution 1: Tunnelbroker Update Script

# Create the update script
sudo vi /config/scripts/update-he-tunnel.sh

#!/bin/bash

# Hurricane Electric tunnel credentials
TUNNEL_ID="12345"
USERNAME="your-username"
PASSWORD="your-update-key"

# Get current public IP
CURRENT_IP=$(curl -s -4 ifconfig.me)

# Update tunnel endpoint
curl -s "https://ipv4.tunnelbroker.net/ixp/1000/update?username=${USERNAME}&password=${PASSWORD}&hostname=${TUNNEL_ID}&myip=${CURRENT_IP}"

echo "$(date): Updated HE tunnel endpoint to ${CURRENT_IP}"

# Make executable
sudo chmod +x /config/scripts/update-he-tunnel.sh

# Add to task scheduler (run every 5 minutes)
configure
set system task-scheduler task update-he-tunnel executable path '/config/scripts/update-he-tunnel.sh'
set system task-scheduler task update-he-tunnel interval '5m'
commit
save

Solution 2: DDNS Integration

configure

# Use VyOS built-in DDNS with a custom service
set service dns dynamic interface eth0 service he-tunnel protocol 'custom'
set service dns dynamic interface eth0 service he-tunnel host-name 'your-tunnel-id.tunnelbroker.net'
set service dns dynamic interface eth0 service he-tunnel username 'your-username'
set service dns dynamic interface eth0 service he-tunnel password 'your-update-key'
set service dns dynamic interface eth0 service he-tunnel server 'ipv4.tunnelbroker.net/ixp/1000'

commit

Integration with Cloud Platforms

Yandex Cloud IPv6 Connectivity

Topology

Hurricane Electric Tunnel
        │
        │ 6in4
        │
VyOS VM in Yandex Cloud
        │
Yandex Cloud VMs (IPv6)

Specifics

VyOS VM in Yandex Cloud:

# Get a public IPv4 from Yandex Cloud
# Configure via the Yandex Cloud Console or CLI

# Yandex Cloud does not provide native IPv6 (yet)
# Tunnelbroker solves this problem

Configuration:

# WAN interface = Yandex Cloud network interface
set interfaces ethernet eth0 address '10.128.0.10/24'

# Get the public IP via metadata
# Or use an Elastic IP

# Tunnel source = Yandex Cloud public IP
set interfaces tunnel tun0 source-address '<yandex-cloud-public-ip>'

Yandex Cloud routing:

# Add IPv6 routes via VyOS
# In the Yandex Cloud routing table:
# ::/0 → 10.128.0.10 (VyOS internal IP)

Security Groups:

# Allow Protocol 41 (IPv6-in-IPv4) on the VyOS VM
# Yandex Cloud Security Group rule:
# Protocol: OTHER
# Protocol number: 41
# Source: 0.0.0.0/0

Yandex Cloud CLI

# Create a VM for VyOS
yc compute instance create \
  --name vyos-ipv6-gateway \
  --zone ru-central1-a \
  --network-interface subnet-name=default-ru-central1-a,nat-ip-version=ipv4 \
  --create-boot-disk image-folder-id=standard-images,image-family=vyos \
  --ssh-key ~/.ssh/id_rsa.pub

# Get the public IP
PUBLIC_IP=$(yc compute instance get vyos-ipv6-gateway --format json | jq -r '.network_interfaces[0].primary_v4_address.one_to_one_nat.address')

# Use this IP for tunnel registration on tunnelbroker.net
echo "Use this IP for HE tunnel: ${PUBLIC_IP}"

# Configure the Security Group for Protocol 41
yc vpc security-group update-rules default-sg-ru-central1-a \
  --add-rule "direction=ingress,protocol=41,v4-cidrs=[0.0.0.0/0]"

VK Cloud IPv6 Connectivity

Topology

Hurricane Electric Tunnel
        │
        │ 6in4
        │
VyOS VM in VK Cloud
        │
VK Cloud VMs (IPv6)

Specifics

VyOS VM in VK Cloud:

# Floating IP from VK Cloud
# VK Cloud also lacks native IPv6 (yet)

Configuration is analogous to Yandex Cloud

Security Groups:

# VK Cloud portal → Security Groups
# Add a rule:
# - Direction: Ingress
# - Protocol: Custom
# - Protocol Number: 41
# - Remote: 0.0.0.0/0

Verifying the Configuration

1. Checking the Tunnel

# Check the tunnel interface
show interfaces tunnel tun0

# The output should show:
# tun0: <POINTOPOINT,NOARP,UP,LOWER_UP>
# inet6 2001:470:1f1c:c8f::2/64 scope global

# Ping the HE tunnel endpoint (IPv6)
ping 2001:470:1f1c:c8f::1

# Ping Google IPv6 DNS
ping 2001:4860:4860::8888

# Traceroute through the tunnel
traceroute6 google.com

2. Checking IPv6 Routing

# Check the IPv6 routes
show ipv6 route

# The output should include:
# ::/0 via :: dev tun0, metric 1024
# 2001:470:1f1d:c8f::/64 dev eth1, metric 256

# Check IPv6 connectivity
ping6 ipv6.google.com
ping6 2a00:1450:4010:c0e::71

3. Checking Router Advertisement

# On VyOS
show service router-advert

# On a Linux client in the LAN
# Verify that an IPv6 address was received via SLAAC
ip -6 addr show

# The output should show a global IPv6:
# inet6 2001:470:1f1d:c8f:xxxx:xxxx:xxxx:xxxx/64 scope global dynamic

# Ping from the client
ping6 google.com

4. Testing DNS

# On VyOS
nslookup -type=AAAA google.com

# On the client
dig AAAA google.com @2001:470:20::2

5. Checking on tunnelbroker.net

Login → Your Tunnels → select the tunnel
Tunnel Details should show:
- Status: Active
- Endpoint: your current public IPv4
Traffic graphs will show usage

Troubleshooting

Problem: Tunnel Does Not Come Up

Symptoms:

show interfaces tunnel tun0
# State: DOWN

Solution:

Check the source IP:

# Make sure source-address matches your public IP
show interfaces tunnel tun0

# Check the actual public IP
curl -4 ifconfig.me

# Update the tunnel if needed
set interfaces tunnel tun0 source-address '<correct-public-ip>'
commit

Check the firewall:

# Protocol 41 must be allowed
show firewall name WAN_LOCAL

# Add it if it is missing
set firewall name WAN_LOCAL rule 20 action 'accept'
set firewall name WAN_LOCAL rule 20 protocol '41'
commit

Check connectivity to the HE endpoint:

# Ping the IPv4 endpoint
ping 216.66.86.114

Problem: Tunnel Is UP, but There Is No IPv6 Connectivity

Solution:

Check the default route:

show ipv6 route
# There should be ::/0 via tun0

# Add it if missing
set protocols static route6 ::/0 interface tun0
commit

Check DNS:

nslookup -type=AAAA google.com

# If it does not resolve, add IPv6 DNS
set system name-server '2001:4860:4860::8888'
commit

Ping test:

# Ping the HE gateway
ping 2001:470:1f1c:c8f::1

# Ping an external IPv6
ping 2001:4860:4860::8888

Problem: LAN Clients Do Not Get IPv6

Solution:

Check Router Advertisement:

show service router-advert

# Make sure it is configured for the LAN interface
show configuration commands | grep router-advert

# It should be:
# set service router-advert interface eth1 prefix ...

On a Linux client, check the RA:

sudo rdisc6 eth0
# It should show the RA from the router

Check the firewall:

# ICMPv6 must be allowed for RA
show firewall ipv6

# Allow it if needed
set firewall ipv6 name WAN6_IN rule 10 action 'accept'
set firewall ipv6 name WAN6_IN rule 10 protocol 'ipv6-icmp'
commit

Problem: High Latency or Packet Loss

Solution:

MTU optimization:

# Reduce the MTU on the tunnel
set interfaces tunnel tun0 mtu '1280'
commit

# MSS clamping for TCP
set interfaces tunnel tun0 ip adjust-mss '1240'
commit

Choose the nearest tunnel server:

# On tunnelbroker.net → Delete the tunnel
# Create a new tunnel with a different endpoint
# Choose a geographically closer server

Best Practices

Security

An IPv6 firewall is mandatory:

# IPv6 is not NAT; all devices are publicly reachable
# A firewall is critically important

set firewall ipv6 name LAN6_IN default-action 'drop'
set firewall ipv6 name LAN6_IN rule 10 action 'accept'
set firewall ipv6 name LAN6_IN rule 10 state established
set firewall ipv6 name LAN6_IN rule 10 state related
# Add specific allow rules

Privacy Extensions:

# Enable IPv6 privacy extensions on the clients
# Linux: net.ipv6.conf.all.use_tempaddr = 2
# Windows: netsh interface ipv6 set privacy state=enabled

Performance

MTU Optimization:

# 1480 is usually optimal for 6in4
set interfaces tunnel tun0 mtu '1480'

A nearby endpoint:
- Choose a geographically close HE tunnel server
- Lower latency = better performance

Monitoring

Tunnel monitoring:

# Ping the HE gateway every minute
# Alert if it is down

#!/bin/bash
while true; do
  ping6 -c 1 2001:470:1f1c:c8f::1 > /dev/null
  if [ $? -ne 0 ]; then
    echo "$(date): HE tunnel down!" | mail -s "IPv6 Alert" admin@example.com
  fi
  sleep 60
done

Traffic statistics:

show interfaces tunnel tun0
# Check the RX/TX bytes

Additional Resources

Hurricane Electric Tunnelbroker
HE IPv6 Certification - Free IPv6 courses
VyOS IPv6 Documentation
IPv6 Best Practices

Tested on: VyOS 1.4 (Sagitta LTS), VyOS 1.5 (Circinus), Hurricane Electric Tunnelbroker Last updated: 2025-10-14

Reviewed by OpenNix LLC · Last updated on 29 July 2026

Site-to-Site VPN to Microsoft Azure with BGP Redundant VPN to Microsoft Azure