# Tunnelbroker.net - IPv6 via Hurricane Electric

> IPv6 via Hurricane Electric Tunnelbroker.net on VyOS - SIT tunnel (6in4), IPv6 routing and Router Advertisement for the LAN

Source: https://opennix.org/en/docs/vyos/examples/tunnelbroker-ipv6/


Setting up IPv6 connectivity via Hurricane Electric Tunnelbroker.net using a SIT (Simple Internet Transition) tunnel on VyOS.

## Scenario Overview

### Use Case

Obtaining IPv6 connectivity for networks where the ISP does not provide native IPv6. Tunnelbroker.net offers free IPv6 tunnels to anyone who wants one.

**Applicability**:
- Home networks without native IPv6
- Small offices without IPv6 from the ISP
- Cloud VMs (Yandex Cloud, VK Cloud) for IPv6 connectivity
- Testing and development of IPv6 applications
- Dual-stack deployments

### Advantages of Hurricane Electric Tunnelbroker

- **Free**: Free IPv6 tunnel service
- **Global network**: Tunnel endpoints worldwide
- **/48 IPv6 block**: Enough addresses for any network
- **BGP option**: For advanced users (your own ASN)
- **Stability**: Hurricane Electric is a tier 1 IPv6 provider

## Network Topology

```
                 Internet (IPv4)
                        │
                        │
                 ┌──────▼──────┐
                 │   VyOS      │
                 │   Router    │
                 │             │
      WAN ───────┤ eth0        │  Public IPv4: 203.0.113.1
                 │             │  (Dynamic DHCP)
                 │             │
                 │ tun0        │◄──── SIT Tunnel (6in4)
                 │             │      Local: 2001:470:1f1c:c8f::2/64
                 └──────┬──────┘      Remote: 2001:470:1f1c:c8f::1
                        │
                 ┌──────▼──────┐
                 │  LAN (IPv6) │
      eth1 ──────┤             │  2001:470:1f1d:c8f::1/64
                 │ Router Adv  │  (Routed /64)
                 └─────────────┘
                        │
                 ┌──────▼──────────┐
                 │  IPv6 Clients   │
                 │  (SLAAC)        │
                 └─────────────────┘
```

### Configuration Parameters

You receive these parameters after registering a tunnel at https://tunnelbroker.net/

| Parameter | Value (example) | Description |
|----------|-------------------|----------|
| **Server IPv4** | 216.66.86.114 | HE tunnel endpoint |
| **Client IPv4** | 203.0.113.1 | Your public IPv4 |
| **Server IPv6** | 2001:470:1f1c:c8f::1/64 | Tunnel remote address |
| **Client IPv6** | 2001:470:1f1c:c8f::2/64 | Tunnel local address |
| **Routed /64** | 2001:470:1f1d:c8f::/64 | For your LAN |
| **Routed /48** | 2001:470:c8f::/48 | Optional |

## Registering on Tunnelbroker.net

### 1. Creating an Account

1. Go to https://tunnelbroker.net/
2. Click **Register** → Fill out the form
3. Confirm your email

### 2. Creating a Tunnel

1. After logging in, click **Create Regular Tunnel**

2. Fill out the form:
   ```
   IPv4 Endpoint (Your side): 203.0.113.1
   (Your public IPv4 address)

   Available Tunnel Servers: Choose the nearest one
   (For example: Moscow, Russia for Russia)
   ```

3. Once created, you will receive:
   - **Server IPv4 Address**: 216.66.86.114
   - **Server IPv6 Address**: 2001:470:1f1c:c8f::1/64
   - **Client IPv6 Address**: 2001:470:1f1c:c8f::2/64
   - **Routed IPv6 Prefixes**:
     - Routed /64: 2001:470:1f1d:c8f::/64
     - Routed /48: 2001:470:c8f::/48 (optional)

4. On the **Example Configurations** tab → select **VyOS** for reference

### 3. Important Notes

- **Dynamic IP**: If your IPv4 is dynamic (DHCP), use the **Update** button or the API to refresh the endpoint
- **Firewall**: Make sure Protocol 41 (IPv6-in-IPv4) is allowed
- **MTU**: 1480 is recommended for the tunnel interface

## VyOS Configuration

### Scenario 1: Single LAN (Simple Configuration)

#### Full Configuration

```bash
configure

# System settings
set system host-name vyos-ipv6-gateway
set system time-zone Europe/Moscow

# ===== WAN Interface (receives IPv4 from the ISP) =====

# DHCP client on WAN
set interfaces ethernet eth0 address dhcp
set interfaces ethernet eth0 description 'WAN'

# ===== Hurricane Electric IPv6 Tunnel =====

# SIT tunnel (6in4)
set interfaces tunnel tun0 encapsulation 'sit'
set interfaces tunnel tun0 description 'HE.NET IPv6 Tunnel'
set interfaces tunnel tun0 source-address '203.0.113.1'
set interfaces tunnel tun0 remote '216.66.86.114'
set interfaces tunnel tun0 address '2001:470:1f1c:c8f::2/64'
set interfaces tunnel tun0 mtu '1480'

# ===== IPv6 Routing =====

# Default IPv6 route via the tunnel
set protocols static route6 ::/0 interface tun0

# ===== LAN Interface (IPv6 for the local network) =====

# LAN with IPv6 from the routed /64
set interfaces ethernet eth1 address '2001:470:1f1d:c8f::1/64'
set interfaces ethernet eth1 description 'LAN'

# IPv4 for dual-stack (optional)
set interfaces ethernet eth1 address '192.168.1.1/24'

# ===== IPv6 Router Advertisement =====

# Enable Router Advertisement on the LAN
set service router-advert interface eth1 prefix 2001:470:1f1d:c8f::/64

# DNS servers (HE and Google)
set service router-advert interface eth1 name-server '2001:470:20::2'
set service router-advert interface eth1 name-server '2001:4860:4860::8888'

# RA parameters
set service router-advert interface eth1 default-lifetime '10800'
set service router-advert interface eth1 max-interval '600'
set service router-advert interface eth1 reachable-time '0'
set service router-advert interface eth1 retrans-timer '0'

# ===== System DNS =====

# Add IPv6 DNS for the router itself
set system name-server '2001:470:20::2'
set system name-server '2001:4860:4860::8888'

# IPv4 DNS (for dual-stack)
set system name-server '8.8.8.8'

# ===== IPv6 Firewall (recommended) =====

# Allow established/related
set firewall ipv6 name WAN6_LOCAL default-action 'drop'
set firewall ipv6 name WAN6_LOCAL rule 10 action 'accept'
set firewall ipv6 name WAN6_LOCAL rule 10 state established
set firewall ipv6 name WAN6_LOCAL rule 10 state related

# Allow ICMPv6
set firewall ipv6 name WAN6_LOCAL rule 20 action 'accept'
set firewall ipv6 name WAN6_LOCAL rule 20 protocol 'ipv6-icmp'

# Apply firewall
set interfaces tunnel tun0 firewall local ipv6-name 'WAN6_LOCAL'

# Firewall for WAN (allow Protocol 41)
set firewall name WAN_LOCAL default-action 'drop'
set firewall name WAN_LOCAL rule 10 action 'accept'
set firewall name WAN_LOCAL rule 10 state established
set firewall name WAN_LOCAL rule 10 state related
set firewall name WAN_LOCAL rule 20 action 'accept'
set firewall name WAN_LOCAL rule 20 protocol '41'
set firewall name WAN_LOCAL rule 20 description 'IPv6-in-IPv4'

set interfaces ethernet eth0 firewall local name 'WAN_LOCAL'

commit
save
```

### Scenario 2: Multiple VLANs (Several Networks)

Using the /48 for multiple subnets:

```bash
configure

# Tunnel configuration (same as above)
set interfaces tunnel tun0 encapsulation 'sit'
set interfaces tunnel tun0 source-address '203.0.113.1'
set interfaces tunnel tun0 remote '216.66.86.114'
set interfaces tunnel tun0 address '2001:470:1f1c:c8f::2/64'
set protocols static route6 ::/0 interface tun0

# ===== VLAN 10 - Office Network =====
set interfaces ethernet eth1 vif 10 address '2001:470:c8f:10::1/64'
set interfaces ethernet eth1 vif 10 description 'Office VLAN'

set service router-advert interface eth1.10 prefix 2001:470:c8f:10::/64
set service router-advert interface eth1.10 name-server '2001:470:20::2'

# ===== VLAN 20 - Guest Network =====
set interfaces ethernet eth1 vif 20 address '2001:470:c8f:20::1/64'
set interfaces ethernet eth1 vif 20 description 'Guest VLAN'

set service router-advert interface eth1.20 prefix 2001:470:c8f:20::/64
set service router-advert interface eth1.20 name-server '2001:4860:4860::8888'

# ===== VLAN 30 - DMZ =====
set interfaces ethernet eth1 vif 30 address '2001:470:c8f:30::1/64'
set interfaces ethernet eth1 vif 30 description 'DMZ VLAN'

set service router-advert interface eth1.30 prefix 2001:470:c8f:30::/64
set service router-advert interface eth1.30 name-server '2001:470:20::2'

commit
save
```

### Scenario 3: Dual-Stack (IPv4 + IPv6)

```bash
configure

# IPv6 tunnel (as above)
set interfaces tunnel tun0 encapsulation 'sit'
set interfaces tunnel tun0 source-address '203.0.113.1'
set interfaces tunnel tun0 remote '216.66.86.114'
set interfaces tunnel tun0 address '2001:470:1f1c:c8f::2/64'
set protocols static route6 ::/0 interface tun0

# ===== Dual-Stack LAN =====

# IPv4
set interfaces ethernet eth1 address '192.168.1.1/24'

# IPv6
set interfaces ethernet eth1 address '2001:470:1f1d:c8f::1/64'

# IPv4 DHCP Server
set service dhcp-server shared-network-name LAN subnet 192.168.1.0/24 default-router '192.168.1.1'
set service dhcp-server shared-network-name LAN subnet 192.168.1.0/24 name-server '192.168.1.1'
set service dhcp-server shared-network-name LAN subnet 192.168.1.0/24 range 0 start '192.168.1.100'
set service dhcp-server shared-network-name LAN subnet 192.168.1.0/24 range 0 stop '192.168.1.200'

# IPv6 Router Advertisement (SLAAC)
set service router-advert interface eth1 prefix 2001:470:1f1d:c8f::/64
set service router-advert interface eth1 name-server '2001:470:20::2'

# IPv4 NAT
set nat source rule 100 outbound-interface name 'eth0'
set nat source rule 100 source address '192.168.1.0/24'
set nat source rule 100 translation address 'masquerade'

# DNS Forwarding (dual-stack)
set service dns forwarding listen-address '192.168.1.1'
set service dns forwarding listen-address '2001:470:1f1d:c8f::1'
set service dns forwarding name-server '8.8.8.8'
set service dns forwarding name-server '2001:4860:4860::8888'

commit
save
```

## Dynamic IP Update

### The Problem

If your WAN IPv4 changes (DHCP), the tunnel will stop working.

### Solution 1: Tunnelbroker Update Script

```bash
# Create the update script
sudo vi /config/scripts/update-he-tunnel.sh
```

```bash
#!/bin/bash

# Hurricane Electric tunnel credentials
TUNNEL_ID="12345"
USERNAME="your-username"
PASSWORD="your-update-key"

# Get current public IP
CURRENT_IP=$(curl -s -4 ifconfig.me)

# Update tunnel endpoint
curl -s "https://ipv4.tunnelbroker.net/ixp/1000/update?username=${USERNAME}&password=${PASSWORD}&hostname=${TUNNEL_ID}&myip=${CURRENT_IP}"

echo "$(date): Updated HE tunnel endpoint to ${CURRENT_IP}"
```

```bash
# Make executable
sudo chmod +x /config/scripts/update-he-tunnel.sh

# Add to task scheduler (run every 5 minutes)
configure
set system task-scheduler task update-he-tunnel executable path '/config/scripts/update-he-tunnel.sh'
set system task-scheduler task update-he-tunnel interval '5m'
commit
save
```

### Solution 2: DDNS Integration

```bash
configure

# Use VyOS built-in DDNS with a custom service
set service dns dynamic interface eth0 service he-tunnel protocol 'custom'
set service dns dynamic interface eth0 service he-tunnel host-name 'your-tunnel-id.tunnelbroker.net'
set service dns dynamic interface eth0 service he-tunnel username 'your-username'
set service dns dynamic interface eth0 service he-tunnel password 'your-update-key'
set service dns dynamic interface eth0 service he-tunnel server 'ipv4.tunnelbroker.net/ixp/1000'

commit
```

## Integration with Cloud Platforms

### Yandex Cloud IPv6 Connectivity

#### Topology

```
Hurricane Electric Tunnel
        │
        │ 6in4
        │
VyOS VM in Yandex Cloud
        │
Yandex Cloud VMs (IPv6)
```

#### Specifics

1. **VyOS VM in Yandex Cloud**:
   ```bash
   # Get a public IPv4 from Yandex Cloud
   # Configure via the Yandex Cloud Console or CLI

   # Yandex Cloud does not provide native IPv6 (yet)
   # Tunnelbroker solves this problem
   ```

2. **Configuration**:
   ```bash
   # WAN interface = Yandex Cloud network interface
   set interfaces ethernet eth0 address '10.128.0.10/24'

   # Get the public IP via metadata
   # Or use an Elastic IP

   # Tunnel source = Yandex Cloud public IP
   set interfaces tunnel tun0 source-address '<yandex-cloud-public-ip>'
   ```

3. **Yandex Cloud routing**:
   ```bash
   # Add IPv6 routes via VyOS
   # In the Yandex Cloud routing table:
   # ::/0 → 10.128.0.10 (VyOS internal IP)
   ```

4. **Security Groups**:
   ```bash
   # Allow Protocol 41 (IPv6-in-IPv4) on the VyOS VM
   # Yandex Cloud Security Group rule:
   # Protocol: OTHER
   # Protocol number: 41
   # Source: 0.0.0.0/0
   ```

#### Yandex Cloud CLI

```bash
# Create a VM for VyOS
yc compute instance create \
  --name vyos-ipv6-gateway \
  --zone ru-central1-a \
  --network-interface subnet-name=default-ru-central1-a,nat-ip-version=ipv4 \
  --create-boot-disk image-folder-id=standard-images,image-family=vyos \
  --ssh-key ~/.ssh/id_rsa.pub

# Get the public IP
PUBLIC_IP=$(yc compute instance get vyos-ipv6-gateway --format json | jq -r '.network_interfaces[0].primary_v4_address.one_to_one_nat.address')

# Use this IP for tunnel registration on tunnelbroker.net
echo "Use this IP for HE tunnel: ${PUBLIC_IP}"

# Configure the Security Group for Protocol 41
yc vpc security-group update-rules default-sg-ru-central1-a \
  --add-rule "direction=ingress,protocol=41,v4-cidrs=[0.0.0.0/0]"
```

### VK Cloud IPv6 Connectivity

#### Topology

```
Hurricane Electric Tunnel
        │
        │ 6in4
        │
VyOS VM in VK Cloud
        │
VK Cloud VMs (IPv6)
```

#### Specifics

1. **VyOS VM in VK Cloud**:
   ```bash
   # Floating IP from VK Cloud
   # VK Cloud also lacks native IPv6 (yet)
   ```

2. **Configuration is analogous to Yandex Cloud**

3. **Security Groups**:
   ```bash
   # VK Cloud portal → Security Groups
   # Add a rule:
   # - Direction: Ingress
   # - Protocol: Custom
   # - Protocol Number: 41
   # - Remote: 0.0.0.0/0
   ```

## Verifying the Configuration

### 1. Checking the Tunnel

```bash
# Check the tunnel interface
show interfaces tunnel tun0

# The output should show:
# tun0: <POINTOPOINT,NOARP,UP,LOWER_UP>
# inet6 2001:470:1f1c:c8f::2/64 scope global

# Ping the HE tunnel endpoint (IPv6)
ping 2001:470:1f1c:c8f::1

# Ping Google IPv6 DNS
ping 2001:4860:4860::8888

# Traceroute through the tunnel
traceroute6 google.com
```

### 2. Checking IPv6 Routing

```bash
# Check the IPv6 routes
show ipv6 route

# The output should include:
# ::/0 via :: dev tun0, metric 1024
# 2001:470:1f1d:c8f::/64 dev eth1, metric 256

# Check IPv6 connectivity
ping6 ipv6.google.com
ping6 2a00:1450:4010:c0e::71
```

### 3. Checking Router Advertisement

```bash
# On VyOS
show service router-advert

# On a Linux client in the LAN
# Verify that an IPv6 address was received via SLAAC
ip -6 addr show

# The output should show a global IPv6:
# inet6 2001:470:1f1d:c8f:xxxx:xxxx:xxxx:xxxx/64 scope global dynamic

# Ping from the client
ping6 google.com
```

### 4. Testing DNS

```bash
# On VyOS
nslookup -type=AAAA google.com

# On the client
dig AAAA google.com @2001:470:20::2
```

### 5. Checking on tunnelbroker.net

1. Login → **Your Tunnels** → select the tunnel
2. **Tunnel Details** should show:
   - Status: Active
   - Endpoint: your current public IPv4
3. **Traffic** graphs will show usage

## Troubleshooting

### Problem: Tunnel Does Not Come Up

**Symptoms**:
```bash
show interfaces tunnel tun0
# State: DOWN
```

**Solution**:

1. Check the source IP:
```bash
# Make sure source-address matches your public IP
show interfaces tunnel tun0

# Check the actual public IP
curl -4 ifconfig.me

# Update the tunnel if needed
set interfaces tunnel tun0 source-address '<correct-public-ip>'
commit
```

2. Check the firewall:
```bash
# Protocol 41 must be allowed
show firewall name WAN_LOCAL

# Add it if it is missing
set firewall name WAN_LOCAL rule 20 action 'accept'
set firewall name WAN_LOCAL rule 20 protocol '41'
commit
```

3. Check connectivity to the HE endpoint:
```bash
# Ping the IPv4 endpoint
ping 216.66.86.114
```

### Problem: Tunnel Is UP, but There Is No IPv6 Connectivity

**Solution**:

1. Check the default route:
```bash
show ipv6 route
# There should be ::/0 via tun0

# Add it if missing
set protocols static route6 ::/0 interface tun0
commit
```

2. Check DNS:
```bash
nslookup -type=AAAA google.com

# If it does not resolve, add IPv6 DNS
set system name-server '2001:4860:4860::8888'
commit
```

3. Ping test:
```bash
# Ping the HE gateway
ping 2001:470:1f1c:c8f::1

# Ping an external IPv6
ping 2001:4860:4860::8888
```

### Problem: LAN Clients Do Not Get IPv6

**Solution**:

1. Check Router Advertisement:
```bash
show service router-advert

# Make sure it is configured for the LAN interface
show configuration commands | grep router-advert

# It should be:
# set service router-advert interface eth1 prefix ...
```

2. On a Linux client, check the RA:
```bash
sudo rdisc6 eth0
# It should show the RA from the router
```

3. Check the firewall:
```bash
# ICMPv6 must be allowed for RA
show firewall ipv6

# Allow it if needed
set firewall ipv6 name WAN6_IN rule 10 action 'accept'
set firewall ipv6 name WAN6_IN rule 10 protocol 'ipv6-icmp'
commit
```

### Problem: High Latency or Packet Loss

**Solution**:

1. MTU optimization:
```bash
# Reduce the MTU on the tunnel
set interfaces tunnel tun0 mtu '1280'
commit

# MSS clamping for TCP
set interfaces tunnel tun0 ip adjust-mss '1240'
commit
```

2. Choose the nearest tunnel server:
```bash
# On tunnelbroker.net → Delete the tunnel
# Create a new tunnel with a different endpoint
# Choose a geographically closer server
```

## Best Practices

### Security

1. **An IPv6 firewall is mandatory**:
   ```bash
   # IPv6 is not NAT; all devices are publicly reachable
   # A firewall is critically important

   set firewall ipv6 name LAN6_IN default-action 'drop'
   set firewall ipv6 name LAN6_IN rule 10 action 'accept'
   set firewall ipv6 name LAN6_IN rule 10 state established
   set firewall ipv6 name LAN6_IN rule 10 state related
   # Add specific allow rules
   ```

2. **Privacy Extensions**:
   ```bash
   # Enable IPv6 privacy extensions on the clients
   # Linux: net.ipv6.conf.all.use_tempaddr = 2
   # Windows: netsh interface ipv6 set privacy state=enabled
   ```

### Performance

1. **MTU Optimization**:
   ```bash
   # 1480 is usually optimal for 6in4
   set interfaces tunnel tun0 mtu '1480'
   ```

2. **A nearby endpoint**:
   - Choose a geographically close HE tunnel server
   - Lower latency = better performance

### Monitoring

1. **Tunnel monitoring**:
   ```bash
   # Ping the HE gateway every minute
   # Alert if it is down

   #!/bin/bash
   while true; do
     ping6 -c 1 2001:470:1f1c:c8f::1 > /dev/null
     if [ $? -ne 0 ]; then
       echo "$(date): HE tunnel down!" | mail -s "IPv6 Alert" admin@example.com
     fi
     sleep 60
   done
   ```

2. **Traffic statistics**:
   ```bash
   show interfaces tunnel tun0
   # Check the RX/TX bytes
   ```

## Additional Resources

- [Hurricane Electric Tunnelbroker](https://tunnelbroker.net/)
- [HE IPv6 Certification](https://ipv6.he.net/certification/) - Free IPv6 courses
- [VyOS IPv6 Documentation](https://docs.vyos.io/en/latest/configuration/interfaces/tunnel.html)
- [IPv6 Best Practices](/docs/vyos/system/vyos-ipv6/)

---

**Tested on**: VyOS 1.4 (Sagitta LTS), VyOS 1.5 (Circinus), Hurricane Electric Tunnelbroker
**Last updated**: 2025-10-14