Assign ipv6 address to KVM guests on bridge mode

hlx98007 asked:

System: CentOS 6.5

Network: Bridge on br0

IPv6: ISP Native /64 block.

IPv4: ISP address (not internal LAN)

Purpose: To assign IPv6 only to guests (manually), I don’t want ipv4 address to be assigned to guest OS.


On Host:

/etc/sysctl.conf:

net.ipv4.ip_forward = 1
net.ipv6.conf.all.forwarding = 1 
net.ipv6.conf.br0.forwarding = 1
net.ipv6.conf.default.forwarding = 1

brctl show

bridge name     bridge id               STP enabled     interfaces
br0             8000.e840f2ecdfed       no              eth0
                                                        vnet0
virbr0          8000.52540051ef3c       yes             virbr0-nic

ifconfig:

br0       Link encap:Ethernet  HWaddr E8:40:F2:EC:DF:ED  
      inet addr:xxx.xxx.xxx.xxx  Bcast:xxx.xxx.xxx.255  Mask:255.255.255.0
      inet6 addr: 2607:beef:be:beef::1/64 Scope:Global
      inet6 addr: fe80::ea40:f2ff:feec:dfed/64 Scope:Link
      UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
      RX packets:365707 errors:0 dropped:0 overruns:0 frame:0
      TX packets:470458 errors:0 dropped:0 overruns:0 carrier:0
      collisions:0 txqueuelen:0 
      RX bytes:28867567 (27.5 MiB)  TX bytes:574512176 (547.8 MiB)

eth0      Link encap:Ethernet  HWaddr E8:40:F2:EC:DF:ED  
      inet6 addr: fe80::ea40:f2ff:feec:dfed/64 Scope:Link
      UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
      RX packets:392675 errors:0 dropped:0 overruns:0 frame:0
      TX packets:608319 errors:0 dropped:0 overruns:0 carrier:0
      collisions:0 txqueuelen:1000 
      RX bytes:46359514 (44.2 MiB)  TX bytes:586262036 (559.1 MiB)
      Interrupt:20 Memory:fe500000-fe520000 

/etc/sysconfig/networt-scripts/ifcfg-br0:

DEVICE=br0
BOOTPROTO=static
IPADDR=xxx.xxx.xxx.xxx
NETMASK=255.255.255.0
ONBOOT=yes
GATEWAY=xxx.xxx.xxx.xxx
IPV6INIT=yes
IPV6_AUTOCONF=no
IPV6ADDR=2607:beef:be:beef::1/64
TYPE=Bridge
DELAY=0

cat /etc/sysconfig/network-scripts/route6-br0

2607:beef:be:bff:ff:ff:ff:ff dev br0
default via 2607:beef:be:bff:ff:ff:ff:ff

route -A inet6 -n

Kernel IPv6 routing table
Destination                                 Next Hop                                Flags Metric Ref    Use Iface
2607:beef:be:beef::/64                       ::                                      U     256    0        0 br0     
2607:beef:be:bff:ff:ff:ff:ff/128            ::                                      U     1024   1        0 br0     
fe80::/64                                   ::                                      U     256    0        0 virbr0  
fe80::/64                                   ::                                      U     256    0        0 vnet0   
fe80::/64                                   ::                                      U     256    0        0 br0     
fe80::/64                                   ::                                      U     256    0        0 eth0    
::/0                                        2607:beef:be:bff:ff:ff:ff:ff            UG    1024   20281       4 br0     
::1/128                                     ::                                      U     0      1        1 lo      
2607:beef:be:beef::/128                      ::                                      U     0      0        1 lo      
2607:beef:be:beef::1/128                     ::                                      U     0      36128       1 lo     
...

ip6tables -S:

-P INPUT ACCEPT
-P FORWARD ACCEPT
-P OUTPUT ACCEPT
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT 
-A INPUT -p ipv6-icmp -j ACCEPT 
-A INPUT -i lo -j ACCEPT 
-A INPUT -p tcp -m state --state NEW -m tcp --dport 8888 -j ACCEPT 
-A INPUT -j REJECT --reject-with icmp6-adm-prohibited 
-A FORWARD -s 2607:beef:be:beef::/64 -i br0 -j ACCEPT 

On Guest:

OS: CentOS 6.5 minimal

Network: Manual

cat /etc/sysconfig/network-scripts/ifcfg-eth0:

ONBOOT=yes
NM_CONTROLLED=no
IPV6INIT=yes
IPV6ADDR=2607:beef:be:beef::2/64
IPV6_DEFAULTGW=2607:beef:be:beef::1 (The host's ipv6 address)

Behaviour:

On Host, I can ping guest’s ipv6 address, vise-vesa.

I cannot ping any other ipv6 address from guest, including google dns 2001:4860:4860::8888/8844. (Timed out)

I cannot ping from any non-assigned ISP ipv6 address to guest. (Timed out)

ping6 from Hosts to outside is OK.


Update:

  1. If I change Guest’s gateway to 2607:beef:be:bff:ff:ff:ff:ff (Host’s gateway), the guest will complain “no route to host”. Even I added the static route info (route6-eth0) to the Guest, it still won’t connect.

Could anyone help me figure out what is going on please? Thanks.

My answer:


Your gateway is wrong in your guest.

Since you bridged your network connection, it is as if the VM is on the same subnet (LAN) as the host. Thus it needs to use the same gateway address as the host.


View the full question and answer on Server Fault.

Creative Commons License
This work is licensed under a Creative Commons Attribution-ShareAlike 3.0 Unported License.