Home / server / Questions / 994625
In Process
Steffen
Asked: 2019-12-07 09:30:53 +0800 CST

Enable IPV6FORWARDING on KVM host on CentOS 7

  • 772

I have here a KVM host on which is running CentOS 7. If my /etc/sysconfig/network looks like

HOSTNAME=myname
NETWORKING_IPV6=yes
NETWORKING=yes

IPv6 was enabled and I get a global IPv6 address:

# ifconfig
br0-enp3s0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
    inet 192.168.1.3  netmask 255.255.255.0  broadcast 192.168.1.255
    inet6 2a02:aaa:bbbb:cccc:82ee:73ff:fe9d:5909  prefixlen 64  scopeid 0x0<global>
    inet6 fe80::82ee:73ff:fe9d:5909  prefixlen 64  scopeid 0x20<link>
    ether 80:ee:73:9d:59:09  txqueuelen 1000  (Ethernet)
    RX packets 5798  bytes 614164 (599.7 KiB)
    RX errors 0  dropped 1842  overruns 0  frame 0
    TX packets 3037  bytes 3130986 (2.9 MiB)
    TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

enp3s0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
    inet6 fe80::82ee:73ff:fe9d:5909  prefixlen 64  scopeid 0x20<link>
    ether 80:ee:73:9d:59:09  txqueuelen 1000  (Ethernet)
    RX packets 7595  bytes 915426 (893.9 KiB)
    RX errors 0  dropped 0  overruns 0  frame 0
    TX packets 5790  bytes 3458964 (3.2 MiB)
    TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

lo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536
    inet 127.0.0.1  netmask 255.0.0.0
    inet6 ::1  prefixlen 128  scopeid 0x10<host>
    loop  txqueuelen 1000  (Lokale Schleife)
    RX packets 2874  bytes 2846558 (2.7 MiB)
    RX errors 0  dropped 0  overruns 0  frame 0
    TX packets 2874  bytes 2846558 (2.7 MiB)
    TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

virbr0: flags=4099<UP,BROADCAST,MULTICAST>  mtu 1500
    inet 192.169.1.1  netmask 255.255.255.0  broadcast 192.169.1.255
    ether 52:54:00:88:24:d4  txqueuelen 1000  (Ethernet)
    RX packets 0  bytes 0 (0.0 B)
    RX errors 0  dropped 0  overruns 0  frame 0
    TX packets 0  bytes 0 (0.0 B)
    TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

vnet0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
    inet6 fe80::fc54:ff:fe08:24af  prefixlen 64  scopeid 0x20<link>
    ether fe:54:00:08:24:af  txqueuelen 1000  (Ethernet)
    RX packets 733  bytes 206871 (202.0 KiB)
    RX errors 0  dropped 0  overruns 0  frame 0
    TX packets 4312  bytes 400237 (390.8 KiB)
    TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

But if I enable IPV6FORWARDING in /etc/sysconfig/network:

HOSTNAME=myname
NETWORKING_IPV6=yes
NETWORKING=yes
IPV6FORWARDING=yes

I get no global IPv6 address:

# ifconfig
br0-enp3s0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
    inet 192.168.1.3  netmask 255.255.255.0  broadcast 192.168.1.255
    inet6 fe80::82ee:73ff:fe9d:5909  prefixlen 64  scopeid 0x20<link>
    ether 80:ee:73:9d:59:09  txqueuelen 1000  (Ethernet)
    RX packets 8727  bytes 995519 (972.1 KiB)
    RX errors 0  dropped 2446  overruns 0  frame 0
    TX packets 4970  bytes 6890188 (6.5 MiB)
    TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

enp3s0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
    inet6 fe80::82ee:73ff:fe9d:5909  prefixlen 64  scopeid 0x20<link>
    ether 80:ee:73:9d:59:09  txqueuelen 1000  (Ethernet)
    RX packets 11014  bytes 1383620 (1.3 MiB)
    RX errors 0  dropped 0  overruns 0  frame 0
    TX packets 10205  bytes 7423351 (7.0 MiB)
    TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

lo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536
    inet 127.0.0.1  netmask 255.0.0.0
    inet6 ::1  prefixlen 128  scopeid 0x10<host>
    loop  txqueuelen 1000  (Lokale Schleife)
    RX packets 6159  bytes 6792034 (6.4 MiB)
    RX errors 0  dropped 0  overruns 0  frame 0
    TX packets 6159  bytes 6792034 (6.4 MiB)
    TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

virbr0: flags=4099<UP,BROADCAST,MULTICAST>  mtu 1500
    inet 192.169.1.1  netmask 255.255.255.0  broadcast 192.169.1.255
    ether 52:54:00:88:24:d4  txqueuelen 1000  (Ethernet)
    RX packets 0  bytes 0 (0.0 B)
    RX errors 0  dropped 0  overruns 0  frame 0
    TX packets 0  bytes 0 (0.0 B)
    TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

vnet0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
    inet6 fe80::fc54:ff:fe08:24af  prefixlen 64  scopeid 0x20<link>
    ether fe:54:00:08:24:af  txqueuelen 1000  (Ethernet)
    RX packets 885  bytes 262087 (255.9 KiB)
    RX errors 0  dropped 0  overruns 0  frame 0
    TX packets 5626  bytes 512476 (500.4 KiB)
    TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

Content of the '/etc/sysctl.conf' is currently (already included the 'net.ipv6.conf.all.accept_ra' configuration of the answer of "A.B"):

# System default settings live in /usr/lib/sysctl.d/00-system.conf.
# To override those settings, enter new settings here, or in an /etc/sysctl.d/<name>.conf file
#
# For more information, see sysctl.conf(5) and sysctl.d(5).

#
# openvpn routing
#
net.ipv4.ip_forward=1

net.ipv6.conf.all.accept_ra=2

On other CentOS 7 machines on which no KVM host is installed it works. Anybody knows why?

EDIT 19.12.09

Adding content of '/etc/sysctl.conf' and adding full output of 'ifconfig'

centos7

1 Answers

  1. Here's a wild guess, considering you didn't provide much information (including the Host OS distribution):

    Your system has probably this default sysctl setting:

    # sysctl net.ipv6.conf.all.accept_ra
net.ipv6.conf.all.accept_ra = 1

    Here's the description:

    accept_ra - INTEGER
  Accept Router Advertisements; autoconfigure using them.

  It also determines whether or not to transmit Router
  Solicitations. If and only if the functional setting is to
  accept Router Advertisements, Router Solicitations will be
  transmitted.

  Possible values are:
      0 Do not accept Router Advertisements.
      1 Accept Router Advertisements if forwarding is disabled.
      2 Overrule forwarding behaviour. Accept Router Advertisements
        even if forwarding is enabled.

  Functional default: enabled if local forwarding is disabled.
              disabled if local forwarding is enabled.

    So when your host is not a router it's autoconfigured by the IPv6 router sending RAs (including in response to RSs from your host) on the network. When it becomes a router itself, by default it won't listen to those RAs.

    Try this:

    sysctl -w net.ipv6.conf.br0-enp3s0.accept_ra=2

    Note that since you're using the bridge's implicit self port to do routing, you can't distinguish where those RAs will come from: you could receive a RA from an untrusted VM: that's your call. You should also check if you need RAs on other interfaces.

    All this could possibly not apply if for example you're configured with DHCPv6.

    • 0