Hetzner dedicated server Proxmox IPv6 routed setup

Multi

Hello guys,

I am trying to setup Proxmox with NAT IPv4 and routed IPv6 on my Hetzner machine for days now and I have absolutely no clue whats wrong with my config. There seem to be many reports of people failing at the same problem as there are many Reddit threads and forum posts in the Proxmox forum.

As there are many Hetzner fans around here maybe someone of you can help me solving this. Basically I followed this guide from Hetzner: https://community.hetzner.com/tutorials/install-and-configure-proxmox_ve

My /etc/network/interfaces on the host machine looks like this:

auto lo
iface lo inet loopback

iface lo inet6 loopback

auto enp6s0
iface enp6s0 inet static
        address 46.4.XX.XXX/26
        gateway 46.4.XX.XXX
        up route add -net 46.4.XX.XX netmask 255.255.255.192 gw 46.4.XX.XXX dev enp6s0
# route 46.4.XX.XXX/26 via 46.4.XX.XXX

iface enp6s0 inet6 static
        address 2a01:4f8:XXX:XXXX::2/64
        gateway fe80::1


auto vmbr0
# IPv4 NAT
iface vmbr0 inet static
        address 192.168.66.1/24
        bridge-ports none
        bridge-stp off
        bridge-fd 0
        post-up   iptables -t nat -A POSTROUTING -s '192.168.66.0/24' -o enp6s0 -j MASQUERADE
        post-down iptables -t nat -D POSTROUTING -s '192.168.66.0/24' -o enp6s0 -j MASQUERADE

# IPv6 routed
iface vmbr0 inet6 static
        address 2a01:4f8:XxX:XXXX::3/64
        netmask 64
        up ip -6 route add 2a01:4f8:XXX:XXXX::/64 dev vmbr0

The /etc/network/interfaces inside a VM looks like this:

# The loopback network interface
auto lo
iface lo inet loopback

# The primary network interface
allow-hotplug ens18
iface ens18 inet static
        address 192.168.66.2/24
        gateway 192.168.66.1
        # dns-* options are implemented by the resolvconf package, if installed
        dns-nameservers 1.1.1.1

iface ens18 inet6 static
        address 2a01:4f8:XXX:XXXX::4
        netmask 64
        gateway 2a01:4f8:XXX:XXXX::3

After applying this I can neither ping any IPv6 from the VM nor ping the IPv6 of the VM from my host.

Unfortunatley I am kinda new to networking especially IPv6.

v3ng

Im on the phone so I‘ll have to keep it short, but in summary:

On your primary NIC change
2a01:4f8:XXX:XXXX::2/64 -> 2a01:4f8:XXX:XXXX::2/128

On vmbr0

2a01:4f8:XxX:XXXX::3/64 -> 2a01:4f8:XxX:XXXX::2/64
Afaik you can also remove the route statement here.

On your VMs you’d then use 2a01:4f8:XxX:XXXX::2 as your gateway.
Oh and make sure IPv6 forwarding is enabled.

Feel free to drop me a message if you need help

Multi

@v3ng said:
Im on the phone so I‘ll have to keep it short, but in summary:

On your primary NIC change
2a01:4f8:XXX:XXXX::2/64 -> 2a01:4f8:XXX:XXXX::2/128

On vmbr0

2a01:4f8:XxX:XXXX::3/64 -> 2a01:4f8:XxX:XXXX::2/64
Afaik you can also remove the route statement here.

On your VMs you’d then use 2a01:4f8:XxX:XXXX::2 as your gateway.
Oh and make sure IPv6 forwarding is enabled.

Feel free to drop me a message if you need help

Oh my god. You are my hero. I just edited the primary NIC and its working. Do I really need to change the ::3 to ::2 in the vmbr interface? Wouldn't the system complain about using the same IP in two different interfaces?

Corolario

My /etc/network/interfaces works fine:

source /etc/network/interfaces.d/*

auto lo
iface lo inet loopback
iface lo inet6 loopback

auto eno1
iface eno1 inet static
        address 178.63.84.248/26
        gateway 178.63.84.193
        up route add -net 178.63.84.192 netmask 255.255.255.192 gw 178.63.84.193 dev eno1

iface eno1 inet6 static
        address 2a01:4f8:121:33fa::2/128
        gateway fe80::1

auto vmbr0
iface vmbr0 inet static
        address 10.10.10.1/24
        bridge-ports none
        bridge-stp off
        bridge-fd 0
        post-up   echo 1 > /proc/sys/net/ipv4/ip_forward
        post-up   iptables -t nat -A POSTROUTING -s '10.10.10.0/24' -o eno1 -j MASQUERADE
        post-down iptables -t nat -D POSTROUTING -s '10.10.10.0/24' -o eno1 -j MASQUERADE

iface vmbr0 inet6 static
        address 2a01:4f8:121:33fa::3/64
        up ip -6 route add 2a01:4f8:121:33fa::/64 dev vmbr0

iptables -t nat -A PREROUTING -p tcp --dport 443 -j REDIRECT --to-ports 8006

Multi

@Corolario said:
My /etc/network/interfaces works fine:
```
source /etc/network/interfaces.d/*

Thank you very much for your input. You might want to censor your real IPs though