3

I have set up a 6in4 tunnel, namely "sit1", but I have discovered that if I traceroute non exist IP within the subnet, it will loop. What should I do to solve this?

The routing table:

enter image description here

  • I'm confused about a 6to4 tunnel, do you mean you are trying to tunnel IPv6 over IPv4 to a tunnel host? Also what IPv6 addresses are on this box? – cpt_fink Dec 5 '14 at 6:39
  • Yes. My IP address on the tunnel interface is 2001:460:18:c7b::2. And gateway address is 2001:460:18:c7b::1 – Harold Chan Dec 5 '14 at 6:40
  • As I understand, it's bad idea to assign IP from one subnet to bridge-local and to sit1 – mmv-ru Dec 5 '14 at 12:59
  • What would be a better solution? – Harold Chan Dec 5 '14 at 13:09
  • Were you assigned another /64 (or a /48 to use internally) by the tunnel broker? – cpt_fink Dec 6 '14 at 5:47
6

The tunnel is a point-to-point interface, all packets sent over the tunnel are received and processed by the remote device. When the remote device realizes the packet is destined for a subnet-local address it sends it back across the tunnel to your Microtik. You are hitting a the ping-pong vulnerability in IPv6.

| improve this answer | |
2

The simplest solution would be to refrain from assigning a prefix to the point-to-point link, and to use a link-local address as the next hop.

| improve this answer | |
  • 1
    We don't always have this option. With this tunnel, in particular, the global address is always assigned, and the link-local address of the other endpoint may not be available. – Michael Hampton Dec 30 '14 at 5:22
  • Then you can hack around the issue by adding some firewall rules to drop the offending packets. But I strongly recommend that you use link-local addresses as next hops whenever possible. – jch Dec 30 '14 at 16:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.