I got myself a nice litte pc with two network cards. I want to divide my network to my provider and use virtual machines with ipv6 and ipv4. As operating system I use debian in command line only.
I don’t use my original ipv6 addresses in this manual
At first you have to get your “ipv6 präfix delegation” from your internet service provider. You find it in your router configuration. You need a network präfix lower than 64 to get more than one subnet in your environment. My isp got me 1234:1234:1234:1234::/62. 2 Bits of subnets or 4 subnets are allowed to create by myself.
First type in “ip a” to display your network configuration:
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host noprefixroute
valid_lft forever preferred_lft forever
2: enp0s3: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN group default qlen 1000
link/ether xx:xx:xx:xx:xx:xx brd ff:ff:ff:ff:ff:ff
3: enp0s8: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
link/ether xx:xx:xx:xx:xx:xx brd ff:ff:ff:ff:ff:ff
inet 192.168.0.59/24 brd 192.168.0.255 scope global dynamic enp0s8
valid_lft 604427sec preferred_lft 604427sec
inet6 1234:1234:1234:1234:aba1:abcd:abcd:abcd/64 scope global dynamic mngtmpaddr
valid_lft 1627sec preferred_lft 1627sec
inet6 fe80::1534:5432:1234:3212/64 scope link
valid_lft forever preferred_lft forever
With the command “ip -br a” you got a nicer output:
lo UNKNOWN 127.0.0.1/8 ::1/128
enp0s3 DOWN
enp0s8 UP 192.168.0.59/24 1234:1234:1234:1234:aba1:abcd:abcd:abcd/64 fe80::1534:5432:1234:3212/64
Every ipv6 address starts with “fe” or “fd” are local adresses and are genereated by the system. Do not change them.
Write down the ipv6 address of the card connected to the internet. In my case it’s the enp0s8 with the ipv6 address 1234:1234:1234:1234:aba1:abcd:abcd:abcd/64.
Next you need the gateway to the internet. Use the comman “ip route show”:
default via 192.168.0.1 dev enp0s8
192.168.0.0/24 dev enp0s8 proto kernel scope link src 192.168.0.59
But you need it for ipv6, do “ip -6 route show”:
....
fe80::/64 dev enp0s8 proto kernel metric 256 pref medium
default via fe80::1534:5432:1234:aaa9 dev enp0s8 proto ra metric 1024 expires 1798sec hoplimit 64 pref medium
Now we can set a fixed ipv4 and ipv6 address for our network card to the internet. Edit the networkfile by “nano /etc/network/interfaces” and change everything of your network card to fixed addresses like here. I got the nameserver from https://controld.com/free-dns but you can use yours:
# The primary network interface
allow-hotplug enp0s8
iface enp0s8 inet static
address 192.168.0.59
netmask 255.255.255.0
gateway 192.168.0.1
dns-nameservers 76.76.2.2 76.76.10.2
iface enp0s8 inet6 static
address 1234:1234:1234:1234:aba1:abcd:abcd:abcd
netmask 64
gateway fe80::1534:5432:1234:aaa9
autoconf 0
dns-nameservers 2606:1a40::2 2606:1a40:1::2
I also changed the resolv.conf file “nano /etc/resolv.conf”:
nameserver 76.76.2.2
nameserver 76.76.10.2
nameserver 2606:1a40::2
nameserver 2606:1a40:1::2
Restart your network with “systemctl restart networking” and test your configuration with “dig -6 google.com”:
; <<>> DiG 9.18.19-1~deb12u1-Debian <<>> -6 google.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 64958
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;google.com. IN A
;; ANSWER SECTION:
google.com. 126 IN A 142.250.184.238
;; Query time: 23 msec
;; SERVER: 1234:1234::2#53(2606:1a40::2) (UDP)
;; WHEN: Fri Feb 09 18:55:18 CET 2024
;; MSG SIZE rcvd: 55
If everything is ok we configure the second card. Since I got four subnets I use the next number 1234:1234:1234:1235::/64 as my sub network. “nano /etc/network/interfaces” and add:
allow-hotplug enp0s3
iface enp0s3 inet static
address 192.168.1.1
netmask 255.255.255.0
iface enp0s3 inet6 static
address 1234:1234:1234:1235::1
netmask 64
autoconf 0
Do a “systemctl restart networking” and check with “ip a” if everything is in place.
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host noprefixroute
valid_lft forever preferred_lft forever
2: enp0s3: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
link/ether 08:00:27:76:d8:d5 brd ff:ff:ff:ff:ff:ff
inet 192.168.1.1/24 brd 192.168.1.255 scope global enp0s3
valid_lft forever preferred_lft forever
inet6 1234:1234:1234:1235::1/64 scope global
valid_lft forever preferred_lft forever
inet6 fe80::1534:5432:6666:7777/64 scope link
valid_lft forever preferred_lft forever
3: enp0s8: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
link/ether xx:xx:xx:xx:xx:xx brd ff:ff:ff:ff:ff:ff
inet 192.168.0.59/24 brd 192.168.0.255 scope global dynamic enp0s8
valid_lft 604427sec preferred_lft 604427sec
inet6 1234:1234:1234:1234:aba1:abcd:abcd:abcd/64 scope global dynamic mngtmpaddr
valid_lft 1627sec preferred_lft 1627sec
inet6 fe80::1534:5432:1234:3212/64 scope link
valid_lft forever preferred_lft forever
Now we need a DHCP Server for the clients: “apt install isc-dhcp-server”. Ignore any error message.
Do “nano /etc/default/isc-dhcp-server” to let the dhcp only run on your internal network card and not on the internet card:
INTERFACESv4="enp0s3"
INTERFACESv6="enp0s3"
Edit the ipv4 settings: “nano /etc/dhcp/dhcpd.conf”
option domain-name "local";
option domain-name-servers 76.76.2.2,76.76.10.2;
default-lease-time 600;
max-lease-time 7200;
ddns-update-style none;
authoritative;
subnet 192.168.1.0 netmask 255.255.255.0 {
range 192.168.1.10 192.168.1.200;
option routers 192.168.1.1;
}
Edit the ipv6 settings: “nano /etc/dhcp/dhcpd6.conf”
default-lease-time 2592000;
preferred-lifetime 604800;
option dhcp-renewal-time 3600;
option dhcp-rebinding-time 7200;
allow leasequery;
option dhcp6.name-servers 2606:1a40::2,2606:1a40:1::2;
option dhcp6.domain-search "local";
#option dhcp6.preference 255;
option dhcp6.info-refresh-time 21600;
subnet6 1234:1234:1234:1235::/64 {
range6 1234:1234:1234:1235::2 1234:1234:1234:1235:ffff:ffff:ffff:ffff;
}
Then restart the service with “systemctl restart isc-dhcp-server”. If you got a error, do “systemctl status isc-dhcp-server”
…
Feb 09 19:35:55 idefix dhcpd[1840]: than a configuration issue please read the section on submitting
…
and do with the number in the bracets: “journalctl _PID=1840”. Now you get detailed informations about the error.
Now activate IP forwarding by “nano /etc/sysctl.conf” and uncomment:
net.ipv4.ip_forward = 1
net.ipv6.conf.all.forwarding = 1
Load the new settings: “sysctl –load /etc/sysctl.conf”
Install iptables with persistent tool: “apt install iptables iptables-persistent”. And “nano /etc/iptables/rules.v4” and “nano /etc/iptables/rules.v6”:
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A FORWARD -j ACCEPT
COMMIT
*nat
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
-A POSTROUTING -j MASQUERADE
COMMIT
Load the iptables with: “iptables-restore < /etc/iptables/rules.v4” and “ip6tables-restore < /etc/iptables/rules.v6”
At least you need to install radvd service to anounce the clients the ipv6 gateway. “apt install radvd”. Do a “nano /etc/radvd.conf”:
interface enp0s3
{
AdvSendAdvert on;
prefix 1234:1234:1234:1235::/64
{
};
route fe80::1534:5432:6666:7777/64
{
};
};
More infos you can find here https://man.archlinux.org/man/radvd.conf.5.en
Do a “systemctl restart radvd”.
“nano /etc/hosts”:
127.0.0.1 localhost
192.168.1.1 asterix.local asterix
# The following lines are desirable for IPv6 capable hosts
::1 localhost ip6-localhost ip6-loopback
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters
1234:1234:1234:1235::1 asterix.local asterix
“systemctl restart networking”
For the clients you have to edit “nano /etc/network/interfaces”:
allow-hotplug enp0s3
iface enp0s3 inet dhcp
iface enp0s3 inet6 dhcp
FINISHED!
To assign fixed addresses via dhcp you have to edit.
“nano /etc/dhcp/dhcpd.conf”:
host gamepc {
option host-name "gamepc.local";
hardware ethernet DD:12:34:AB:CC:DE;
fixed-address 192.168.1.100;
}
“nano /etc/dhcp/dhcpd6.conf”:
host gamepc {
hardware ethernet DD:12:34:AB:CC:DE;
fixed-address6 1234:1234:1234:1235::100;
}