Configure IPv6 for OVH dedicated servers

English Version

OVH的機器默認給的是/128,但是其實整個/64都是可以用的,如果添加到網卡上是可以雙向ping通的。

但是如果docker的bridge網絡分配了一個IPv6,卻無法ping通。喝了一瓶果汁之後我發現是因為沒有向(OVH的)路由器發鄰居發現協議包(NDP)。

辛酸歷程

配置docker使用IPv6

參考docker官方文檔,給dockerd的啟動參數增加

–ipv6 –fixed-cidr-v6=aaaa:bbbb:cccc:dddd:1::/80

需要注意的是如果是Ubuntu用戶,並且docker是從很早的版本(Ubuntu 16.04 LTS發布以前)一路升級上來的話,你可能去會更改/etc/default/docker。然而systemd並不會自動讀取/etc/default/docker(見這個issue)。怎麼想都是systemd的錯。所以要麼在/lib/systemd/system/docker.service中增加

要麼直接修改/lib/systemd/system/docker.service,加上上面說的啟動參數。

配置內核轉發IPv6

參考docker官方文檔,配置內核轉發IPv6包,運行:

OVH不是用Router Advertisement來獲得IPv6地址的,所以不需要配置net.ipv6.conf.eth0.accept_ra

配置內核轉發NDP

其實就是為了告訴OVH的路由器,這個IPv6地址的包請讓我來處理。

運行:

然後設置轉發NDP,其中IP是容器的IPv6地址:

你一定覺得每個容器都要發一遍很煩吧,可以:

  1. 事先配置為aaaa:bbbb:cccc:dddd:1:242:ac11:0 – aaaa:bbbb:cccc:dddd:1:242:ac11:ffff發NDP。因為docker默認使用MAC地址來配置IPv6,根據這個文檔,docker會使用的MAC為02:42:ac:11:00:00到02:42:ac:11:ff:ff。
  2. 安裝ndppd,配置/etc/ndppd.conf,填寫

proxy eth0 {
rule aaaa:bbbb:cccc:dddd:1::/80 {

}
}


OVH gives you a /128 block by default. But in fact you can use the whole /64. You can simply add a /64 address to eth0.

But if you activate IPv6 in docker and try to allocate an address in bridge network, you will find the address is not ping-able. The problem here is we should send a NDP notification to OVH router.

How it works

Configure docker to use IPv6

According to this docker document ,we should append these options to dockerd:

–ipv6 –fixed-cidr-v6=aaaa:bbbb:cccc:dddd:1::/80

If you are an Ubuntu user and upgrade from 14.04 to 16.04, you may be thinking to edit /etc/default/docker. But actually systemd will not read this file at all. Systemd is never wrong. So you may either add these lines to /lib/systemd/system/docker.service:

or edit /lib/systemd/system/docker.service directly.

Configure kernel to forward IPv6

According to docker document,run:

OVH does not use Router Advertisement to allocate IPv6, so we don’t need to touch net.ipv6.conf.eth0.accept_ra.

Configure kernel to proxy NDP

This is needed to tell the OVH router that please let me handle the packet with source or destination equal to this address. Run:

Then set to proxy NDP, the IPv6 address should be container’s IPv6 address.

You may find this annoying to set this every time for a new container. So you can:

  1. Set ndp proxy for aaaa:bbbb:cccc:dddd:1:242:ac11:0 – aaaa:bbbb:cccc:dddd:1:242:ac11:ffff in advance. That’s because docker uses MAC address to configure IPv6 by default, according to this document, docker will only use 02:42:ac:11:00:00 to 02:42:ac:11:ff:ff as MAC address for container.
  2. Install ndppd,create and edit /etc/ndppd.conf:

proxy eth0 {
rule aaaa:bbbb:cccc:dddd:1::/80 {

}
}