On Sun, Dec 20, 2009 at 09:45:13PM +0100, Eugen Leitl wrote: > On Sun, Dec 20, 2009 at 08:24:56PM +0000, Davide Brini wrote: > > On Sunday 20 December 2009, David Sommerseth wrote: > > > On 20/12/09 20:36, Adam Tauno Williams wrote: > > > > It works well, no issues. > > > I believe you will need to use the TAP device to make this work, > > > as OpenVPN do not support IPv6 over TUN devices. But I agree, that > > > this should work, even though I have not tried it in real life > > > yet. > > > The caveats is that using TAP devices gives more overhead in the > > > traffic between the OpenVPN server and client, as raw ethernet > > > frames are transferred, compared against TUN devices, which > > > operates on the IP level. > > > But as TUN do not support IPv6, you need to use TAP. from the OpenVPN FAQ: | Is IPv6 support planned/in the works? | Currently, there's limited support for IPv6. | Point-to-point IPv6 tunnels are supported on OSes which have IPv6 TUN | driver support (this includes Linux and the BSDs). IPv6 over TAP is | always supported as is any other protocol which can run over Ethernet. so, the limited IPv6 is an artificial OpenVPN limitation it seems? > > Or tunnel IPv6 in IPv4, and use TUN (yes, IPv6 MTU will be smaller, > > but it should work). > I do not have native IPv6 connectivity (HE.net and SixXs /48 tunnels > on the linux vserver host), so then TUN is the way to go to terminate > /56 subnets in the guests? you could always terminate whatever you are able to terminate on the host, and simply _use_ the IPv6 addresses for the guests (which won't really care where the IP comes from :) of course, putting the TAP _into_ the guest is not a good idea, unless you use network namespaces ... best, Herbert > -- > Eugen* Leitl <a href="leitlhttp://leitl.org">leitl</a> http://leitl.org > ______________________________________________________________ > ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org > 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE