Today I installed OpenVPN 2.3rc2 on both my windows 7 client machine and centos 6 server. This new version of OpenVPN provides full compatibility for IPv6.

The Problem: I am currently able to connect to the server (through the IPv4 tunnel) and ping the IPv6 address which is assigned to my client and I can also ping the tun0 interface on the server. However, I cannot browse to any IPv6 websites.

My vps provider has given me this:

2607:f840:0044:0022:0000:0000:0000:0000/64 is routed to this server (2607:f840:0:3f:0:0:0:eda).

This is ifconfig after setup with OpenVPN running:

eth0      Link encap:Ethernet  HWaddr 00:16:3E:12:77:54  
          inet addr:208.111.39.160  Bcast:208.111.39.255  Mask:255.255.255.0
          inet6 addr: 2607:f740:0:3f::eda/64 Scope:Global
          inet6 addr: fe80::216:3eff:fe12:7754/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:2317253 errors:0 dropped:7263 overruns:0 frame:0
          TX packets:1977414 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:1696120096 (1.5 GiB)  TX bytes:1735352992 (1.6 GiB)
          Interrupt:29 

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:0 (0.0 b)  TX bytes:0 (0.0 b)

tun0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  
          inet addr:10.8.0.1  P-t-P:10.8.0.2  Mask:255.255.255.255
          inet6 addr: 2607:f740:44:22::1/64 Scope:Global
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1
          RX packets:739567 errors:0 dropped:0 overruns:0 frame:0
          TX packets:1218240 errors:0 dropped:1542 overruns:0 carrier:0
          collisions:0 txqueuelen:100 
          RX bytes:46512557 (44.3 MiB)  TX bytes:1559930874 (1.4 GiB)

So OpenVPN is sucessfully creating a tun0 interface and assigning clients IPv6 addresses using 2607:f840:44:22::/64. The first client to connect is getting 2607:f840:44:22::1000 and the second 2607:f840:44:22::1001, and so on... plus 1 each time.

After connecting as the first client, I can ping from my windows client machine 2607:f740:44:22::1 and 2607:f740:44:22::1000. However, I have no access to IPv6 websites. I believe the problem is that the tun0 IPv6 addressees are not being forwarded to the eth0 interface.

This is the firewall running on the server:

#!/bin/sh
#
# iptables configuration script
#
# Flush all current rules from iptables
#
iptables -F
iptables -t nat -F


#
# Allow SSH connections on tcp port 22 
#
iptables -A INPUT -i eth0 -p tcp --dport 22 -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp --sport 22 -j ACCEPT

#
# Set access for localhost
#
iptables -A INPUT -i lo -j ACCEPT

#
# Accept connections on 1195 for vpn access from client
#
iptables -A INPUT -i eth0 -p udp --dport 1195 -m state --state NEW,ESTABLISHED -j   ACCEPT
iptables -A OUTPUT -o eth0 -p udp --sport 1195 -m state --state ESTABLISHED -j ACCEPT

#
# Apply forwarding for OpenVPN Tunneling
#
iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -s 10.8.0.0/24 -j ACCEPT     
iptables -t nat -A POSTROUTING -o eth0 -j SNAT --to 209.111.39.160   
iptables -A FORWARD -j REJECT

#
# Enable forwarding
# 
echo 1 > /proc/sys/net/ipv4/ip_forward

#
# Set default policies for INPUT, FORWARD and OUTPUT chains
#
iptables -P INPUT ACCEPT              
iptables -P FORWARD ACCEPT
iptables -P OUTPUT ACCEPT

#
# IPv6
#

IP6TABLES=/sbin/ip6tables

$IP6TABLES -F INPUT
$IP6TABLES -F FORWARD
$IP6TABLES -F OUTPUT

echo -n "1" >/proc/sys/net/ipv6/conf/all/forwarding
echo -n "1" >/proc/sys/net/ipv6/conf/all/proxy_ndp
echo -n "0" >/proc/sys/net/ipv6/conf/all/autoconf
echo -n "0" >/proc/sys/net/ipv6/conf/all/accept_ra        

$IP6TABLES -A INPUT -i eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT
$IP6TABLES -A INPUT -i eth0 -p tcp --dport 22 -j ACCEPT
$IP6TABLES -A INPUT -i eth0 -p icmpv6 -j ACCEPT

$IP6TABLES -P INPUT ACCEPT
$IP6TABLES -P FORWARD ACCEPT
$IP6TABLES -P OUTPUT ACCEPT

Server.conf:

server-ipv6 2607:f840:44:22::/64

server 10.8.0.0 255.255.255.0
port 1195
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key  
dh dh2048.pem
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 208.67.222.222"
push "dhcp-option DNS 208.67.220.220"
keepalive 10 60
tls-auth ta.key 0 
cipher AES-256-CBC   
comp-lzo
user nobody
group nobody
persist-key
persist-tun
status openvpn-status.log
log-append  openvpn.log
verb 5

Client.conf:

client
dev tun
nobind
keepalive 10 60
hand-window 15
remote 209.111.39.160 1195 udp 
persist-key
persist-tun
ca ca.crt
key client1.key
cert client1.crt
remote-cert-tls server
tls-auth ta.key 1
comp-lzo
verb 3
cipher AES-256-CBC

I'm not sure where I am going wrong, it could be the firewall, or something missing from server or client.conf. This version of OpenVPN was only released yesterday, and there's little info on the internet about how to setup an IPv6 over IPv4 vpn tunnel. I've read the manual for this new version of OpenVPN (parts pertaining to IPv6) and it provides very little info too.

Thanks for any help.