目前，我有一个设置了 ipv6 连接的 Ubuntu 16 EC2 实例。我特别想通过 IPV6 尝试 SSH 和 OpenVPN。以下工作：
- ipv4 SSH 和 OpenVPN 连接
- ipv6 出站连接，
ping6例如curl - 如果我连接到服务器托管的 VPN，则为 ipv6 入站连接，这是 ipv4 连接
我检查了安全组，仔细检查并执行了AWS IPV6 迁移指南，并清除了所有 ip6tables。我在修复此问题方面没有取得任何进展。
当我尝试在 VPN 之外进行 SSH 时发生的情况如下：
$ ssh [email protected] -i "example.key" -6 -v
OpenSSH_6.6.1, OpenSSL 1.0.1f 6 Jan 2014
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: Applying options for *
debug1: Connecting to example.com [2600:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx] port 22.
debug1: connect to address 2600:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx port 22: Resource temporarily unavailable
ssh: connect to host example.com port 22: Resource temporarily unavailable
当我通过 OpenVPN 上的 IPV4 连接，然后通过 IPV6 进行 SSH 时：
$ ssh ubuntu@2001:db8:ee00:abcd::1 -i "example.key" -6 -v
OpenSSH_6.6.1, OpenSSL 1.0.1f 6 Jan 2014
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: Applying options for *
debug1: Connecting to 2001:db8:ee00:abcd::1 [2001:db8:ee00:abcd::1] port 22.
debug1: Connection established.
debug1: identity file example.key type -1
debug1: identity file example.key-cert type -1
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_6.6.1p1 Ubuntu-2ubuntu2.8
debug1: Remote protocol version 2.0, remote software version OpenSSH_7.2p2 Ubuntu-4ubuntu2.2
debug1: match: OpenSSH_7.2p2 Ubuntu-4ubuntu2.2 pat OpenSSH* compat 0x04000000
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: server->client aes128-ctr [email protected] none
debug1: kex: client->server aes128-ctr [email protected] none
debug1: sending SSH2_MSG_KEX_ECDH_INIT
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: Server host key: ECDSA bd:a7:ac:dd:37:98:c0:8f:7a:f6:e7:e8:20:05:36:48
The authenticity of host '2001:db8:ee00:abcd::1 (2001:db8:ee00:abcd::1)' can't be established.
ECDSA key fingerprint is xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '2001:db8:ee00:abcd::1' (ECDSA) to the list of known hosts.
debug1: ssh_ecdsa_verify: signature correct
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey
debug1: Next authentication method: publickey
debug1: Trying private key: example.key
debug1: key_parse_private2: missing begin marker
debug1: read PEM private key done: type RSA
debug1: Authentication succeeded (publickey).
Authenticated to 2001:db8:ee00:abcd::1 ([2001:db8:ee00:abcd::1]:22).
debug1: channel 0: new [client-session]
debug1: Requesting [email protected]
debug1: Entering interactive session.
debug1: client_input_global_request: rtype [email protected] want_reply 0
setsockopt IPV6_TCLASS 16: Operation not permitted:
debug1: Sending environment.
debug1: Sending env LANG = en_US.UTF-8
Welcome to Ubuntu 16.04.3 LTS (GNU/Linux 4.4.0-1035-aws x86_64)
* Documentation: https://help.ubuntu.com
* Management: https://landscape.canonical.com
* Support: https://ubuntu.com/advantage
Get cloud support with Ubuntu Advantage Cloud Guest:
http://www.ubuntu.com/business/services/cloud
6 packages can be updated.
0 updates are security updates.
Last login: Sat Sep 30 04:32:44 2017 from xxx.xxx.xxx.xxx
这是此实例的安全组：
编辑1：这是 tcpdump。看来服务器正在查看数据包。
17:26:33.761004 IP6 (flowlabel 0x93c4a, hlim 50, next-header TCP (6) payload length: 32) 2601:my:home:ipv6:addr:xxxx:xxxx:xxxx.64941 > 2600:my:server:ipv6:addr:yyyy:yyyy:yyyy.ssh: Flags [S], cksum 0x20be (correct), seq 2537279844, win 64800, options [mss 1440,nop,wscale 8,nop,nop,sackOK], length 0
17:26:36.761425 IP6 (flowlabel 0x93c4a, hlim 50, next-header TCP (6) payload length: 32) 2601:my:home:ipv6:addr:xxxx:xxxx:xxxx.64941 > 2600:my:server:ipv6:addr:yyyy:yyyy:yyyy.ssh: Flags [S], cksum 0x20be (correct), seq 2537279844, win 64800, options [mss 1440,nop,wscale 8,nop,nop,sackOK], length 0
17:26:42.260168 IP6 (hlim 255, next-header ICMPv6 (58) payload length: 56) fe80::b7:e1ff:fee7:e95e > ip6-allnodes: [icmp6 sum ok] ICMP6, router advertisement, length 56
hop limit 64, Flags [managed], pref medium, router lifetime 1800s, reachable time 0s, retrans time 0s
source link-address option (1), length 8 (1): 02:b7:e1:e7:e9:5e
0x0000: 02b7 e1e7 e95e
prefix info option (3), length 32 (4): 2600:my:server:ipv6::/64, Flags [none], valid time infinity, pref. time infinity
0x0000: 4000 ffff ffff ffff ffff 0000 0000 2600
0x0010: 1f1c 0c41 b120 0000 0000 0000 0000
17:26:42.761137 IP6 (flowlabel 0x93c4a, hlim 50, next-header TCP (6) payload length: 32) 2601:my:home:ipv6:addr:xxxx:xxxx:xxxx.64941 > 2600:my:server:ipv6:addr:yyyy:yyyy:yyyy.ssh: Flags [S], cksum 0x20be (correct), seq 2537279844, win 64800, options [mss 1440,nop,wscale 8,nop,nop,sackOK], length 0
17:26:52.260303 IP6 (hlim 255, next-header ICMPv6 (58) payload length: 56) fe80::b7:e1ff:fee7:e95e > ip6-allnodes: [icmp6 sum ok] ICMP6, router advertisement, length 56
hop limit 64, Flags [managed], pref medium, router lifetime 1800s, reachable time 0s, retrans time 0s
source link-address option (1), length 8 (1): 02:b7:e1:e7:e9:5e
0x0000: 02b7 e1e7 e95e
prefix info option (3), length 32 (4): 2600:my:server:ipv6::/64, Flags [none], valid time infinity, pref. time infinity
0x0000: 4000 ffff ffff ffff ffff 0000 0000 2600
0x0010: 1f1c 0c41 b120 0000 0000 0000 0000
编辑2：这是禁用 miredo 后的 tcpdump。然而，ping6现在返回错误connect: Network is unreachable
17:52:44.291012 IP6 (flowlabel 0xc8b54, hlim 50, next-header TCP (6) payload length: 32) 2601:my:home:ipv6:addr:xxxx:xxxx:xxxx.65166 > 2600:my:server:ipv6:addr:yyyy:yyyy:yyyy.ssh: Flags [S], cksum 0xf081 (correct), seq 4210466052, win 64800, options [mss 1440,nop,wscale 8,nop,nop,sackOK], length 0
17:52:47.291056 IP6 (flowlabel 0xc8b54, hlim 50, next-header TCP (6) payload length: 32) 2601:my:home:ipv6:addr:xxxx:xxxx:xxxx.65166 > 2600:my:server:ipv6:addr:yyyy:yyyy:yyyy.ssh: Flags [S], cksum 0xf081 (correct), seq 4210466052, win 64800, options [mss 1440,nop,wscale 8,nop,nop,sackOK], length 0
17:52:52.272999 IP6 (hlim 255, next-header ICMPv6 (58) payload length: 56) fe80::b7:e1ff:fee7:e95e > ip6-allnodes: [icmp6 sum ok] ICMP6, router advertisement, length 56
hop limit 64, Flags [managed], pref medium, router lifetime 1800s, reachable time 0s, retrans time 0s
source link-address option (1), length 8 (1): 02:b7:e1:e7:e9:5e
0x0000: 02b7 e1e7 e95e
prefix info option (3), length 32 (4): 2600:my:server:ipv6::/64, Flags [none], valid time infinity, pref. time infinity
0x0000: 4000 ffff ffff ffff ffff 0000 0000 2600
0x0010: 1f1c 0c41 b120 0000 0000 0000 0000
17:52:53.298882 IP6 (flowlabel 0xc8b54, hlim 50, next-header TCP (6) payload length: 32) 2601:my:home:ipv6:addr:xxxx:xxxx:xxxx.65166 > 2600:my:server:ipv6:addr:yyyy:yyyy:yyyy.ssh: Flags [S], cksum 0xf081 (correct), seq 4210466052, win 64800, options [mss 1440,nop,wscale 8,nop,nop,sackOK], length 0
17:53:02.273102 IP6 (hlim 255, next-header ICMPv6 (58) payload length: 56) fe80::b7:e1ff:fee7:e95e > ip6-allnodes: [icmp6 sum ok] ICMP6, router advertisement, length 56
hop limit 64, Flags [managed], pref medium, router lifetime 1800s, reachable time 0s, retrans time 0s
source link-address option (1), length 8 (1): 02:b7:e1:e7:e9:5e
0x0000: 02b7 e1e7 e95e
prefix info option (3), length 32 (4): 2600:my:server:ipv6::/64, Flags [none], valid time infinity, pref. time infinity
0x0000: 4000 ffff ffff ffff ffff 0000 0000 2600
0x0010: 1f1c 0c41 b120 0000 0000 0000 0000
17:53:12.273190 IP6 (hlim 255, next-header ICMPv6 (58) payload length: 56) fe80::b7:e1ff:fee7:e95e > ip6-allnodes: [icmp6 sum ok] ICMP6, router advertisement, length 56
hop limit 64, Flags [managed], pref medium, router lifetime 1800s, reachable time 0s, retrans time 0s
source link-address option (1), length 8 (1): 02:b7:e1:e7:e9:5e
0x0000: 02b7 e1e7 e95e
prefix info option (3), length 32 (4): 2600:my:server:ipv6::/64, Flags [none], valid time infinity, pref. time infinity
0x0000: 4000 ffff ffff ffff ffff 0000 0000 2600
0x0010: 1f1c 0c41 b120 0000 0000 0000 0000
17:53:22.273260 IP6 (hlim 255, next-header ICMPv6 (58) payload length: 56) fe80::b7:e1ff:fee7:e95e > ip6-allnodes: [icmp6 sum ok] ICMP6, router advertisement, length 56
hop limit 64, Flags [managed], pref medium, router lifetime 1800s, reachable time 0s, retrans time 0s
source link-address option (1), length 8 (1): 02:b7:e1:e7:e9:5e
0x0000: 02b7 e1e7 e95e
prefix info option (3), length 32 (4): 2600:my:server:ipv6::/64, Flags [none], valid time infinity, pref. time infinity
0x0000: 4000 ffff ffff ffff ffff 0000 0000 2600
0x0010: 1f1c 0c41 b120 0000 0000 0000 0000
答案1
问题是由于 的权限不正确造成的/etc/network/interfaces.d/60-default-with-ipv6.cfg。它被设置为只有用户可以读取该文件。我通过运行以下命令解决了该问题：
$ sudo chmod go+r /etc/network/interfaces.d/60-default-with-ipv6.cfg
$ sudo ifdown eth0 ; sudo ifup eth0
IPV6 现在完全可以支持入站和出站。OpenVPN 仍然不支持 ipv6，但那是另一个问题。