DS-LITE and DSL-AC68U (with GNUton Merlin)

[sandrodjay]

One thing at a time. First you need to solve the "no IPv6" problem. Please double check the Fritz settings, specifically the DHCPv6 settings. Also check what kind of IPv6 subnet your ISP assigns to you, avm states in their knowledge base: "The FRITZ!Box must obtain an IPv6 prefix longer than 64 bits (for example /60 or /56) when it connects to the internet."

Yes - I get a /56 .. but what I don't get is: to access from tje internet, where I read the IP from the ASUS? On the fritzbox or on the Asus? Because I get two different numbers (and they don't work btw...but first I would like to understand why they are different...they should be the same for IPv6, shouldn't they? )

Sent from my SM-G960F using Tapatalk

 

[charlie2alpha]

Yes - I get a /56 .. but what I don't get is: to access from tje internet, where I read the IP from the ASUS? On the fritzbox or on the Asus? Because I get two different numbers (and they don't work btw...but first I would like to understand why they are different...they should be the same for IPv6, shouldn't they? )

Sent from my SM-G960F using Tapatalk

You should look at the Asus, System Log -> IPv6, there check the WAN IP.

 

[sandrodjay]

You should look at the Asus, System Log -> IPv6, there check the WAN IP.

OK - I tried really multiple times, but somehow I do not manage to connect to my router. There is an IPv6 address, all my devices have it, I activated in the admin the remote access, but nothing ..

At this point, I wonder:
(1) Could it be that it is not possible to access the Router GUI from IPv6? because this is what I am currently trying to do
(2) how do you setup the WAN? currently I have "Automatic IP"
(3) how do you setup the IPv6? currently I have "native"
=> could you please do a screenshot of your configuration for the above?

Many thanks

 

[charlie2alpha]

OK - I tried really multiple times, but somehow I do not manage to connect to my router. There is an IPv6 address, all my devices have it, I activated in the admin the remote access, but nothing ..

At this point, I wonder:
(1) Could it be that it is not possible to access the Router GUI from IPv6? because this is what I am currently trying to do
(2) how do you setup the WAN? currently I have "Automatic IP"
(3) how do you setup the IPv6? currently I have "native"
=> could you please do a screenshot of your configuration for the above?

Many thanks

OMG, you're trying the wrong thing as a test, the Asus router GUI only listens on IPv4 and you can't change that! If you don't have another http server in your LAN try something simple like ping to check if the device you want to connect to is actually reachable.

 

[sandrodjay]

OMG, you're trying the wrong thing as a test, the Asus router GUI only listens on IPv4 and you can't change that! If you don't have another http server in your LAN try something simple like ping to check if the device you want to connect to is actually reachable.

LOL - but the fritzbox works like a charm.. Can't believe that the Asus can't be access by IPv6...

Btw - I set the DDNS and I manage to ping my ipv6 ..
.. but again, now the OPENVPN Server... It does not seem to work .. I put already the proto udp6 string as you said, but no results ..

Sent from my SM-G960F using Tapatalk

 

[charlie2alpha]

LOL - but the fritzbox works like a charm.. Can't believe that the Asus can't be access by IPv6...

Btw - I set the DDNS and I manage to ping my ipv6 ..
.. but again, now the OPENVPN Server... It does not seem to work .. I put already the proto udp6 string as you said, but no results ..

Sent from my SM-G960F using Tapatalk

If you look at my earlier messages you'll notice I mention an ip6tables command. Without it the firewall on the Asus router will block incoming connections to your OpenVPN server even if you configure it correctly.

 

[sandrodjay]

If you look at my earlier messages you'll notice I mention an ip6tables command. Without it the firewall on the Asus router will block incoming connections to your OpenVPN server even if you configure it correctly.

Even if I currently disabled my firewall?

Sent from my SM-G960F using Tapatalk

 

[charlie2alpha]

Even if I currently disabled my firewall?

Sent from my SM-G960F using Tapatalk

Unfortunately yes, I tried disabling it when I was testing this, it still puts some basic rules in place that protect the router itself, but leaves unprotected all the LAN devices!

 

[sandrodjay]

Ok - and eventually your .ovpn client file how does it look? I imagine you are editing the one downloaded by the router..

Sent from my SM-G960F using Tapatalk

 

[charlie2alpha]

Ok - and eventually your .ovpn client file how does it look? I imagine you are editing the one downloaded by the router..

Sent from my SM-G960F using Tapatalk

You can either edit it to add the "proto udp6" in it or if the client has an "extra options" field you can put it there.

 

[sandrodjay]

You can either edit it to add the "proto udp6" in it or if the client has an "extra options" field you can put it there.

Guess what? Still doesn't work ..
What IPv6 address you put in the client openvpn file? The one of the router or something else?
I did all what you said (firewall-start, etc.. Even though I'm not sure ETH0 in your script is the right interface..)

Sent from my SM-G960F using Tapatalk

 

[charlie2alpha]

Guess what? Still doesn't work ..
What IPv6 address you put in the client openvpn file? The one of the router or something else?
I did all what you said (firewall-start, etc.. Even though I'm not sure ETH0 in your script is the right interface..)

Sent from my SM-G960F using Tapatalk

I just put the ddns address I assigned to my router, of course making sure it has the right AAAA DNS record. eth0 is usually the WAN interface in ASUS routers, if in doubt use the ifconfig command to check the interfaces which IP they have.

 

[sandrodjay]

I just put the ddns address I assigned to my router, of course making sure it has the right AAAA DNS record. eth0 is usually the WAN interface in ASUS routers, if in doubt use the ifconfig command to check the interfaces which IP they have.

It was VLAN4 ... and guess what? NOW IT WORKS unbelievable!! I also manage to access my router configuration via VPN... can't believe it!

Now I need to make my Xbox work .. I know you don't have experience, but if you have any tip I may put attention (like ipv6 tables), please let me know

Many thanks again!

Sent from my SM-G960F using Tapatalk

 

[charlie2alpha]

It was VLAN4 ... and guess what? NOW IT WORKS unbelievable!! I also manage to access my router configuration via VPN... can't believe it!

Now I need to make my Xbox work .. I know you don't have experience, but if you have any tip I may put attention (like ipv6 tables), please let me know

Many thanks again!

Sent from my SM-G960F using Tapatalk

Since you managed to make VPN work you don't need to bother with IPv6 for the Xbox as the tunnel the VPN creates is IPv4 only after all. Can't really help with the Xbox as I have no idea how you plan to use it, you should have access to it through the tunnel normally.

 

[sandrodjay]

Since you managed to make VPN work you don't need to bother with IPv6 for the Xbox as the tunnel the VPN creates is IPv4 only after all. Can't really help with the Xbox as I have no idea how you plan to use it, you should have access to it through the tunnel normally.

so - apparently, to be able to stream the Xbox on the VPN, we need to put the Xbox and the notebook (connected via vpn) on the same "network subnet" (https://www.reddit.com/r/xboxone/comments/bj69wc/streaming_xbox_over_internet/)
Any idea how we could achieve this using our Router?

 

[charlie2alpha]

so - apparently, to be able to stream the Xbox on the VPN, we need to put the Xbox and the notebook (connected via vpn) on the same "network subnet" (https://www.reddit.com/r/xboxone/comments/bj69wc/streaming_xbox_over_internet/)
Any idea how we could achieve this using our Router?

That can be achieved in theory if you change the VPN type from TUN to TAP. I have not tested that kind of setup as I use my own VPN from my Android devices and Android does not support OpenVPN TAP connections, but if you're using a laptop or some other device you can try.

 

[sandrodjay]

That can be achieved in theory if you change the VPN type from TUN to TAP. I have not tested that kind of setup as I use my own VPN from my Android devices and Android does not support OpenVPN TAP connections, but if you're using a laptop or some other device you can try.

Today I have an issue that the AAAA DDNS does not update the address correctly ...
How did you setup your DDNS? I put:
Service: FREEDNS.AFRAID.ORG (which is an option in the Merlin firmware)
Host: my_name.mooo.com (as registered on FREEDNS)
username: my_name
password: the token extract from the URL

But I feel something is not working ... in the log I get the following:
Oct 28 07:54:02 inadyn[14343]: In-a-dyn version 2.5 -- Dynamic DNS update client.
Oct 28 07:54:04 inadyn[14343]: Update forced for alias my_name.mooo.com, new IP# [omitted]
Oct 28 07:54:06 inadyn[14343]: HTTP(S) Transaction failed, error 36: Temporary network error (HTTPS send)

Do you know what I am doing wrong? simply the IPv6 address does not update ..

 

[charlie2alpha]

Today I have an issue that the AAAA DDNS does not update the address correctly ...
How did you setup your DDNS? I put:
Service: FREEDNS.AFRAID.ORG (which is an option in the Merlin firmware)
Host: my_name.mooo.com (as registered on FREEDNS)
username: my_name
password: the token extract from the URL

But I feel something is not working ... in the log I get the following:
Oct 28 07:54:02 inadyn[14343]: In-a-dyn version 2.5 -- Dynamic DNS update client.
Oct 28 07:54:04 inadyn[14343]: Update forced for alias my_name.mooo.com, new IP# [omitted]
Oct 28 07:54:06 inadyn[14343]: HTTP(S) Transaction failed, error 36: Temporary network error (HTTPS send)

Do you know what I am doing wrong? simply the IPv6 address does not update ..

I'm using the custom update script method, as service you select custom and then create the appropriate script as per the instructions here https://github.com/RMerl/asuswrt-merlin/wiki/Custom-DDNS
You'll need 2 curl commands, one for the A record and one for the AAAA. We need a custom script because Asus only updates the IPv4 (their firmware really is more IPv4 oriented, they barely support IPv6).

 

[sandrodjay]

I'm using the custom update script method, as service you select custom and then create the appropriate script as per the instructions here https://github.com/RMerl/asuswrt-merlin/wiki/Custom-DDNS
You'll need 2 curl commands, one for the A record and one for the AAAA. We need a custom script because Asus only updates the IPv4 (their firmware really is more IPv4 oriented, they barely support IPv6).

OK - I found this script example: https://github.com/RMerl/asuswrt-merlin/wiki/DDNS-Sample-Scripts#afraidorg
=> this should work, shouldn't it?

What I do not get about your post is that you mention to use IPv4 (with A record) - being behind DS-LITE, what IP should I put? it is not really clear this step to me ...

 

[sandrodjay]

I'm using the custom update script method, as service you select custom and then create the appropriate script as per the instructions here https://github.com/RMerl/asuswrt-merlin/wiki/Custom-DDNS
You'll need 2 curl commands, one for the A record and one for the AAAA. We need a custom script because Asus only updates the IPv4 (their firmware really is more IPv4 oriented, they barely support IPv6).

I find the issue... When i call the curl script, I get an IPv4 address even though I configured an AAAA ... Basically it gets overwritten to an IP v4... Any idea on how to avoid this? How do I catch the ipv6 address in the ddns-start script? Because i can pass it manually I understand..

Sent from my SM-G960F using Tapatalk