Subject: Re: Recent ipv6 changes and gif breakage
To: <>
From: Ignatios Souvatzis <>
List: tech-net
Date: 01/27/2006 10:55:35
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Thu, Jan 26, 2006 at 08:48:48PM +0000, Martijn van Buul wrote:
> It occurred to me that Ignatios Souvatzis wrote in
> > Yes, but what outer address did you use for your view of your end of the
> > tunnel? The poster uses a public address - I can't quite see how this is
> > supposed to work, and he doesn't explain.
> I did, a few weeks ago ;), but a quick recap:
> My modem doesn't offer bridging, but it does offer a DMZ of some sorts.=
> My public IP is, and that's the official endpoint of the
> tunnel. (The other end being at The private IP of my modem
> is It *should* NAT all traffic to, but for some
> strange reason it fails to do so for IP protocols it doesn't know about
> itself (Including proto 41, aka gif). That traffic is still bridged to
> the inside network, and it's being transmitted with the ethernet address
> of as target address, but the IP header isn't rewritten prope=
> it still reads "" as destination. So in fact, it's doing a=
> bridge instead of a NAT, but only for proto 41. I initially added the
> appropriate alias to rtk0, my interface connected with the modem, but that
> didn't quite work out. Moving the alias to lo0 did.=20
> I tried putting back the alias to rtk0, but that didn't help. And I'm not
> convinced my slightly dodgy network setup is to blame - I see traffic com=
> in and out of my tunnel - just neighbourhood discovery seems broken.

Caution - rant follows.

|"Slightly dodgy"? Your network setup is so sick that I wonder how your
|machines survive. Do you understand know why reasonable people frown upon

Ok, seriously now:

Adding to your _ethernet_ interface should work. Somehow you
have to convince your machine to accept that packet in the first place,
before gif can see it.

If it doesn't, maybe give your ethernet interface as the
primary address and the internal address as the alias.

Adding that address to lo0 as an alias should confuse gif, as it's trying
to use an address on one interface and output the data through another.
Maybe you need to switch routing on for this to work.

Oh, yes, did you swithc routing on? (What does
sysctl net.inet.ip.forwarding say?)

If this still doesn't work, I guess you can use IPfilter to rewrite
proto 41 packets on your NetBSD machine so that gif can understand them.
You wold have to tell gif to use the internal address.


Content-Type: application/pgp-signature
Content-Disposition: inline

Version: 2.6.i