Gre /

Configure GRE inside VMM

In this guide, we demonstrate the use of gre(4) to tunnel IPv6 packets inside IPv4. This demonstration will be performed with virtual machines inside vmm using network address translation for the private IPv4 subnet. One virtual machine will be configured IPv4-only, the other with both IPv4 and IPv6. Once the gre(4) tunnel has been properly configured, both machines will have IPv6 access.

First, in the hypervisor, we configure the proper interfaces:

host# cat /etc/hostname.veb0                                        
add vport0
link1
host# cat /etc/hostname.vport0 
inet 10.0.20.1 0xffffff00
inet6 2001:db8::1 48
!route add -inet6 2001:db8:0:3::1 -cloning -link -iface vport1
!route add -inet6 2001:db8:0:3::/64 2001:db8:0:3::1
up

In these examples, you must replace all IPv6 addresses with publicly routable IPv6 addresses. So, for example, the address 2001:db8::1 and prefix length 48 must both be replaced. 10.0.20.1, however, is deliberately chosen to be a reserved IP address, and we will later apply network address translation to conserve on IPv4 addresses.

host# cat /etc/vm.conf
socket owner :vmdusers

switch "switch0" {
    locked lladdr
    interface veb0
}

bsdiso="/home/iso/install75.iso"

vm "gre2" {
    owner user
    memory 1G
    cdrom $bsdiso
    disk /home/user/gre2.qcow2 format qcow2
    interface tap2 { 
        locked lladdr ab:cd:ef:22:22:22
        switch "switch0"
    }
}
vm "gre3" {
    owner user
    memory 1G
    cdrom $bsdiso
    disk /home/user/gre3.qcow2 format qcow2
    interface tap3 { 
        locked lladdr ab:cd:ef:33:33:33
        switch "switch0"
    }
}

We also need to create the qcow2 images and install the system:

$ vmctl create -s 20G $HOME/gre2.qcow2
$ vmctl create -s 20G $HOME/gre3.qcow2

In /etc/pf.conf?, you will need a rule similar to the following for performing NAT:

match out on egress from !(egress:network) to any nat-to (egress:0)

Then reload the ruleset:

# pfctl -f /etc/pf.conf

Inside the virtual machines, we first configure machine gre2:

gre2# cat /etc/hostname.vio0
inet 10.0.20.2 0xffffff00
gre2# cat /etc/mygate
10.0.20.1
gre2# cat /etc/hostname.gre0
tunnel 10.0.20.2 10.0.20.3
inet6 2001:db8:0:3::2 64
keepalive 10 6
!route add -inet6 default 2001:db8:0:3::3
gre2# sysctl net.inet.gre.allow=1
gre2# echo "net.inet.gre.allow=1" >> /etc/sysctl.conf
gre2# sysctl net.inet.ip.forwarding=1
gre2# echo "net.inet.ip.forwarding=1" >> /etc/sysctl.conf

Then we configure machine gre3:

gre3# cat /etc/hostname.vio0
inet 10.0.20.3 0xffffff00
inet6 2001:db8:0:3::1 64
!route add -inet6 2001:db8::1 -cloning -link -iface vio0
!route add -inet6 default 2001:db8::1
gre3# cat /etc/mygate
10.0.20.1
gre3# cat /etc/hostname.gre0
tunnel 10.0.20.3 10.0.20.2
inet6 2001:db8:0:3::3 64
keepalive 10 6
!route add -inet6 2001:db8:0:3::2 -cloning -link -iface gre0
gre3# sysctl net.inet.gre.allow=1
gre3# echo "net.inet.gre.allow=1" >> /etc/sysctl.conf
gre3# sysctl net.inet.ip.forwarding=1
gre3# echo "net.inet.ip.forwarding=1" >> /etc/sysctl.conf
gre3# sysctl net.inet6.ip6.forwarding=1
gre3# echo "net.inet6.ip6.forwarding=1" >> /etc/sysctl.conf

Now, on gre2, run ping6 to test connectivity:

gre2# ping6 2001:db8:0:3::3
PING 2001:db8:0:3::3 (2001:db8:0:3::3): 56 data bytes
64 bytes from 2001:db8:0:3::3: icmp_seq=0 hlim=64 time=0.646 ms
64 bytes from 2001:db8:0:3::3: icmp_seq=1 hlim=64 time=0.678 ms
64 bytes from 2001:db8:0:3::3: icmp_seq=2 hlim=64 time=0.631 ms
64 bytes from 2001:db8:0:3::3: icmp_seq=3 hlim=64 time=0.615 ms
64 bytes from 2001:db8:0:3::3: icmp_seq=4 hlim=64 time=0.609 ms
^C
--- 2001:db8:0:3::3 ping statistics ---
5 packets transmitted, 5 packets received, 0.0% packet loss
round-trip min/avg/max/std-dev = 0.609/0.636/0.678/0.025 ms

On gre3, run tcpdump to view packets:

gre3# tcpdump -ne -i gre0
tcpdump: listening on gre0, link-type LOOP
14:42:46.562742 2001:db8:0:3::2 > 2001:db8:0:3::3: icmp6: echo request
14:42:46.562772 2001:db8:0:3::3 > 2001:db8:0:3::2: icmp6: echo reply
14:42:47.579278 2001:db8:0:3::2 > 2001:db8:0:3::3: icmp6: echo request
14:42:47.579301 2001:db8:0:3::3 > 2001:db8:0:3::2: icmp6: echo reply
14:42:48.579188 2001:db8:0:3::2 > 2001:db8:0:3::3: icmp6: echo request
14:42:48.579210 2001:db8:0:3::3 > 2001:db8:0:3::2: icmp6: echo reply
14:42:49.579212 2001:db8:0:3::2 > 2001:db8:0:3::3: icmp6: echo request
14:42:49.579234 2001:db8:0:3::3 > 2001:db8:0:3::2: icmp6: echo reply
14:42:50.579228 2001:db8:0:3::2 > 2001:db8:0:3::3: icmp6: echo request
14:42:50.579250 2001:db8:0:3::3 > 2001:db8:0:3::2: icmp6: echo reply
^C
10 packets received by filter
0 packets dropped by kernel

You should also be able to see the gre encapsulation if you run tcpdump on the vio0 interface:

gre3# tcpdump -ne -i vio0
tcpdump: listening on vio0, link-type EN10MB
14:47:32.358103 e8:8b:a3:22:22:22 e8:8b:a3:33:33:33 0800 78: 10.0.20.2 > 10.0.20.3: gre 10.0.20.3 > 10.0.20.2: gre keep-alive [tos 0xc0] [tos 0xc0]
14:47:32.358153 e8:8b:a3:33:33:33 e8:8b:a3:22:22:22 0800 54: 10.0.20.3 > 10.0.20.2: gre keep-alive [tos 0xc0]
14:47:32.697773 e8:8b:a3:33:33:33 e8:8b:a3:22:22:22 0800 78: 10.0.20.3 > 10.0.20.2: gre 10.0.20.2 > 10.0.20.3: gre keep-alive [tos 0xc0] [tos 0xc0]
14:47:32.698305 e8:8b:a3:22:22:22 e8:8b:a3:33:33:33 0800 54: 10.0.20.2 > 10.0.20.3: gre keep-alive [tos 0xc0]
14:47:33.060019 e8:8b:a3:22:22:22 e8:8b:a3:33:33:33 0800 142: 10.0.20.2 > 10.0.20.3: gre 2001:db8:0:3::2 > 2001:db8:0:3::3: icmp6: echo request
14:47:33.060104 e8:8b:a3:33:33:33 e8:8b:a3:22:22:22 0800 142: 10.0.20.3 > 10.0.20.2: gre 2001:db8:0:3::3 > 2001:db8:0:3::2: icmp6: echo reply
14:47:34.078159 e8:8b:a3:22:22:22 e8:8b:a3:33:33:33 0800 142: 10.0.20.2 > 10.0.20.3: gre 2001:db8:0:3::2 > 2001:db8:0:3::3: icmp6: echo request
14:47:34.078225 e8:8b:a3:33:33:33 e8:8b:a3:22:22:22 0800 142: 10.0.20.3 > 10.0.20.2: gre 2001:db8:0:3::3 > 2001:db8:0:3::2: icmp6: echo reply

Finally, on gre2, test IPv6 connectivity to the Internet:

gre2# ping6 google.com
ping6: Warning: google.com has multiple addresses; using 2607:f8b0:4023:1000::71
PING google.com (2607:f8b0:4023:1000::71): 56 data bytes
64 bytes from 2607:f8b0:4023:1000::71: icmp_seq=0 hlim=102 time=9.077 ms
64 bytes from 2607:f8b0:4023:1000::71: icmp_seq=1 hlim=102 time=8.976 ms
^C
--- google.com ping statistics ---
2 packets transmitted, 2 packets received, 0.0% packet loss
round-trip min/avg/max/std-dev = 8.976/9.027/9.077/0.051 ms