As an additional datapoint it looks like if I remove '::/0' at all (either replaced with the ::/1 8000:/1 rules or just removed outright) I appear to lose outbound traffic UNLESS I'm allowing 0.0.0.0/0. Which doesn't make much sense as one is an IPv4 rule and the other isn't. This is what it currently look like (pseudocode for brevity)
$IPV4_IPS = 0.0.0.0/5, 8.0.0.0/7, 11.0.0.0/8, 12.0.0.0/6, 16.0.0.0/4, 32.0.0.0/3, 64.0.0.0/2, 128.0.0.0/3, 160.0.0.0/5, 168.0.0.0/6, 172.0.0.0/12, 172.32.0.0/11, 172.64.0.0/10, 172.128.0.0/9, 173.0.0.0/8, 174.0.0.0/7, 176.0.0.0/4, 192.0.0.0/9, 192.128.0.0/11, 192.160.0.0/13, 192.169.0.0/16, 192.170.0.0/15, 192.172.0.0/14, 192.176.0.0/12, 192.192.0.0/10, 193.0.0.0/8, 194.0.0.0/7, 196.0.0.0/6, 200.0.0.0/5, 208.0.0.0/4 AllowedIPs = $IPV4_IPS, ::/0, fd82:88::1/128 -- IPv4 WORKS, IPv6 ONLY ROUTES fd82:88::1 AllowedIPs = $IPV4_IPS, fd82:88::1/128 -- IPv4 AND IPv6 DO NOT WORK AllowedIPs = $IPV4_IPS, ::/1, 8000::/1, fd82:88::1/128 -- IPv4 AND IPv6 DO NOT WORK AllowedIPs = 0.0.0.0/0, ::/1, 8000::/1 -- IPv4 AND IPv6 WORK On Tue, 21 Jul 2020 at 14:29, Adam Cooper <[email protected]> wrote: > > Mmm. It looks like unticking "Exclude Private IPs" and entering > "0.0.0.0/0, ::/1, 8000::/1" gives me a functional setup. Trouble is I > don't want to route the private IPs and ticking the box (whilst > retaining '::/1, 8000::/1') allows no traffic at all. There's > something odd about the way the client is configuring routes but I've > not got the expertise to figure it out :( > > On Tue, 21 Jul 2020 at 14:12, Hasan Berkay Çağır <[email protected]> wrote: > > > > On 15/07/2020 14:14, Adam Cooper wrote: > > > ... > > > Probably worth mentioning that I tried to replace ::/0 with ::/1, > > > 8000::/1 but that just results in completely broken connectivity in > > > IPv6 and IPv4 - which may be another issue in and of itself. > > > > Did you try only having "::/1, 8000::/1" in the AllowedIPs option? I had > > a default route creation issue myself where I'm only trying to tunnel > > IPv6 through; and having this actually solved it. > > > > $ netstat -nr > > Routing tables > > Internet: > > ... > > Internet6: > > Destination Gateway > > Flags Netif Expire > > ::/1 link#14 > > UCS utun2 > > default fe80::%utun0 > > UGcI utun0 > > default fe80::%utun1 > > UGcI utun1 > > default fe80::%utun3 > > UGcI utun3 > > default [ public IPv6 ] > > UGcI utun2 > > > > If just "::/1, 8000::/1" solves the IPv6 issue, I guess you can give it > > a try with "0.0.0.0/0, ::/1, 8000::/1" to see if both routes are created > > properly? > > > > Best, > > Berkay
