Plusnet Gateway dropping IPv6 tunnel data

[#1]

The Gateway with IP 195.166.130.254 appears to be dropping or blocking 6in4 tunnel traffic from Hurricane Electric. This results in timeouts for IPv6 connections.

Is anyone else seeing this behaviour who are also with HE?

[#2]

@RPMozley  is your H.E. tunnel endpoint in London the server "tserv1.lon2" ?

- that device is currently showing a warning - "New tunnels temporarily disabled due to high usage"

The other H.E. London endpoints "tserv5.lon1" and "tserv17.lon1" are not reporting any issues.

I would have tried to help you by attempting to reproduce your problem on my setup, having used an H.E. tunnel for about eleven years, but I now have native IPv6, and my H.E. tunnel config has been cleared out of my router.

If you are on "tserv1.lon2", then just go into your Tunnelbroker account, change the endpoint to one of the others, then update the tunnel IP address in your router to match. (that's what I had to do when my "tserv5.lon1" endpoint went down for a month).

.

[#3]

I’m aware of that server issue but my tunnel is to “5.1” and not “1.2”.
The tunnel works perfectly fine on my current gateway server “195.166.130.251”.
There seems to be something different with the 195.166.130.254 gateway.

Thanks for your input though @outcast
(Typing on mobile)

[#4]

Gateway "195.166.130.255" is also showing the same odd behaviour as the one I mentioned earlier.

Now I have to try and get on a different gateway, which isn't always easy, to get IPv6 traffic flowing again.

[#5]

The only person on here that I can think could look at this for you is  @dave  ?

.

[#6]

@RPMozley   what part of England are you in ?

I'm not far from London, and both my Plusnet gateway and Hurricane Electric tunnel gateway were in Telehouse London, so likely located in the same building ? - and if anything I had better internet connectivity over the HE IPv6 tunnel than I got on native Plusnet IPv4 routes,  certainly less hops, near identical speed, and just a 0.3ms latency penalty.

I'm wondering if you were in a different part of the country, whether your Hurricane Electric endpoint might be in  Manchester,   Leeds,  Slough,  Edinburgh,  and 'might' be a transit issue that could be region specific to your nearest Plusnet gateway ?

Hurricane Electric's UK locations are listed on page 2 of this map - http://he.net/HurricaneElectricNetworkMap.pdf 

.

[#7]

Certainly Dave would probably be able to find out, if he's still around and not moved on to other areas or companies.

I don't think in this case, location is a factor because I believe all PN gateways are located in London. But for info we're located in Gloucestershire.

I think it was still possible to ping an IPv6 address directly but times out with a domain name. I'll have to do some more testing once we get kicked onto a "problem" gateway.

[#8]

@RPMozley  I'm still around. We have made some changes on the network over the last few months. Does it still work on any of the gateway IPs? There are currently 3 different ones in service so would be good to know if it works on any of them?

[#9]

---

@dave wrote:

... There are currently 3 different ones in service so would be good to know if it works on any of them?

---

@dave  from  @RPMozley 's  replies  #1  ,  #3 and #4 , if I read it correctly,

it appears that gateway  195.166.130.251  is working

but  195.166.130.254  and  195.166.130.255  are not.

.

[#10]

I've just set up n account with he.net's tunnel broker and tested on 2 of the 3 active devices: 195.166.130.254 and 195.166.130.251.

I'm using a Mac (internal IP 192.168.1.116) and did the following to set it up:

ifconfig gif0 create
ifconfig gif0 tunnel 192.168.1.116 209.51.161.14
ifconfig gif0 inet6 2001:470:<snip>::2 2001:470:<snip>::1 prefixlen 128
route -n add -inet6 default 2001:470:<snip>::1

ifconfig shows the following:

gif0: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> mtu 1280
tunnel inet 192.168.1.116 --> 209.51.161.14
inet6 fe80::60b1:5232:61c4:17ee%gif0 prefixlen 64 scopeid 0x2
inet6 2001:470:<snip>::2 --> 2001:470:<snip>::1 prefixlen 128
nd6 options=201<PERFORMNUD,DAD>

ping6 ipv6.google.com works fine on both
PING6(56=40+8+8 bytes) 2001:470:<snip>::2 --> 2a00:1450:4009:815::200e
16 bytes from 2a00:1450:4009:815::200e, icmp_seq=0 hlim=120 time=147.552 ms
16 bytes from 2a00:1450:4009:815::200e, icmp_seq=1 hlim=120 time=146.848 ms
16 bytes from 2a00:1450:4009:815::200e, icmp_seq=2 hlim=120 time=242.870 ms
16 bytes from 2a00:1450:4009:815::200e, icmp_seq=3 hlim=120 time=281.020 ms
16 bytes from 2a00:1450:4009:815::200e, icmp_seq=4 hlim=120 time=320.368 ms
16 bytes from 2a00:1450:4009:815::200e, icmp_seq=5 hlim=120 time=145.196 ms
^C
--- ipv6.l.google.com ping6 statistics ---
6 packets transmitted, 6 packets received, 0.0% packet loss

The IPv4 tunnel end point I have is 209.51.161.14, which are you using? And do you see dropped packets on the ping?

[#11]

---

@dave wrote:

The IPv4 tunnel end point I have is 209.51.161.14, which are you using? And do you see dropped packets on the ping?

---

@dave -

@RPMozley  isn't here to answer,  but indicates in reply #3 that the H.E. endpoint being used is "tserv5.lon1"

I *think* that  "tserv5.lon1.ipv6.he.net"  is  216.66.80.26

.

[#12]

Our broadband network has a different design depending on whether you have a static IP (and a couple of other things) or a dynamic IP address.

For static IPs there are 4 potential gateway IP addresses:

195.166.130.250 & 251 which are devices in Colindale (PCN-BNG03 & PCN-BNG04)

195.166.130.254 & 255 which are devices in Southbank (PSB-BNG03 & PSB-BNG04)

PCN-BNG03 (195.166.130.250) is currently out of service having some maintenance work done on it, it should be back next week if the final tests all pass so we'll ignore that one for now but if we don't work out what's wrong will be interesting to see if that works or not.

There shouldn't be any difference in the design/config on the other 3 so it's odd that it's not working on the 2 Southbank devices. I've just had a scan of 216.66.80.26 to see if I can see any traffic and I can see protocol 41 traffic flows in both directions at both sites. The other main IP I'm seeing is 216.66.88.98 and that also seems to have protocol 41traffic in both directions at both sites. I don't see much else other than some limited volumetrics (traffic is definitely measured in high gigabytes per day not megabytes).

[#13]

---

@dave wrote:

I've just had a scan of 216.66.80.26 to see if I can see any traffic and I can see protocol 41 traffic flows in both directions at both sites. The other main IP I'm seeing is 216.66.88.98 and that also seems to have protocol 41traffic in both directions at both sites. I don't see much else ...

---

@dave

At the Hurricane Electric end there should be three UK endpoints -

• "tserv1.lon2"
• "tserv5.lon1"
• "tserv17.lon1"

Note that "tserv1.lon2" (Tunnel Server Status) is currently reporting "New tunnels temporarily disabled due to high usage"

.

[#14]

---

@dave wrote:

195.166.130.254 & 255 which are devices in Southbank (PSB-BNG03 & PSB-BNG04)

There shouldn't be any difference in the design/config on the other 3 so it's odd that it's not working on the 2 Southbank devices.

---

@dave 

Does that point to the possibility that the issue is caused by some other kit in Southbank other than the readily identifiable gateways.  "Out here" we can only identify the gateway touch point, not what other infrastructure might be involved.  Could this issue be caused by Southbank peering or "exit" kit / routes?

Possibly a barking idea, but given that the bits which are identifiable are identical, then the issue might well be somewhere else.

[#15]

It's not impossible, but I'd expect to be able to replicate or not see any traffic at Southbank at all. As such need to get a bit of confirmation on @RPMozley's setup.