<html><head></head><body><div style="font-family: Verdana;font-size: 12.0px;"><div>
<div>Hi everyone,</div>
<div> </div>
<div>so after fixing the mistake Hamish pointed out, this ruleset appears to work just fine:</div>
<div> </div>
<div>
<div># vpn internal subnet<br/>
ip -6 route add <remote vpn subnet>/64 via <remote vpn ip> dev $INTERFACE</div>
<div> </div>
<div># remote host's public subnet<br/>
ip -6 route add <remote public subnet>/64 via <remote vpn ip> dev $INTERFACE<br/>
ip -6 route add <remote public ip> via <local default gateway> dev <local default interface></div>
<div> </div>
<div>I verified this by using traceroute on both internal and external ips of all of my nodes. The benefit of using route specificity instead of <em>ip rule</em> is a smaller overhead.</div>
<div> </div>
<div>Kind regards</div>
<div>Christopher</div>
</div>
<div>
<div style="margin: 10.0px 5.0px 5.0px 10.0px;padding: 10.0px 0 10.0px 10.0px;border-left: 2.0px solid rgb(195,217,229);">
<div style="margin: 0 0 10.0px 0;"><b>Gesendet:</b> Dienstag, 07. Mai 2019 um 01:17 Uhr<br/>
<b>Von:</b> "Lars Kruse" <lists@sumpfralle.de><br/>
<b>An:</b> tinc@tinc-vpn.org<br/>
<b>Betreff:</b> Re: very high traffic without any load</div>
<div>Hello Christopher,<br/>
<br/>
<br/>
Am Mon, 6 May 2019 21:57:09 +0200<br/>
schrieb "Christopher Klinge" <Christ.Klinge@web.de>:<br/>
<br/>
> shouldn't these two rules work as well?<br/>
> <br/>
> ip route add <remote public ipv6>/64 via 1111:1::1<br/>
> ip route add <remote public ipv6>/0 dev<own internet interface><br/>
> <br/>
> According to my knowledge thus far, linux should pick routes based on<br/>
> specificity. Since /0 is more specific than /64, it should pick that rule<br/>
> whenever the remote public ipv6 is targeted directly.<br/>
<br/>
Yes, that is my understanding, too.<br/>
<br/>
I think, the culprit is here:<br/>
<br/>
ip route add <remote public ipv6>/0 dev<own internet interface><br/>
<br/>
I think, it should be the following instead:<br/>
<br/>
ip route add <remote public ipv6>/0 via <your_local_default_gateway><br/>
<br/>
(I think, your "dev" route will lead to ARP requests on the local interface for<br/>
public IP addresses - they obviously cannot resolve)<br/>
<br/>
Please note that my comments above are only based on my understanding of IPv4.<br/>
Thus I may have missed some nuances of IPv6 ...<br/>
<br/>
Cheers,<br/>
Lars<br/>
_______________________________________________<br/>
tinc mailing list<br/>
tinc@tinc-vpn.org<br/>
<a href="https://www.tinc-vpn.org/cgi-bin/mailman/listinfo/tinc" target="_blank">https://www.tinc-vpn.org/cgi-bin/mailman/listinfo/tinc</a></div>
</div>
</div>
</div></div></body></html>