IPv4上建立IPv6隧道技术

2019-12-03 16:05:37 Albin Wong 2220

#### 升级Nginx, 添加ipv6模块
1. 下载最新版nginx源码并解压编译
```shell
wget http://nginx.org/download/nginx-1.17.6.tar.gz
tar -zxvf nginx-1.17.6.tar.gz
cd nginx-1.17.6
```

2. 编译nginx，添加ipv6模块应用，编译命令:
```shell
./configure --prefix=/usr/local/nginx \
--user=www \
--group=www \
--conf-path=/usr/local/nginx/conf/nginx.conf \
--sbin-path=/usr/local/nginx/sbin/nginx \
--pid-path=/usr/local/nginx/nginx.pid \
--prefix=/usr/local/nginx \
--with-http_stub_status_module \
--with-http_ssl_module \
--with-http_v2_module \
--with-http_gzip_static_module \
--with-http_sub_module \
--with-stream \
--with-stream_ssl_module \
--with-openssl=/lnmp1.6-full/src/openssl-1.1.1d \
--with-openssl-opt='enable-weak-ssl-ciphers' \
--with-http_stub_status_module \
--with-http_ssl_module \
--with-ipv6 \
```

3. 源代码编译
`make`

4. 备份原有版本的nginx二进制文件
`mv /usr/local/nginx/sbin/nginx /usr/local/nginx/sbin/nginx.bak`

5. 将编译好的新版本nginx二进制文件，拷贝到运行目录
`cp objs/nginx /usr/local/nginx/sbin/nginx`

6. 执行更新命令 
`make upgrade`

7. 查看当前nginx的编译信息
```bash
    $ nginx -V
    nginx version: nginx/1.17.6
    built by gcc 5.4.0 20160609 (Ubuntu 5.4.0-6ubuntu1~16.04.4) 
    built with OpenSSL 1.1.1d  10 Sep 2019
    TLS SNI support enabled
    configure arguments: --user=www --group=www --prefix=/usr/local/nginx --with-http_stub_status_module --with-http_ssl_module --with-http_v2_module --with-http_gzip_static_module --with-http_sub_module --with-stream --with-stream_ssl_module --with-openssl=/lnmp1.6-full/src/openssl-1.1.1d --with-openssl-opt=enable-weak-ssl-ciphers --with-http_stub_status_module --with-http_ssl_module --with-ipv6
```

#### 开启服务器的IPv6支持
1. 修改/etc/sysctl.conf中ipv6的配置，把下面三项设置都改为0，如下
```shell
net.ipv6.conf.all.disable_ipv6 = 0
net.ipv6.conf.default.disable_ipv6 = 0
net.ipv6.conf.lo.disable_ipv6 = 0
```

2. 重启服务器 `shutdown -r now`

3. 通过`ifconfig`查看服务器网卡信息中`inet6 addr`信息，如果说明已启用
![Server IPv6](http://albinwongcdn.oss-cn-beijing.aliyuncs.com/uploads/article/20191203/60af0115fa9d78d9fe0512dffcff460c.png "Server IPv6")

#### Nginx启用IPv6
1. 修改Nginx默认虚拟主机的配置 `vim /usr/local/nginx/conf/nginx.conf`
```shell
...
server
    {
        listen 80 default_server;
        listen [::]:80 default_server ipv6only=on; # 新增
        ....
    }
...
```

2. 修改其他虚拟主机, 将所有`server {}`里面的`listen 80;`下面添加上
```shell
...
server
	{
		listen 80;
		listen [::]:80; # 新增
		....
	}
...
# 如若同时启用了`https`协议, 需同时添加443端口 
...
server
	{
		listen [::]:443 ssl http2 ipv6only=on;
		listen 443 ssl http2;
		...
	}
...
```

3. 检查Nginx配置是否存在语法错误
```shell
$ nginx -t
nginx: the configuration file /usr/local/nginx/conf/nginx.conf syntax is ok
nginx: configuration file /usr/local/nginx/conf/nginx.conf test is successful
```

4. 重启Nginx服务器 `service nginx restart`

#### 添加IPv6 Tunnel相关信息
1. 到 https://www.tunnelbroker.net/ 注册一个账户

2. 点击Create Regular Tunnel

3. 在IPv4 Endpoint 输入框中输入您的服务器公网IP地址

4. Available Tunnel Servers选一个延迟较低节点，可以ping一下

5. 编辑`/etc/network/interfaces` , 在下面添加IPv6 Tunnel的相关信息
```bash
auto he-ipv6
iface he-ipv6 inet6 v4tunnel
address <IPv6>::2
netmask 64
remote <Tunnel 的 Server IPv4 Address>
local <阿里云的内网 IPv4 地址>
endpoint any
ttl 255
gateway <IPv6>::1
up ip -6 route add 2000::/3 via ::<Tunnel 的 Server IPv4 Address> dev he-ipv6
up ip -6 addr add <IPv6>::1:1/128 dev he-ipv6
up ip -6 addr add <IPv6>::2:1/128 dev he-ipv6
down ip -6 route flush dev he-ipv6
```
其中里面`<IPv6>` 需要你自己替换成你刚刚申请的 Tunnel 的 Server IPv6 Address，但不包括最后的::1/64

6. 重启Nginx服务器 `service nginx restart`

7. 执行 `ifup he-ipv6` 启用he-ipv6虚拟网卡

8. 测试(因Tunnel香港节点都是从美国绕回来，有丢包的可能性)
	- Google
	```shell
	$ ping6 -c 5 ipv6.google.com
	PING ipv6.google.com(tsa01s08-in-x0e.1e100.net) 56 data bytes
	64 bytes from tsa01s08-in-x0e.1e100.net: icmp_seq=1 ttl=56 time=330 ms
	64 bytes from tsa01s08-in-x0e.1e100.net: icmp_seq=2 ttl=56 time=330 ms
	64 bytes from tsa01s08-in-x0e.1e100.net: icmp_seq=3 ttl=56 time=331 ms
	64 bytes from tsa01s08-in-x0e.1e100.net: icmp_seq=4 ttl=56 time=330 ms
	64 bytes from tsa01s08-in-x0e.1e100.net: icmp_seq=5 ttl=56 time=335 ms

--- ipv6.google.com ping statistics ---
	5 packets transmitted, 5 received, 0% packet loss, time 4004ms
	rtt min/avg/max/mdev = 330.709/331.741/335.362/1.814 ms
	```

- Baidu
	```shell
	$ ping6 -c 5 ipv6.baidu.com
	PING ipv6.baidu.com(2400:da00:2::29) 56 data bytes
	64 bytes from 2400:da00:2::29: icmp_seq=1 ttl=40 time=678 ms
	64 bytes from 2400:da00:2::29: icmp_seq=2 ttl=40 time=678 ms
	64 bytes from 2400:da00:2::29: icmp_seq=3 ttl=40 time=678 ms
	64 bytes from 2400:da00:2::29: icmp_seq=4 ttl=40 time=678 ms
	64 bytes from 2400:da00:2::29: icmp_seq=5 ttl=40 time=678 ms

--- ipv6.baidu.com ping statistics ---
	5 packets transmitted, 5 received, 0% packet loss, time 3999ms
	rtt min/avg/max/mdev = 678.356/678.554/678.822/0.179 ms
	```

9. 添加域名解析AAAA
将Ipv6 Tunnel中Client IPv6 Address信息添加到域名解析中
![AAAA Host](http://albinwongcdn.oss-cn-beijing.aliyuncs.com/uploads/article/20191203/bea28142817f4612fb68a11fe10c54ff.png "AAAA Host")

10. 测试
- http://ipv6-test.com/validate.php, 在这个网址中输入你的域名
![](http://albinwongcdn.oss-cn-beijing.aliyuncs.com/uploads/article/20191203/4b88df163e471ed1874af25ab5edd5f0.png)

- http://www.ipv6now.com.au/pingme.php
```shell
	The response for 'www.albinwong.com' using IPv4 is:
	PING www.albinwong.com (47.94.237.14) 56(84) bytes of data.
	64 bytes from 47.94.237.14: icmp_seq=1 ttl=44 time=180 ms
	64 bytes from 47.94.237.14: icmp_seq=3 ttl=44 time=180 ms
	64 bytes from 47.94.237.14: icmp_seq=4 ttl=44 time=180 ms
	64 bytes from 47.94.237.14: icmp_seq=5 ttl=44 time=180 ms

--- www.albinwong.com ping statistics ---
	5 packets transmitted, 4 received, 20% packet loss, time 4020ms
	rtt min/avg/max/mdev = 180.458/180.607/180.939/0.466 ms

The response for 'www.albinwong.com' using IPv6 is:
	PING www.albinwong.com(tunnel562523-pt.tunnel.tserv20.hkg1.ipv6.he.net) 56 data bytes
	64 bytes from tunnel562523-pt.tunnel.tserv20.hkg1.ipv6.he.net: icmp_seq=2 ttl=58 time=545 ms
	64 bytes from tunnel562523-pt.tunnel.tserv20.hkg1.ipv6.he.net: icmp_seq=3 ttl=58 time=532 ms
	64 bytes from tunnel562523-pt.tunnel.tserv20.hkg1.ipv6.he.net: icmp_seq=4 ttl=58 time=550 ms

--- www.albinwong.com ping statistics ---
	5 packets transmitted, 3 received, 40% packet loss, time 4017ms
	rtt min/avg/max/mdev = 532.308/542.730/550.663/7.720 ms
```

### 常见错误
错误结果：ping ipv6域名时，得到ping 响应Destination unreachable: Address unreachable
错误原因：配置IPv6虚拟网卡时，将服务器内网地址配置成公网地址
处理： 将ipv6 Tunnel中local设置为服务器私有IP地址
```
$ ping6 -c 5 ipv6.google.com
PING ipv6.google.com(tsa01s07-in-x0e.1e100.net) 56 data bytes
From tsa01s07-in-x0e.1e100.net icmp_seq=1 Destination unreachable: Address unreachable
From tsa01s07-in-x0e.1e100.net icmp_seq=2 Destination unreachable: Address unreachable
From tsa01s07-in-x0e.1e100.net icmp_seq=3 Destination unreachable: Address unreachable
From tsa01s07-in-x0e.1e100.net icmp_seq=4 Destination unreachable: Address unreachable
From tsa01s07-in-x0e.1e100.net icmp_seq=5 Destination unreachable: Address unreachable
```

(3) Comments

John Doe- Reply

February 26, 2013 at 1:18 pm
- saqib sarwar- Reply
  
  February 26, 2013 at 1:20 pm
  
  Nam liber tempor cum soluta nobis eleifend option congue nihil imperdiet doming id quod mazim placerat facer possim assum. Typi non habent claritatem insitam; est usus legentis in iis qui facit eorum claritatem. Investigationes demonstraverunt lectores legere me lius quod ii legunt saepius. Claritas est etiam processus dynamicus, qui sequitur mutationem consuetudium lectorum. Mirum est notare quam littera gothica, quam nunc putamus parum claram, anteposuerit litterarum formas humanitatis per seacula quarta decima et quinta decima. Eodem modo typi, qui nunc nobis videntur parum clari, fiant sollemnes in futurum.
John Doe- Reply

February 26, 2013 at 1:27 pm

Lorem ipsum dolor sit amet, consectetuer adipiscing elit, sed diam nonummy nibh euismod tincidunt ut laoreet dolore magna aliquam erat volutpat. Ut wisi enim ad minim veniam, quis nostrud exerci tation ullamcorper suscipit lobortis nisl ut aliquip ex ea commodo consequat.

Duis autem vel eum iriure dolor in hendrerit in vulputate velit esse molestie consequat, vel illum dolore eu feugiat nulla facilisis at vero eros et accumsan et iusto odio dignissim qui blandit praesent luptatum zzril delenit augue duis dolore te feugait nulla facilisi. Nam liber tempor cum soluta nobis eleifend option congue nihil imperdiet doming id quod mazim placerat facer possim assum.

Your email address will not be published. Required fields are marked *

Name *

Email *

Website

Comment

You can use these HTML tags and attributes <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <strike> <strong>

IPv4上建立IPv6隧道技术

(3) Comments

John Doe- Reply

saqib sarwar- Reply

John Doe- Reply

Leave a Reply