Re: [Openvpn-devel] [PATCH v5] Implement block-ipv6

2018-11-30 Thread Gert Doering
Hi, On Mon, Oct 29, 2018 at 06:20:40PM +0100, Arne Schwabe wrote: > This can be used to redirect all IPv6 traffic to the tun interface, > effectively black holing the IPv6 traffic. Without ICMPv6 error > messages this will result in timeouts when the server does not send > error codes. block-ipv6

Re: [Openvpn-devel] [PATCH v5] Implement block-ipv6

2018-11-12 Thread Arne Schwabe
Am 29.10.18 um 18:20 schrieb Arne Schwabe: > +#define MAX_ICMPV6LEN IPV6_MIN_MTU This should be #define MAX_ICMPV6LEN 1280 Antonios suggestion of using IPV6_MIN_MTU works on Android on my linux test box but breaks on other Linux machines and FreeBSD does not even have this define. Arne signa

Re: [Openvpn-devel] [PATCH v5] Implement block-ipv6

2018-10-30 Thread Thomas Schäfer
Am 30.10.18 um 11:53 schrieb Arne Schwabe: That should answer your questions, doesn't it? Thanks for clarification. It doesn't harm IPv6 transport. But it may (if intended ) block IPv6 payload. Thomas ___ Openvpn-devel mailing list Openvpn-devel@li

Re: [Openvpn-devel] [PATCH v5] Implement block-ipv6

2018-10-30 Thread Arne Schwabe
Am 30.10.18 um 11:22 schrieb Arne Schwabe: > Am 30.10.18 um 11:07 schrieb Thomas Schäfer: >> Am 29.10.18 um 23:09 schrieb Gert Doering: >>> Hi, >>> >>> On Mon, Oct 29, 2018 at 09:06:13PM +, Kristian McColm wrote: Will this feature break VPNs that use NAT64 to connect to IPv4-only Open

[Openvpn-devel] [PATCH v5] Implement block-ipv6

2018-10-30 Thread Arne Schwabe
Am 30.10.18 um 11:07 schrieb Thomas Schäfer: > Am 29.10.18 um 23:09 schrieb Gert Doering: >> Hi, >> >> On Mon, Oct 29, 2018 at 09:06:13PM +, Kristian McColm wrote: >>> Will this feature break VPNs that use NAT64 to connect to IPv4-only >>> OpenVPN servers? >> >> No. >> >> This is an opt-in feat

Re: [Openvpn-devel] [PATCH v5] Implement block-ipv6

2018-10-30 Thread Thomas Schäfer
Am 29.10.18 um 23:09 schrieb Gert Doering: Hi, On Mon, Oct 29, 2018 at 09:06:13PM +, Kristian McColm wrote: Will this feature break VPNs that use NAT64 to connect to IPv4-only OpenVPN servers? No. This is an opt-in feature which you can enable by pushing "block-ipv6" from the server to

Re: [Openvpn-devel] [PATCH v5] Implement block-ipv6

2018-10-29 Thread Gert Doering
Hi, On Mon, Oct 29, 2018 at 09:06:13PM +, Kristian McColm wrote: > Will this feature break VPNs that use NAT64 to connect to IPv4-only OpenVPN > servers? No. This is an opt-in feature which you can enable by pushing "block-ipv6" from the server to the client, to avoid IPv6 traffic (to, say,

Re: [Openvpn-devel] [PATCH v5] Implement block-ipv6

2018-10-29 Thread Kristian McColm
Will this feature break VPNs that use NAT64 to connect to IPv4-only OpenVPN servers? -Original Message- From: Arne Schwabe [mailto:a...@rfc2549.org] Sent: October 29, 2018 13:21 To: openvpn-devel@lists.sourceforge.net Subject: [Openvpn-devel] [PATCH v5] Implement block-ipv6 This can be

[Openvpn-devel] [PATCH v5] Implement block-ipv6

2018-10-29 Thread Arne Schwabe
This can be used to redirect all IPv6 traffic to the tun interface, effectively black holing the IPv6 traffic. Without ICMPv6 error messages this will result in timeouts when the server does not send error codes. block-ipv6 allows client side only blocking on all platforms that OpenVPN supports IP