---
title: "IPv6 Tunnel Broker"
description: "Ixolate supports native IPv6 as well as tunneled IPv6. This article shows how to set up TunnelBroker, Hurricane Electric's IPv6-in-IPv4 tunnel, with…"
---

> Documentation Index
> Fetch the complete documentation index at: https://docs.ixolate.com/llms.txt
> Use this file to discover all available pages before exploring further.

# IPv6 Tunnel Broker

**Original Author:** Shawn Webb

## Introduction

Ixolate supports native IPv6 as well as tunneled IPv6. This article shows how to set up TunnelBroker, Hurricane Electric's IPv6-in-IPv4 tunnel, with Ixolate. If you're based in the US and you use Netflix, you might not want to follow these instructions. Netflix now blocks TunnelBroker.

If you use IRC or need access to SMTP over the TunnelBroker connection, Hurricane Electric requires you to go through their free IPv6 certification process. Their "sage" level is the highest level and will allow you to enable IRC and SMTP. Note that your Ixolate firewall must be directly connected to the Internet. Being behind a NAT will not work.

The rest of this article assumes you already have a TunnelBroker account. If not, sign up and go through the free IPv6 certification process. Screenshots are provided throughout this article.

## Background

Enable ICMP on the WAN side of your Ixolate firewall. TunnelBroker's UI will tell you an IP to use when you're setting up your tunnel on their end.

Now add a tunnel. Make sure to add a routed /48 as we will need that to dish out individual /64 slices to each network. Once configured, your tunnel settings should look like this:

## Step 1 - Add GIF tunnel

To configure Ixolate start with adding a new gif interface. Go to **Interfaces › Devices › GIF** and click on **Add** in the upper tight corner of the form.

Use the following settings and copy in the IPv4&6 addresses from your TunnelBroker's UI.

|                               |                          |
|-------------------------------|--------------------------|
| **Parent interface**          | *WAN*                    |
| **GIF remote address**        | *Server IPv4 Address*    |
| **GIF tunnel local address**  | *Client IPv6 Address*    |
| **GIF tunnel remote address** | *Server IPv6 Address/64* |
| **Route caching**             | *disabled*               |
| **ECN friendly behavior**     | *disabled*               |
| **Description**               | *Tunnel Broker*          |

## Step 2 - Configure the GIF tunnel as a new interface

The newly created GIF tunnel must now be assigned as a new interface. Go to **Interfaces › Assignments**, select the GIF tunnel for **New interface** and click the **+** sign next to it.

Then under **Interfaces › [OPTX]** (or **Interfaces › [TunnelBroker]** depending on what you selected) check **Enable Interface** and change the description to e.g., TUNNELBROKER before hitting **Save**.

The newly created interface must now be set as the default IPv6 gateway under **System › Gateways › Configuration** by editing the new gateway entry TUNNELBROKER_TUNNELV6 and checking **Upstream Gateway** before saving.

## Step 3 - Basic Firewall Rules

Now add basic firewall rules. Since I have a LAN network and a WLAN network, I allow WLAN to initiate connections to LAN, but not the other way around. I only have servers on LAN whereas most of my clients are on WLAN (Wireless LAN). I block all incoming to LAN and WLAN. Of course, outbound connections are fine.

## Step 4 - Configure LAN interface

Now configure your LAN interface. The static IPv6 address we'll give it is a **/64** address from your assigned **/48**. I won't show the WLAN settings simply because it's the very same. You'll repeat the same process for further networks, but assigning the next interface a separate **/64** address.

## Step 5 - Configure DHCPv6 SLAAC

We'll next configure Ixolate for Stateless Address Auto Configuration (SLAAC). Go to **Services › Router Advertisements** and choose an interface.

Set the **Router Advertisements** setting to *Assisted* and the **Router Priority** setting to *Normal*.

Save your settings.

## Step 6 - Test your Configuration

You should now be set up for IPv6. To test your configuration, bring online an IPv6 machine, use your favorite tool to determine you have an IPv6 address. If you're using SLAAC, it may take up to 30 seconds or more to get an IPv6 address. If you see that your interface has an IPv6 address, you can try going to an IPv6 only test site, such as [https://www.doesnotwork.eu/](https://www.doesnotwork.eu/)

## Step 7 - Configure Endpoint Updates

If your IPv4 address is dynamic, it is important to keep your tunnel endpoint up to date to maintain IPv6 connectivity through the tunnel. We will configure automatic updates using ddclient.

First, install the **os-ddclient** plug-in under **System › Firmware › Plugins**. Once installed, refresh the UI and go to **Services › Dynamic DNS › Settings**. Add a new account, the fill in the following information, pulling from your Tunnelbroker's tunnel settings where needed.

|                 |                                 |
|-----------------|---------------------------------|
| **Service**     | he-net-tunnel                   |
| **Username**    | *Tunnelbroker account username* |
| **Password**    | *Update Tunnel Key*             |
| **Hostname(s)** | *Tunnel ID*                     |

For **Check ip method**, select any method that will return an *IPv4* address (e.g., ipify-ipv4, Interface [IPv4], or ipv4only.me). If using "Interface [IPv4]", also select the appropriate WAN interface to monitor.

Add a **Description** for your own use and leave all other options unchanged. Enable and save this account configuration, then enable and start the Dynamic DNS service.

Source: https://docs.ixolate.com/network/ipv6-tunnel-broker/index.mdx