View source for OpenWRT IPv6: Setup tunnel dengan AICCU

Sumber: https://www.sixxs.net/wiki/Aiccu/Installing_on_OpenWRT




Main topic page: [[Aiccu]].

It is possible to maintain a dynamic AYIYA tunnel using the Aiccu client on a OpenWRT Router.  The subnet can then be announced on the lan giving IPv6 connectivity to all compatible connected devices.


For this walk through we assume you have a basic install of OpenWRT Kamikaze installed and know how to connect to it using ''ssh'', Linux directory transversal and ''vi''.

== Prerequisites ==

<div style="padding: 1px; background: red; border: width: 100px; -moz-border-radius:15px;">

You may expect issues with OpenWRT Attitude Adjustment (12.09). The configuration files are missing and start up scripts are subject of discussion. 

Possible alternatives are to stay with your working OpenWRT release and wait. Or you build your own workaround. Or use the current version Barrier Breaker 14.07.

</div>

=== All versions before Barrier Breaker 14.07 ===
Out of the box, OpenWRT does not have any IPv6 utilities or kernel level support for IPv6.  This can easily be solved by installing the necessary packages.

To install the packages, execute the following commands on your OpenWRT-box:

 opkg update
 opkg install kmod-ipv6
 opkg install kmod-ip6tables
 opkg install ip6tables
 opkg install ip
 opkg install kmod-tun
 opkg install aiccu
 opkg install radvd
 opkg install ntpclient

In order, the above packages are:
* Kernel support for IPv6
* Kernel support for <tt>iptables</tt> for IPv6 (Optional: Needed to create [[IPv6_Firewalling]])
* <tt>iptables</tt> for IPv6 (Optional: See above)
* Utilities to manage the IP configuration
* Kernel support for Virtual Network Interface devices (tun) to create tunnels
* [http://www.sixxs.net/tools/aiccu/ AICCU]: Automatic IPv6 Connectivity Client Utility 
* Router IPv6 Advertisement Daemon (Optional, not needed if you do not have a subnet, or if you use static IPv6 adresses)
* System clock requires synchronization for tunnel to stay up, so some ntp package is required. <tt>ntpclient</tt> is recommended.

<div style="padding: 1px; background: lightgrey; border: width: 100px; -moz-border-radius:15px;">
If you run White Russian, be warned that that distribution contains an old aiccu and backports a [https://dev.openwrt.org/ticket/1971 broken one]. If you want a working one for mipsel, you can get it [http://dl.cihar.com/openwrt/aiccu_20070115-1_mipsel.ipk here] (see [http://blog.cihar.com/archives/2008/09/09/white_russian_and_aiccu_problems/ related blog post] for more information).

In addition, the White Russian install-program is called ''ipkg'' instead of Kamikaze's ''opkg''.
</div>
After installing the above packages:
 reboot

=== Barrier Breaker 14.07 and later ===

Barrier Breaker and newer versions have native ipv6 support. Only one package needs to be installed later (aiccu). (See below for the instructions)

* Native IPv6-support with DHCPv6, an RA & DHCPv6-Server and an IPv6-firewall are installed and configured by default.
* Transitioning technologies like 6in4, 6rd, 6to4 or ds-lite can be installed using the packages with the same names.
* For WebUI-support install the package luci-proto-ipv6.


==Set Time==
If your system clock is not synchronized to network time, AICCU will exit with an error message (see syslog or 'readlog') as the time will be too far off when compared to the TIC server.
Also, ntpclient will not correct your time if it is not close to correct. 

Instead install 'rdate' and use that instead, that properly sets the clock directly instead of slowly changing it.

Use the following before starting AICCU to force the time to be set (and thus also network connectivity to work:
<code>
   NTPSERVER=0.pool.ntp.org
   
   while : ; do
       rdate ${NTPSERVER}
       <nowiki>[ $? = 0 ] && break</nowiki>
       sleep 5
   done
</code>
'ntpdate' can also be used, but that might fail setting the clock when the offset to the real time is too large, hence why 'rdate' is preferred.

== Tunnel Configuration ==

=== White Russian ===
Edit /etc/aiccu.conf to include your login and what tunnel to bind to.

Sample Configuration:

 # AICCU Configuration
 #
 # Login information (defaults: none)
 username ABC1-SIXXS
 password 1234
 #
 # Interface names to use (default: aiccu)
 ipv6_interface sixxs
 #
 # The tunnel_id to use (default: none)
 # (only required when there are multiple tunnels in the list)
 tunnel_id T12345
 #
 # Be verbose? (default: false)
 verbose false
 #
 # Daemonize? (default: true)
 # Set to false if you want to see any output
 # When true output goes to syslog
 daemonize true
 #
 # Automatic Login and Tunnel activation?
 automatic true
 #
 # Require TLS?
 #
 requiretls false
 #
 # PID File
 pidfile /var/run/aiccu.pid
 #
 # Add a default route (default: true)
 defaultroute true

Start aiccu and check the system logs for errors using the following.
 aiccu start
 logread

If aiccu is pleased it will show in the log something along the lines of
 Jul 18 13:47:51 (none) local7.info syslog: Succesfully retrieved tunnel information for T12345
 Jul 18 13:47:51 (none) local7.info syslog: AICCU running as PID 1234
 Jul 18 13:47:52 (none) local7.info syslog: [AYIYA-start] : Anything in Anything (draft-02)
 Jul 18 13:47:52 (none) local7.info syslog: [AYIYA-tun->tundev] : (Socket to TUN) started

Check that ipv6 is working by pinging sixxs.
 ping6 sixxs.net
 ping6 2001:XXXX:XXXX:XXXX::1 ( The tunnel server )
 ping6 2001:XXXX:XXXX:XXXX::2 ( your endpoint, the wrt54g router )

 Note: do not reuse these addresses for router config, you need to use the addresses from a subnet in addition to the tunnel you have just set up

=== Kamikaze ===
Kamikaze uses ''/etc/config/aiccu'' for its configuration.

The first time you will have a file like:
 config aiccu
        option username         'ABC1-SIXXS'
        option password         '1234'
        option protocol         ''
        option server           ''
        option interface        'sixxs'
        option tunnel_id        ''
        option requiretls       '0'
        option defaultroute     '1'
        option nat              '1'
        option heartbeat        '1'

Edit the file to your settings. Protocol is typically <tt>tic</tt> and server is <tt>tic.sixxs.net</tt>

In the command prompt, type:
 /etc/init.d/aiccu start

The above command will start the aiccu-client by using <tt>/etc/config/aiccu</tt> as a basis for it's configuration. ''[The configuration is generated and stored in ''<tt>/tmp/run/aiccu-cfg######.conf</tt>''. However, do '''not''' edit this file, since it is generated automatically by the <tt>/etc/init.d/aiccu</tt> script.]''

You can verify that the tunnel started by executing:
 logread

If aiccu is pleased it will show in the log something like:
 Jul 18 13:47:51 (none) local7.info syslog: Succesfully retrieved tunnel information for T12345
 Jul 18 13:47:51 (none) local7.info syslog: AICCU running as PID 1234

Check that ipv6 is working by pinging sixxs:
 ping6 sixxs.net
 ping6 2001:XXXX:XXXX:XXXX::1
 ping6 2001:XXXX:XXXX:XXXX::2

The tunnel will start automatically at every reboot, however, sometimes the tunnel may start too early. Therefore, you should edit ''/etc/init.d/aiccu'' and change the line:

 START=50

to

 START=80

=== Backfire ===

Backfire also uses <tt>/etc/config/aiccu</tt> for its configuration. After you install aiccu, edit the file to set your username and password. Note that the default protocol is <tt>tic</tt> and the default server is <tt>tic.sixxs.net</tt>, so you can leave these blank. Set the interface to ''sixxs.0'' in order simplify the firewall setup (see below).

This is how your <tt>/etc/config/aiccu</tt> file should look like:

 config aiccu
        option username         'ABC1-SIXXS'
        option password         '1234'
        option protocol         ''
        option server           ''
        option interface        'sixxs.0'
        option tunnel_id        ''
        option requiretls       '0'
        option defaultroute     '1'
        option nat              '1'
        option heartbeat        '1'

After editing the file, type in the command prompt:
 /etc/init.d/aiccu start

The above command will start the aiccu-client by using <tt>/etc/config/aiccu</tt> as a basis for it's configuration. ''[The configuration is generated and stored in ''<tt>/tmp/run/aiccu-cfg######.conf</tt>''. However, do '''not''' edit this file, since it is generated automatically by the <tt>/etc/init.d/aiccu</tt> script.]''

You can verify that the tunnel started by executing:
 logread

If aiccu is pleased it will show in the log something like:
 Jul 18 13:47:51 (none) local7.info syslog: Succesfully retrieved tunnel information for T12345
 Jul 18 13:47:51 (none) local7.info syslog: AICCU running as PID 1234

Check that ipv6 is working by pinging sixxs:
 ping6 sixxs.net
 ping6 2001:XXXX:XXXX:XXXX::1
 ping6 2001:XXXX:XXXX:XXXX::2

The tunnel will start automatically at every reboot. In Backfire, aiccu is correctly started after radvd, so there is no need to change the <tt>START</tt> parameter in <tt>/etc/init.d/aiccu</tt>.

=== Barrier Breaker ===

As of Barrier Breaker (14.07) RC1, AICCU is now integrated with netifd.
This release of OpenWRT also sports native IPv6 support, so no extra software is needed for IPv6.

Install software dependencies:
 opkg update
 opkg install aiccu

Edit the 'wan6' section in /etc/config/network to read as follows, filling the appropriate information from your tunnel information:

 config interface 'wan6'
        # mandatory settings
        option proto 'aiccu'
        option username ' ''SIXXS user name/tunnelID'' '
        option password ' ''TIC tunnel password'' '
        # optional settings (but you should set these, comment out using #)
        option tunnelid ' ''ID of SIXXS tunnel'' '
        option ip6prefix ' ''routed subnet prefix'' '
        option requiretls 'true'            # (false disables encryption for the authentication, that is a security risk)
        # optional
        #option server ' ''IP address or FQDN of TIC server'' '
        #option ip6addr ' ''IP of this host on routes subnet'' '
        #option heartbeat ' ''makebeats? 1 or 0'' '
        #option sourcerouting ' ''1 or 0'' '
        #option defaultroute ' ''1 or 0'' '
        #option verbose ' ''1 or 0'' '

Tell netifd to reload the configuration file:

 /etc/init.d/network reload

Verify with ''logread'' that AICCU has been started and finally ping sixxs to check the connection.

 ping6 sixxs.net


===== AICCU fails at boot =====
Due to DNS and time issues AICCU may fail to start at boot; see [https://dev.openwrt.org/ticket/17744 #17744]

The following patch of /lib/netifd/proto/aiccu.sh adds a work around that can be applied till this issue has been fixed.
 --- lib/netifd/proto/aiccu.sh	2014-08-08 12:20:06.000000000 +0200
 +++ /lib/netifd/proto/aiccu.sh	2014-09-21 11:59:53.000000000 +0200
 @@ -43,6 +43,16 @@
 	echo "daemonize true"	  >> "$CFGFILE"
 	echo "pidfile $PIDFILE"   >> "$CFGFILE"
  
 +# work-around for https://dev.openwrt.org/ticket/17744
 +	NTPSERVER=pool.ntp.org
 + 
 +	local try=0
 +	local max=10
 +	while [ $((++try)) -le $max ]; do
 +		ntpd -qn -p pool.ntp.org >/dev/null 2>&1 && break
 +		sleep 6
 +	done
 +# end of work-around
 +
 	aiccu start "$CFGFILE"
 
 	[ "$?" -ne 0 ] && {

If you have a diff time, maybe you need to try another ntp pool.

Check the pools at [http://www.pool.ntp.org/zone/@ NTP.org]

Change pool.ntp.org to another. Ex. 0.br.pool.ntp.org

=== Bleeding edge / trunk / Chaos Calmer ===

Chaos Calmer is the current development version, also called Bleeding Edge or trunk.
Look at the instructions for Barrier Breaker or configure everything with the luci webinterface.

You need the following packages:
 luci
 luci-proto-ipv6
 aiccu

Then you an change the interface wan6 from dhcp to aiccu/sixxs and enter your login data.



== Subnet Configuration ==

Note that the IPv6 router does not need to be on the same device as your IPv4 router. Traffic will be routed by your Sixxs IPv6 tunnel transparently through your IPv4 gatway. Therefore, your IPv6 router can be located internal to your existing gateway '''''and firewall'''''. For this reason, pay attention to this new exposure of the inside of your network and to the configuration of your ip6 traffic rules which will not be handled by your existing IPv4 iptables. (See <tt>ip6tables</tt>)


=== Routing (all versions up to 12.09)===

Note: you need to use addresses from a subnet and enable it before you are able to utilize radvd, and it is not the same as the tunnel. Each tunnel has a separate /64 (or /48 if you have requested it) which is named "default routed subnet". You can use this prefix and set your router to have this ip address, <Subnet-Prefix>::'1/64 being a reasonable choice

To give connectivity to other hosts on your subnet, you first need to set the IPv6 address for your OpenWRT-box, which is now your router. We assume it has the postfix ''1'' for the examples below.

Edit <tt>/etc/config/network</tt> and add the following line under the correct interface:
 option 'ip6addr' <Subnet-Prefix>::'1/64'

Here is part of an example config-file:
<pre>
config 'interface' 'lan'
	option 'type' 'bridge'
	option 'ifname' 'eth0.0'
	option 'proto' 'static'
	option 'ipaddr' '192.168.10.1'
	option 'netmask' '255.255.255.0'
	option 'dns' '192.168.10.5'
	option 'defaultroute' '0'
	option 'peerdns' '0'
	option 'ip6addr' '2001:####:###::1/64'
</pre>

Then you need to add / uncomment the following line at the bottom of ''/etc/sysctl.conf'':
 net.ipv6.conf.all.forwarding=1

==== Radvd ====
Radvd is how IPv6 advertises the existence of the router on your network. It accomplishes much of what DHCP does for IPv4. Without needing to be polled by devices, the radvd process advertises the IPv6 address of the router along with a ''prefix'' from which clients can self-generate their own IP assignments (originally by appending their MAC address, though that is no longer the only way.)

If you have been assigned a subnet such as a /48, you may be tempted to use it all for your network prefix, but take note that automatic address assignments by your network's client devices will '''''only''''' work if you advertise a /64 prefix, since they are trying to use their MAC address for the remaining 64 bits.

For details on the other radvd options, refer to the man page for radvd.conf.

====White Russian====
Edit /etc/radvd.conf to make radvd properly advertise the subnet.

(note br-lan, the configuration default is br0)

 interface br-lan
 {
        AdvSendAdvert on;
        prefix <Subnet-Prefix>::/64
        {
                AdvOnLink on;
                AdvAutonomous on;
        };
 };

====Kamikaze and Backfire====
Kamikaze and Backfire use <tt>/etc/config/radvd</tt>, which lists options corresponding to those listed in the <tt>radvd.conf</tt> file shown above. Your interface and prefix section should look like this:

 config interface
         option interface        'lan'
         option AdvSendAdvert    1
         option AdvManagedFlag   0
         option AdvOtherConfigFlag 0
         list client             <nowiki>''</nowiki>
         <span style="color:green">option ignore           0</span>
 
 config prefix
         option interface        'lan'
         # If not specified, a non-link-local prefix of the interface is used
         <span style="color:green">list prefix             '<Subnet-Prefix>::/64'</span>
         option AdvOnLink        1
         option AdvAutonomous    1
         option AdvRouterAddr    0
         option ignore           0

Make sure to set the <tt>ignore</tt> option to zero to enable radvd and set your prefix.

==== Finalize ====

Execute the following commands to configure these services to autostart after the next reboot of your router:
 /etc/init.d/radvd enable
 /etc/init.d/aiccu enable

Then restart the router one last time to make everything take effect.
 reboot

If everything is working correctly, then restarting the network adapter of a connected device should result in it assigning itself an IPv6 address on your subnet. If this does not happen, unplug the router, count to 30 and plug it back in to make sure computers on the LAN are not caching old settings. Do not worry if your devices show a router address different from your subnet and beginning with <tt>FE80</tt>. This is a link local address which also works just fine for reaching your router. You get one of these also. As long as you also show an IP address on the new subnet, you can know that the router can direct external traffic to your device.

=== Routing (Barrier Breaker 14.07 and later) ===

Note: you need to use addresses from a routed subnet and enable it before you are able to utilize odhcpd, and it is not the same as the tunnel. Each tunnel has a separate /64 (or /48 if you have requested it) which is named "default routed subnet". You can use this prefix and set your router to have this ip address, <Subnet-Prefix>::'1/64 being a reasonable choice.
Note2: radvd is no longer used in Barrier Breaker 14.07

The subnet prefix has to be set in <tt>/etc/config/network</tt> for the tunnel device(see the instructions for tunnel setup):
<pre> 
config interface 'wan6' #(if you followed the example from above)
        ...
        option ip6prefix '2001:xxxx:xxxx:xxxx::1/64'
        ...
</pre>
Be sure to use the routed prefix, not the tunnel prefix (sometimes only 1 character is different!).
Afterwards, enable prefix delegation for your lan interface:
<pre>
config interface lan
        option proto    static
        option ip6assign 64
        ...
</pre>
This will assign a /64 from every available public prefix (including the routed one from the tunnel and per default also a ULA prefix which can be used for local routing purposes)
Do not use <tt>option ip6addr</tt>!
See this page for more options: [http://wiki.openwrt.org/doc/uci/network6#downstream.configuration.for.lan-interfaces Downstream configuration for LAN-Interfaces - OpenWRT Wiki]

==== Finalize ====
Restart the router one last time to make everything take effect.
 reboot

If everything is working correctly, then restarting the network adapter of a connected device should result in it assigning itself several IPv6 addresses, including one on your subnet. If this does not happen, unplug the router, count to 30 and plug it back in to make sure computers on the LAN are not caching old settings. Do not worry if your devices show a router address different from your subnet and beginning with <tt>FE80</tt>. This is a link local address which also works just fine for reaching your router. You get one of these also. As long as you also show an IP address on the new subnet, you can know that the router can direct external traffic to your device.

== Firewalling (using OpenWrt firewall2 configuration) ==

'''Hint: This is tested with an SIXXS 6in4-hearbeat tunnel.'''

On newer releases of Kamikaze and Backfire, iptables and ip6tables can be configured using <tt>/etc/config/network</tt>. 

'''Preparation'''

Before you apply any change create backups of your <tt>/etc/config/firewall</tt> and <tt>/etc/config/network</tt> by using

 root@OpenWrt:~# uci export network > network.uci
 root@OpenWrt:~# uci export firewall > firewall.uci

In case of failure just do a reimport of the saved configuration files and reboot. 
 
 root@OpenWrt:~# uci import < network.uci
 root@OpenWrt:~# uci import < firewall.uci

Or apply any of your preferred configuration backup. 

'''First Step'''

If you have a running configuration stop the aiccu tunnel first.

  root@OpenWrt:~# /etc/init.d/aiccu stop

Create an additional interface <tt>wan6</tt> in ''/etc/config/network'' and assign an VLAN Interface: '''"sixxs0"'''. 

 config 'interface' 'wan6'
 	option 'proto' 'static'
 	option 'ifname' ''''sixxs0''''
 	option 'auto' ''' '1' '''
 	option 'ip6addr' '2001:your:end:point::2'
 	option 'send_rs' '0'

Hint: Set ''option'' '''auto''' to '''1''', this add wan6 (sixxs0) to zone wan6 and everything is working fine.

'''Second Step'''

Change the interface name in ''/etc/config/aiccu '' to '''sixxs0'''.  

 	option username         'YOUR-SIXXS/T1234'
 	option password         'password'
 	option protocol         'tic'
 	option server           'tic.sixxs.net'
 	option interface        ''''sixxs0''''
 	option tunnel_id        'T1234'
 	option requiretls       '0'
 	option defaultroute     '1'
 	option nat              '1'
 	option heartbeat        '1'

'''Final Step'''

Adopt your ''/etc/config/firewall'' as shown below.

(Change it carefully in case you already have other ipv4 rules in place.) 

 config 'defaults'
 	option 'syn_flood' '1'
 	option 'input' 'ACCEPT'
 	option 'output' 'ACCEPT'
 	option 'forward' 'REJECT'
 	option 'drop_invalid' '1'
 ....
 your standard firewall config 
 .... 
 
 config 'include'
 	option 'path' '/etc/firewall.user'
 
 config 'zone'
 	option 'name' 'wan6'
 	option 'output' 'ACCEPT'
 	option 'network' 'wan6'
 	option 'family' 'ipv6'
 	option 'input' 'DROP'
 	option 'forward' 'DROP'
 
 config 'forwarding'
 	option 'dest' 'wan6'
 	option 'src' 'lan'
 
 config 'rule'
        option 'name' 'RHO'
        option 'family' 'ipv6'
        option 'target' 'DROP'
        option 'extra' '-m rt --rt-type 0'
        option 'proto' 'all'
        option 'src' 'wan6'
 
 config 'rule'
        option 'name' 'RHO2'
        option 'family' 'ipv6'
        option 'target' 'DROP'
        option 'extra' '-m rt --rt-type 0'
        option 'proto' 'all'
        option 'src' 'wan6'
        option 'dest' 'lan'
 
 config 'rule'
 	option 'target' 'ACCEPT'
 	option 'output' 'ACCEPT'
 	option 'forward' 'REJECT'
 	option 'name' 'Allow-Ping ipv6'
 	option 'family' 'ipv6'
 	option 'proto' 'icmp'
 	option 'src' 'wan6'
 	option 'limit' '1000/sec'
 	list 'icmp_type' 'echo-request'
 	list 'icmp_type' 'destination-unreachable'
 	list 'icmp_type' 'packet-too-big'
 	list 'icmp_type' 'time-exceeded'
 	list 'icmp_type' 'bad-header'
 	list 'icmp_type' 'unknown-header-type'
 	list 'icmp_type' 'router-solicitation'
 	list 'icmp_type' 'neighbour-solicitation'
 	list 'icmp_type' 'echo-reply' ''

And restart everything

  root@OpenWrt:~# /etc/init.d/network restart
 
  root@OpenWrt:~# /etc/init.d/firewall restart
 
  root@OpenWrt:~# /etc/init.d/aiccu start

Check if '''wan6 (sixxs0)''' is added to zone wan6 as shown below.    
 
 root@OpenWrt:~# logread | grep firewall
 Jan 20 17:11:09 OpenWrt user.info firewall: adding lan (br-lan) to zone lan
 Jan 20 17:11:09 OpenWrt user.info firewall: adding wan (eth0) to zone wan
 Jan 20 17:11:12 OpenWrt user.info firewall: '''adding wan6 (sixxs0) to zone wan6'''

Check also if aiccu and radvd are up and running.

Don't forget to scan your ipv6 firewall configuration with an external ipv6 firewall check. 

If everything fails, restore your configuration as described above and follow the firewalling method described in the section ''Post Setup''.

== Post Setup ==

You can use the command ''ip6tables'' (''iptables'' for IPv6) to setup [[IPv6 Firewalling]].

For Kamikaze, the rules should go in the ''/etc/firewall.user''. Please note, default kernel for OpenWRT does not support rt-matching, so you can not block RH0-packages.


== Troubleshooting ==
===Installation brcm-2.4===
When you follow the instructions above for installation, you will get the following error when installing aiccu:
   root # opkg install aiccu
   Collected errors:
    * Cannot find package aiccu.

In the current version of kamikaze 8.09.1 (aiccu_20070115-2.1_mipsel.ipk), there seems to be a dependency on a 2.6 kernel. <nowiki>(Cannot satisfy the following dependencies for aiccu: *  kmod-sit *) </nowiki>

To get around this you can do the following:
   cd /tmp
   wget http://downloads.openwrt.org/kamikaze/8.09.1/brcm-2.4/packages/aiccu_20070115-2.1_mipsel.ipk 
   opkg -force-depends install aiccu_20070115-2.1_mipsel.ipk

You will get the following error message, which you can ignore:
   Collected errors:
    * Warning: Cannot satisfy the following dependencies for aiccu:
       *  kmod-sit * 

Then continue to follow the instructions above.

===Running processes===
Look at your running processes with <tt>ps</tt>. You should see <tt>aiccu</tt>, <tt>radvd</tt>, and <tt>ntpclient</tt>. If any of these are missing, either they were not started, or there is some reason they stopped. Find out why and fix.

If your tunnel is active, <tt>ifconfig</tt> will show an interface named sixxs.0:
 sixxs.0     Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  
           inet6 addr: 2001:.....
           UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1280  Metric:1
           ....

If you do not see it, try starting <tt>aiccu</tt> again. If this does not reappear in the ifconfig list, check <tt>logread</tt> for clues. Make sure your <tt>aiccu</tt> config file is correct.

===Timing===
If <tt>logread</tt> shows a message like:
 May 31 12:15:29 OpenWrt local7.err syslog: The clock is off by 8577949 seconds, use NTP to sync it!
 May 31 12:15:29 OpenWrt local7.err syslog: Couldn't retrieve first tunnel for the above reason, aborting
This means the tunnel started but due to your system clock being unsynchronized, it immediately aborted as no valid heartbeat or crypto could then be used.

See the note above about using rdate to resolve this problem.

If the number of seconds off is a near multiple of 3600, your error is in hours and likely a result of improperly set timezone. Change the TZ setting and then set your clock again to the current time and try again.

===DNS===
If you can not successfully <tt>ping6 sixxs.net</tt>, try pinging the address numerically to assess if this is just a DNS problem.:
 ping6 2001:838:1:1:210:dcff:fe20:7c7c


===Routing===
If you can <tt>ping6 www.sixxs.net</tt> from your router, and you can ping6 your router from your clients, but somehow the clients cannot <tt>ping6 www.sixxs.net</tt>, you appear to have an issue with your default route. Check out this forum post: [http://www.sixxs.net/forum/?msg=setup-658563 OpenWRT Kamikaze routing problem] (Some people solve the problem by ensuring that aiccu starts after radvd).

I spent most of the weekend fighting this, in my case the problem was that I had not bothered to get a subnet from sixxs.
For routing to/from the lan <br>
Note: When using a SixXS tunnel (and probably others), only ::1 (the PoP) and ::2 (your endpoint) can be used as the rest is not routed! Therefore, you need to use a subnet and enable it before you are able to utilize radvd

With OpenWrt Attitude Adjustment 12.09-rc1 in my configuration, the default ipv6 gateway isn't set correct. My Solution was:
Check the ipv6 kernel routing table with <tt>ip -6 route</tt><br>
it was set to:
 default via fe80::1 dev br-wan  proto kernel  metric 1024
I correct it by deleting the old defualt route and than add the correct one.
 ip route del default via fe80::1 dev br-wan
 ip route del default via fe80::1 dev br-wan
 ip -6 route add default via 2001:4dd0:xxxx:yyyy::1

===IPv6 Stack not found===
Possibly from using a version of OpenWrt with Linux kernel 2.4 (e.g. brcm-2.4). Try brcm47xx if you can. Note that the kernel was held back for Broadcom because the wireless driver was not as stable in 2.6, so there is a tradeoff.

=== Do not use hotplug scripts! ===

(Especially in Backfire 10.03)
Do not use the hotplug scripts for AICCU. Automatically restarting AICCU causes automatic blocking by the TIC server when the restart occurs too often.

== References ==
* [http://wiki.openwrt.org/IPv6_howto OpenWRT IPv6 Howto]
* [[IPv6 Firewalling]]
* [http://openwrt.org/ OpenWrt Project] (Web interface must be installed from command line)
* [http://x-wrt.org/ X-Wrt] OpenWrt with nice web interface pre-installed

[[Category:Administration]][[Category:Aiccu]]



==Referensi==

* https://www.sixxs.net/wiki/Aiccu/Installing_on_OpenWRT