5

I'm trying to set up a simple VM in Google Cloud Platform that can ping ipv6.google.com successfully. I'm using these GCP docs regarding IPv6 support, including :

[NOTE: Edited/updated to provide full commands used]

Here's my simple and repeatable proof of concept:

  1. Within a project, create a VPC network
$ gcloud config set project my-test-project $ gcloud compute networks create targetnet \ --subnet-mode=custom --mtu=1460 --bgp-routing-mode=regional
  1. Create subnet with IPv6 support
$ gcloud compute networks subnets create targetnet-1 \ --network=targetnet --range=10.9.9.0/24 \ --stack-type=IPV4_IPV6 --ipv6-access-type=EXTERNAL \ --region=us-west2
  1. Create an instance with IPv6 support
$ gcloud compute instances create test-1 \ --stack-type=IPV4_IPV6 --ipv6-network-tier=PREMIUM \ --subnet=targetnet-1 --zone=us-west2-a \ --image-family=debian-10 --image-project=debian-cloud \ --machine-type=e2-micro
  1. Add a firewall rule to give SSH access to the instance
$ gcloud compute firewall-rules create target-ssh-home \ --network targetnet --allow tcp:22 --source-ranges <my IPv4 addr>
  1. SSH to the instance, look at the network addresses & route:
$ ip -6 addr 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 state UNKNOWN qlen 1000 inet6 ::1/128 scope host valid_lft forever preferred_lft forever 2: ens4: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1460 state UP qlen 1000 inet6 2600:1900:xxxx:xxxx:0:1::/128 scope global valid_lft forever preferred_lft forever inet6 fe80::4001:aff:fe04:2d2/64 scope link valid_lft forever preferred_lft forever $ ip -6 route ::1 dev lo proto kernel metric 256 pref medium 2600:1900:xxxx:xxxx:0:1:: dev ens4 proto kernel metric 256 pref medium fe80::/64 dev ens4 proto kernel metric 256 pref medium default via fe80::4001:aff:fe04:201 dev ens4 proto ra metric 1024 expires 85sec pref medium
  1. Attempt to ping an external IPv6 resource:
$ ping6 ipv6.google.com PING ipv6.google.com(lax31s01-in-x0e.1e100.net (2607:f8b0:4007:80e::200e)) 56 data bytes From fe80::4001:ff:fe00:0%ens4 (fe80::4001:ff:fe00:0%ens4): icmp_seq=1 Destination unreachable: No route

The docs indicate the firewall defaults should allow outgoing ICMP. Still, I've also tried adding firewall rules to allow ICMP (and every) service in various forms to see if that helped. This did not change the result. Also, I confirmed that GCP added a default IPv6 route for the network. (::/0).

According to the documentation, the GCP is to provide a /64 and the NIC should be assigned the first address from that range. I don't see that here. Is there something I need to do on the host to get that? Or is there something I've missed that is needed in GCP?

Improve this question
5
  • 1
    Check that your VPC has an IPv6 default route. Can you ping fe80::4001:aff:fe04:201? If not the problem is within the OS (OS firewall rule, etc.) Commented Jul 26, 2021 at 6:14
  • Thanks @JohnHanley. No I cannot ping the next hop. As I mentioned, I'm using the default Debian 10 image. I haven't added any firewall rules, and ip6tables shows nothing blocking that I can see. Do you know of anything I should look for on the OS? Commented Jul 26, 2021 at 13:23
  • In case I was missing something in my explanation, I updated the post to include the exact commands I'm using to build the test. Hopefully that may help someone identify a step I'm missing. Commented Jul 27, 2021 at 3:17
  • Try creating a new VM with a different OS. If you cannot ping the next hop, you probably have an OS level problem. Commented Jul 27, 2021 at 3:19
  • I'm also having a similar experience across multiple ISPs, ssh over IPV6 works after opening up the firewall, but ICMP seems to be permanently blocked. Why does your ens4 have a prefix of 128, when GCP subnets are 96 and the VMs are 64. I just for go the whole gateway thing and use the loopback for IPv6 in external mode. To be clear SSH over IPv6 works. Commented Nov 23, 2021 at 23:39

2 Answers 2

Reset to default
3

Connecting to Google APIs and services from VPCs via external IPv6 addresses is currently not supported. Efforts to ping ‘ipv6.google.com’ from Cloud VM via IPv6 often lead to a destination unreachable ICMP response.
I had replicated your setup with the steps you mentioned and I was also getting the same “Destination unreachable: No route” error while trying to ping ipv6.google.com, however I was able to ping other IPv6 sites like ‘wikipedia.org’ quite successfully.

enter image description here

Furthermore, to best use VMs with IPv6 network, you can prefer incorporating GCP Load Balancing with IPv6 support.

Improve this answer
0

I found that even after opening firewalls at the GCP and the ufw level, I needed to add the inet6 to the default interface ens4 that GCP configured.

On debian, I edited: /run/network/interfaces.d/ens4

And added: iface ens4 inet6 dhcp

So that both the inet dhcp and the inet6 dhcp were present.

Improve this answer
1
  • I tried this, but as soon as the VM reboots, the iface ens4 inet6 dhcp line is removed. Also I checked other VMs that have been created more recently and this file doesn't even exist. Commented Dec 16, 2024 at 2:49

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.