IPv6: support it or block it? about dsvpn

[jedisct1]

Maybe what we can do is assign pseudorandom IPv6 addresses to each endpoint, and add the required commands to route IPv6 traffic to the tunnel.

[angristan]

What if the server does not have IPv6 connectivity? The traffic won't go anywhere so I guess it's what we want anyways?

[jedisct1]

Correct, packets won't go anywhere if you don't have a route for them.

I added a stopgap solution to block all IPv6 traffic on the client. But the block stays after the VPN is stopped since it's not tied to a virtual interface.

Automatically assigning IPv6 addresses seems like a better solution. We may even use link-local addresses.

[jedisct1]

All IPv6 is now sent to the server. Rules for NATing that traffic are missing, so IPv6 traffic is effectively dropped.

If you know the proper iptables incantations to NAT the IPv6 traffic, feel free to add them :)