Sunday, February 18, 2018

linux - TCP listen on any IPv6 in a block on Debian

I have a /64 block of IPv6 addresses, and I'd like to be able to start a TCP server listening on any one of them. Currently I can bind to any static IP address, but not any others. If I try to bind to an address not statically routed (by the way, I'm not sure if I'm using the right terms), I get an error message, "bind: cannot assign requested address".



Here's from ifconfig:



eth0      Link encap:Ethernet  HWaddr 56:00:00:60:af:c6
inet addr:104.238.191.172 Bcast:104.238.191.255 Mask:255.255.254.0
inet6 addr: fe80::5400:ff:fe60:afc6/64 Scope:Link
inet6 addr: 2001:19f0:6801:187:5400:ff:fe60:afc6/64 Scope:Global

inet6 addr: 2001:19f0:6801:187:ea1e:eb99:13ae:d49a/128 Scope:Global
UP BROADCAST RUNNING ALLMULTI MULTICAST MTU:1500 Metric:1
RX packets:1526389 errors:0 dropped:0 overruns:0 frame:0
TX packets:1622562 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:280302410 (267.3 MiB) TX bytes:266740313 (254.3 MiB)


If I try to bind to e.g. 2001:19f0:6801:187:a:b:c:d, it fails with "bind: cannot assign requested address". But if I do ip -6 addr add dev eth0 2001:19f0:6801:187:a:b:c:d, then I'm able to start the server listening on that IP address.




How can I configure Linux so that I can listen on any 2001:19f0:6801:187::/64 address? That is, I want to bind to some specific IP address without having to ip addr add it first.



Or should I just have my server ip addr add an address before binding, then maybe ip addr del it when I'm done?



Addendum: In case my problem isn't clear, I've already gotten far enough that the whole prefix is getting routed to my server so that it can, for example, respond to pings for any address with that prefix. If I start a TCP listening on "[::]:80", it will respond to requests to any IP address. What I want is to be able to listen on a specific IP address so that only requests addressed to that IP address will hit the server. Other ServerFault questions linked to are asking how to get a server to respond to requests to any IP address. I've already gotten that far. I want to be able to bind to any arbitrary address, but only one specific one. The problem is that Linux won't even let me start the server on a specific address if that particular address isn't statically assigned to an interface, and I'd like to work around that.



To be even more concrete, I can presently run a TCP echo server on my VPS on all interfaces:



ncat -l 2000 --keep-open --exec "/bin/cat"



Then from my laptop, I can connect to it using any random IPv6 address:



telnet 2001:19f0:6801:187:: 2000
telnet 2001:19f0:6801:187:abc:def:: 2000
telnet 2001:19f0:6801:187:abc:def:123:0 2000


This all works. If I start the server on a statically assigned address, it also works:




ncat -l 2001:19f0:6801:187:5400:ff:fe60:afc6 2000 --keep-open --exec "/bin/cat"


Now I can only connect to that particular IP address. So far so good.



Now I'd like to be able to start a server on some random address:



ncat -l 2001:19f0:6801:187:abc:123:: 2000 --keep-open --exec "/bin/cat"



But I get an error: "Ncat: bind to 2001:19f0:6801:187:abc:123:::2000: Cannot assign requested address. QUITTING." But if I ip -6 addr add dev eth0 2001:19f0:6801:187:abc:123::/64, then the previous ncat command works, and the server starts and only responds to connections to 2001:19f0:6801:187:abc:123::.



So can I configure Linux to let me start a server on any arbitrary address in my block without first adding it as a static address?



(Actually, my question is very similar to https://stackoverflow.com/questions/40198619/can-docker-automatically-add-ip-addresses-to-the-host-upon-running-container, although there they're talking about IPv4. There the answer is to statically add all addresses.)

No comments:

Post a Comment

linux - How to SSH to ec2 instance in VPC private subnet via NAT server

I have created a VPC in aws with a public subnet and a private subnet. The private subnet does not have direct access to external network. S...