Proxying Neighbor Discovery messages: ndproxy

On our systems at Hetzner we only have a single /64 IPv6 range, which we use to assign addresses to virtual systems, running in Xen and KVM. We also wish to perform layer 3 and 4 firewalling and traffic accounting on the host system, which means we don’t directly bridge the virtual machines to the external interface, but bridge them to a dummy interface on the host system. This implies that Neighbor Discovery messages that are generated on the internal bridge interface are not propagated to the outside network interface. We currently solve this by manually adding proxy rules, using the ip -6 neigh add proxy ... dev ... command.

The disadvantage of this approach is that you cannot add proxy rules for entire ranges of addresses. This is also not a good approach, because it may potentially pollute upstream routers with spurious entries. This is a problem for us, because we want to be able to simply assign new addresses to virtual machines without requiring manual reconfiguration on the host system. Therefore we have written a small script called ndproxy, which scans the output of ip -6 neigh show dev ... and replicates proxy entries on the outer interface.

The code is published in the ndproxy repository on GitHub. Enjoy!

*Image source: https://unsplash.com/photos/xekxE_VR0Ec

Tags: ,


One Response to “Proxying Neighbor Discovery messages: ndproxy”

  1. Daniel says:

    Check out NDP Proxy Daemon:
    http://www.tuhox.com/ndppd/

Leave a Reply

Kumina helps companies innovate with the power of open source software. As specialists in managed IT operations since 2007, our mission is simple: building and managing the perfectly tailored technical infrastructures that allow our clients to thrive.

With fully managed solutions, we help our customers unlock the full potential of the cloud and Kubernetes. Our team also supports organisations with IT consulting and Kubernetes training courses. Learn more about our services or get in touch, we would love to hear about your business and projects.