Page 1 of 1
starlink ipv6 gre tunnel problem
Posted: Fri Jun 28, 2024 3:16 pm
by ia2130
Hi everyone, I have two starlink in bypass mode and two mikrotik hex RouterOS 7.15.1. I use ipv6 to build gre tunnel between mikrotik and tunnel did not work.All ipv6 firewall rules is default, when I look at connections I see that grev6 tunnel use src address fe00 local address but other type vpn tunnel l2tp and wireguard use global address 2a0d and tunnel connect without problems.If I use my Global ipv6 address in Local Address in gre tunnel nothings is changed
Re: starlink ipv6 gre tunnel problem
Posted: Sat Jul 06, 2024 3:04 am
by sindy
I cannot currently test using Starlink, but betwen my two CHRs running 7.15.2, the gre6 tunnel works without any issues, even without specifying
local-address. So as usually in such cases, sniffing is the way to find out what is wrong. Assuming that keepalive is enabled in your GRE6 tunnel configuration, running
/tool/sniffer/quick ipv6-address=2a0d
1e00::/40 ip-protocol=gre on both hEXes will show you whether there are any attempts to send the GRE keepalives. If you can see the packets to leave through ether1 on one router but never to arrive to the other one, it means that Starlink filters GRE; otherwise there must be some issue with firewall or routing.
Re: starlink ipv6 gre tunnel problem
Posted: Sun Jul 07, 2024 4:42 pm
by ia2130
This problem only between two starlik, if I make GRE6 tunnel my home router and any of this starlink gre6 tunnel works without any issues.This problem only between two starlik. I do not use /tool/sniffer/ I see all connections in ipv6/firewall/Connections
Re: starlink ipv6 gre tunnel problem
Posted: Sun Jul 07, 2024 5:29 pm
by sindy
OK, /ipv6/firewall/connections is not bad, but sniffer shows you whether the packet has left through the correct (expected) ethernet interface at one end and whether the same packet has reached the ethernet interface at the remote end. /ipv6/firewall/connections do not care about interfaces, only addresses, protocols, and ports, and you can only see whether there was any response based on the S (Seen-Reply) attribute.
Something may be wrong with Starlink's handling of GRE on IPv6, with routing, or with the way how the GRE6 interface is created. Since other types of tunnels over IPv6 apparently work fine between two Starlinks, I deem the first variant most likely, but I still prefer to make conclusions based on evidence, not just assumptions.