GNU/Linux 6in4隧道IPv6路由条目异常变更原因排查求助

Hey there, let’s walk through the most likely causes behind your 6in4 tunnel route changing hours after server restart. I’ve troubleshooted similar IPv6 routing quirks before, so here’s what to look into:

• Flaky Tunnel Management Services
  If you’re using tools like aiccu or a custom script to maintain your 6in4 tunnel, periodic health checks or unexpected restarts could overwrite your original route. Many tunnel daemons re-negotiate sessions if they detect connectivity blips. Check service logs with journalctl -u <your-tunnel-service> (replace with aiccu or your actual service name) to see if restart events line up with when the route changes.

• Dynamic Routing Daemons
  IPv6 routing tools like radvd or bird adjust routes based on network conditions. For example, radvd might advertise an updated prefix, or bird could pull new routing info from your tunnel provider. Verify if these services are active with systemctl status radvd and audit their configs for rules that auto-adjust routes.

• Tunnel Provider Side Adjustments
  Your tunnel host might be doing maintenance, load-balancing, or reassigning IPv6 prefixes periodically. When their endpoint configuration shifts, your tunnel will re-establish with a new route. Check if the provider has had recent outages or scheduled work, or reach out to their support team for details.

• Stale Kernel Routes
  If your original route was added manually (not saved in persistent configs), the Linux kernel’s route garbage collection might mark it as stale after inactivity and replace it. Confirm the route is persistent: check /etc/network/interfaces (Debian/Ubuntu) or /etc/sysconfig/network-scripts/ (RHEL/CentOS). Use ip -6 route show to check if the route has an expires timestamp that lines up with the change.

• Firewall/Monitoring Tool Interference
  Custom scripts, fail2ban, or nftables rules might modify routes as part of their logic. For example, a script could switch to a fallback route if it detects a temporary tunnel outage, then fail to revert it. Check cron jobs in /etc/cron.d/, network hook scripts in /etc/network/if-up.d/, and firewall logs for route-altering actions.

• IPv6 Neighbor Discovery Flaps
  If your tunnel endpoint’s link-local address changes (e.g., provider server restarts), your system’s neighbor cache will update, which can indirectly alter the route. Use ip -6 neigh show to check if the endpoint’s neighbor entry is changing around the time your route shifts.

内容的提问来源于stack exchange，提问作者hans