OpenVPN и IPv6 не работают

# Tunnel subnet prefix
prefix=2001:aaaa:bbbb:cccc:80::
# netmask
prefixlen=112

# Listen port
port 443
 
# Protocol
proto tcp-server
 
# IP tunnel
dev tun0
tun-ipv6
push tun-ipv6
 
# Master certificate
ca ca.crt
 
# Server certificate
cert debforvpn.crt
 
# Server private key
key debforvpn.key
 
# Diffie-Hellman parameters
dh debforvpn.pem
 
# Allow clients to communicate with each other
client-to-client
 
# Client config dir
client-config-dir /etc/openvpn/ccd
 
# Run client-specific script on connection and disconnection
script-security 2
client-connect "/usr/bin/sudo -u root /etc/openvpn/server-clientconnect.sh"
client-disconnect "/usr/bin/sudo -u root /etc/openvpn/server-clientdisconnect.sh"
 
# Server mode and client subnets
server 10.8.0.0 255.255.255.0
server-ipv6 2001:aaaa:bbbb:cccc:80::/112
topology subnet
 
# IPv6 routes
push "route-ipv6 2001:aaaa:bbbb:cccc::/64"
push "route-ipv6 2000::/3"
 
# DNS (for Windows)
# These are OpenDNS
push "dhcp-option DNS 208.67.222.222"
push "dhcp-option DNS 208.67.220.220"
 
# Configure all clients to redirect their default network gateway through the VPN
push "redirect-gateway def1 bypass-dhcp"
push "redirect-gateway ipv6" #For iOS
 
# Don't need to re-read keys and re-create tun at restart
persist-key
persist-tun
 
# Ping every 10s. Timeout of 120s.
keepalive 10 120
 
# Enable compression
comp-lzo
 
# User and group
user vpn
group vpn
 
# Log a short status
status openvpn-status.log
 
# Logging verbosity
verb 4

ifconfig-push 10.8.0.101 255.255.255.0
ifconfig-ipv6-push 2001:aaaa:bbbb:cccc:80::1001/112 2001:aaaa:bbbb:cccc:80::1

Chain INPUT (policy DROP)
target     prot opt source               destination         
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere             ctstate RELATED,ESTABLISHED
ACCEPT     icmp --  <censored>           anywhere             icmp echo-request 
ACCEPT     icmp --  <censored>           anywhere             icmptype 6
ACCEPT     tcp  --  <censored>           anywhere             tcp dpt:22
ACCEPT     tcp  --  <censored>           anywhere             tcp dpt:https

Chain FORWARD (policy DROP)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         

iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

# IPv6 configuration
net.ipv6.conf.all.autoconf = 1
net.ipv6.conf.all.accept_ra = 0

# For OpenVPN
net.ipv4.ip_forward = 1
net.ipv6.conf.all.forwarding = 1
net.ipv6.conf.all.proxy_ndp = 1
net.ipv4.conf.all.accept_redirects = 0
net.ipv6.conf.all.accept_redirects = 0
net.ipv4.conf.all.send_redirects = 0

Mon Jan 29 19:05:36 2018 us=988898 mikrotik/xx.xxx.xxx.xxx:52839 MULTI: bad source address from client [fe80::xxxx:xxxx:xxxx:xxxx], packet dropped