3

Netfilter says they have support for SNAT and DNAT for ipv6. I look under the man pages of ip6tables and see that there is SNAT and DNAT listed. So my question is how do you make rules for them? I tried using the same structure of the rules for iptables, but ip6tables does not have a nat table and SNAT/DNAT are virtual states. So I don't know what modifications to make from an example like:

iptables -t nat -A POSTROUTING -o eth0 -j SNAT --to 1.2.3.4

to be applicable to ip6tables. Thanks for the help!

7
  • 2
    I don't know what man pages you're reading, but my ip6tables man page says nothing about SNAT or DNAT. As you're probably aware, there is no such thing in IPv6. Jan 17, 2013 at 22:02
  • 5
    Not to mention, if you're even thinking about NAT in the context of an IPv6 deployment, something is horribly wrong and you need to revisit your network design. Jan 18, 2013 at 4:30
  • 2
    NAT in IPv6 is evil. NAT support for IPv6 was only added in the Linux kernel because many idiots were implementing it and distributing crappy patches to do it. Sadly, Harald Welte's position about integrating IPv6 NAT in the kernel softened from "over my dead body" to "there are some legitimate cases"
    – BatchyX
    Aug 30, 2013 at 11:08
  • 2
    NAT66 IS a necessary evil. When your ISP only assigns you a /64, and you don't want to break standard autoconfiguration tools, then you MUST use NAT66 to add more networks. QED.
    – user210509
    Feb 23, 2014 at 13:58
  • 4
    When your ISP only assigns you a /64, you need to beat them over the head with RFC 6177. Feb 23, 2014 at 14:04

3 Answers 3

5

EDIT**: You need a 3.7+ kernel as that's when they released the NAT table for ipv6. Then you use iptables 1.4.17 and you can use the simple command of:

  • ip6tables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

ORIGINAL**:

Under the netfilter website you can find:

  • all kinds of network address and port translation, e.g. NAT/NAPT (IPv4 and IPv6)

From the ipv6 man page (http://linux.die.net/man/8/ip6tables)

  • SNAT
  • A virtual state, matching if the original source address differs from the reply destination.
  • DNAT
  • A virtual state, matching if the original destination differs from the reply source.

So it appears to be possible. But I have not found examples of its usage.

5
  • 2
    That page is out of date. No such tables or targets exist in ip6tables. Jan 18, 2013 at 1:53
  • 1
    I have seen them on my system's man page for version 1.4.12 that came with Ubuntu 12.04. Here is a link to the man page for that version: fredprod.com/cgi-bin/man/man2html?8+ip6tables It is listed on the website as having the capabilities. And here is the original posting from the netfilter developer mailing list: 68.183.106.108/lists/netfilter-devel/msg19979.html So I'm at a loss of why you think it's not there. I don't have experience with virtual states, but they're listed there. Jan 18, 2013 at 3:03
  • The actual man page from the upstream git repository contains no such code, and from what I can tell, never did. My guess is you are seeing an Ubuntu-specific patch in userspace (maybe Debian?). As for the kernel patch, I would expect that to have been rejected out of hand. Indeed, that patch does not seem to be in current kernels. In short, it's not there because it's not there, and somebody added it to your specific system without putting enough thought into it. Jan 18, 2013 at 4:19
  • 2
    So I just pulled the latest code from the git repository. And from it I can find the following files: iptables/extensions/libip6t_SNAT.c iptables/extensions/libip6t_DNAT.c Jan 18, 2013 at 16:50
  • Yes, I see it in the tree now. No idea why I couldn't see it before. Maybe I was looking at the wrong branch or something. Feb 23, 2014 at 14:14
2

I have a nat table:

apoc ~ # ip6tables -t nat -nvL
Chain PREROUTING (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain POSTROUTING (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

And can write SNAT rules:

apoc ~ # ip6tables -t nat -A POSTROUTING -o eth1 -j SNAT --to 2001:db8::1
apoc ~ # ip6tables -t nat -nvL POSTROUTING
Chain POSTROUTING (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 SNAT       all      *      eth1    ::/0                 ::/0                 to:2001:db8::1

This is on ArchLinux with kernel 3.10.7-1-ARCH; it is a fairly recent addition to the netfilter code.

I must reiterate Michael Hampton though:

Not to mention, if you're even thinking about NAT in the context of an IPv6 deployment, something is horribly wrong and you need to revisit your network design.

0

There is no NAT with IPv6. One of the main points of IPv6 is to eliminate NAT. NAT was invented (primarily) as a way to stretch out the usable amount of IPv4 space. With IPv6, we're getting back to the original design of all end-points on the Internet being addressable from all other end-points.

0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .