Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Currently I have a nice setup using private IPv4 address space and uplinks from two ISPs to the Internet. Thanks to NAT I can just take down one of the interfaces and the Internet access is still there.

I've been thinking how to duplicate this configuration in IPv6. From what I read is that "NAT is dead", I really glad for that, I don't like it (and sometimes outright hate it), but it has its uses.

To put some perspective in: this is a small company, 3 dozen computers in network, we don't have budget for fancy links with SLA and BGP support. So I think that our own IPv6 subnet from RIPE-NCC won't work.

On the other hand, having two independent links is more than useful. Is there a way to do a 1-to-1 NAT in IPv6 (I'm using Linux machine as a router)? How do I do it? Will it allow me to continue using two ISPs (provided that they both support IPv6).

When I get a subnet from my ISP I need to have an IP address facing the Internet (to be able to route packets to my ISP) and a second one facing my LAN. In IPv6 both should be routable. Doesn't this mean I have to get at least 2 subnets from my ISP? Or ISPs are required to provide a /48 subnet not only two /64 subnets? (And dedicate first /64 subnet to intra router communication.) What to do if I get only a single /64 subnet from ISP?

To summarize:


  • Can I do 1-to-1 NAT in IPv6 in Linux? How do I do it?
  • Do I need to receive at least two /64 subnets to comfortably set up routing in LAN behind firewall?
  • Is there a way to have public addresses in my LAN if I get a single /64 subnet from my ISP?
share|improve this question

1 Answer 1

up vote 3 down vote accepted

Without BGP and 'business class' ISPs multihoming isn't going to work for you. It is possible to do 1-to-1 NAT with IPv6. I don't know how to configure it on Linux though. There is another way though:

You will get a prefix from both ISPs. Probably a /56 or a /48. It doesn't really matter in this case if the link to the ISP gets it's own addresses or not. IPv6 can work perfectly with unnumbered uplinks. What you then do is to connect a router from each ISP to your LAN, and both should advertise a /64 from their own ISP on your LAN. So all your systems get (at least) two public IPv6 addresses: one from each ISP. You can give the advertisements of your primary ISP a higher priority. When the link to the ISP goes down the corresponding router should withdraw its advertisement and your systems will start using the other link.

The only downside is when one ISP doesn't accept packets with a source address from the other ISP. If that is the case then the routers should check the source address and forward traffic with the wrong source address to the other router.

If you only get a single /64 from your ISP then you can use that on your LAN. They should give you more than that though. A /48 used to be the standard for many years, a /56 is becoming more normal these days, but you should definitely get more than a /64.

share|improve this answer
3.5 years later and small-site multi-homing on IPv6 is still pretty much horribly broken. No commercial or open source routers/firewalls/whatever support the needed features suck as sub-prefix based configuration and RA deprecation. You still have to hack something together via scripts and monitoring to properly withdraw prefixes. See blog.ipspace.net/2015/01/… and all the related links. –  rmalayter Feb 3 at 3:10
Unfortunately small site multi homing is indeed not easy. The IETF homenet working group is working on it but it's not ready yet. I'm using LISP at the moment to solve it. It's a tunnelling protocol but it works well. –  Sander Steffann Feb 3 at 22:26

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.