I'm trying to implement NAT64 with tayga on my server and came to a point where I'm not sure how to proceed.
My server is connected via one IPv4 address and one /64 IPv6 address block to the internet. It servers all kind of stuff. For reasons I'm also running some LinuX Containers (LXC). These are IPv6 exclusive. I implemented a bridge (br0) on my host system and switched addresses from eth0 to br0. My containers successfully communicate with each other on IPv6. Via mod_proxy on my host I could connect my ipv6 only webservers (LXC) to the IPv4 internet, too. But just in one direction, you could say.
For some auto-update functionalities I need NAT64+DNS6, because some update servers don't speak IPv6.
Let's assume the following and beware that the IP addresses are not really in use.
inet address: 10.0.0.1 # external IP inet6 address: 2a01::1/64 # external IP
# external IP, some ip6tables forward rules implemented on the host inet6 address: 2a01::2/64
I installed tayga on my host and configured it like that:
tun-device nat64 ipv4-addr 192.168.255.1 prefix 2a01:0:0:0:64::/96 map 192.168.255.2 2a01::2
Tayga auto chooses an IPv6 address from that /96 subnet. Then I created the interface.
Now, you ought to add each an IPv4 and IPv6 address to the nat64 interface. According to the FAQ it's not a good idea to use the same IP addresses to host uses. On the other hand it's stated to use the routers (internal) addresses. But I could take totally different ones, too, and then would be asked to add the needed routes. Let me cite something:
# ip link set nat64 up # ip addr add 192.168.0.1 dev nat64 (replace with your router's IPv4 address) # ip addr add 2001:db8:1::1 dev nat64 (replace with your router's IPv6 address) # ip route add 192.168.255.0/24 dev nat64 # ip route add 2001:db8:1:ffff::/96 dev nat64
I'm not sure what to do. What addresses should I use? Just use some private IPv4/IPv6 addresses? And what else is needed? One source talks about adding some forward rules (I already changed eth0 to br0, as I use br0):
iptables -t nat -A POSTROUTING -o br0 -j MASQUERADE iptables -A FORWARD -i br0 -o nat64 -m state --state RELATED,ESTABLISHED -j ACCEPT iptables -A FORWARD -i nat64 -o br0 -j ACCEPT
Thing is, I tried thing's and once I could
on my host. But I couldn't manage to get my LXC talk to any system. Not 2a01:0:0:0:64::192.168.255.1 or maybe 2a01:0:0:0:64::188.8.131.52 (Google).
Right now I don't care about the not yet fully implemented DNS64. I installed some debian package and (think to) know how to configure it, just didn't try it yet.
The sources I consulted: http://www.litech.org/tayga/ http://www.litech.org/tayga/faq.html http://www.litech.org/tayga/README-0.9.2 http://ipvsix.me/?p=106 http://stuartl.longlandclan.yi.org/blog/2011/06/23/nat64dns64-in-gentoo/ http://blog.raorn.name/2012/02/ipv6-only-lan-with-dual-stack-openwrt.html
From 2a01::64:0:c0a8:ff01 icmp_seq=1 Destination unreachable: Unknown code 5
That's the address tayga choose on its own. I tried pinging From 2a01:0:0:0:64::184.108.40.206. I added those mentioned iptables rules and did this:
ip link set nat64 up ip addr add 192.168.255.1 dev nat64 ip addr add 2a01::1 dev nat64 ip route add 192.168.255.0/24 dev nat64 ip route add 2a01:0.0.0.64::/96 dev nat64
Still, I can ping 2a01:0:0:0:64::192.168.255.1, but only from my host. My LXC can't even reach that address.
Yes, I ruled out wrong ip6tables rules.