Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to implement NAT64 with tayga on my server and came to a point where I'm not sure how to proceed.

My server is connected via one IPv4 address and one /64 IPv6 address block to the internet. It servers all kind of stuff. For reasons I'm also running some LinuX Containers (LXC). These are IPv6 exclusive. I implemented a bridge (br0) on my host system and switched addresses from eth0 to br0. My containers successfully communicate with each other on IPv6. Via mod_proxy on my host I could connect my ipv6 only webservers (LXC) to the IPv4 internet, too. But just in one direction, you could say.

For some auto-update functionalities I need NAT64+DNS6, because some update servers don't speak IPv6.

Let's assume the following and beware that the IP addresses are not really in use.

Host br0:

inet address: # external IP
inet6 address: 2a01::1/64 # external IP

LXC eth0:

# external IP, some ip6tables forward rules implemented on the host 
inet6 address: 2a01::2/64

I installed tayga on my host and configured it like that:

tun-device nat64
prefix 2a01:0:0:0:64::/96
map 2a01::2

Tayga auto chooses an IPv6 address from that /96 subnet. Then I created the interface.

$>tayga --mktun

Now, you ought to add each an IPv4 and IPv6 address to the nat64 interface. According to the FAQ it's not a good idea to use the same IP addresses to host uses. On the other hand it's stated to use the routers (internal) addresses. But I could take totally different ones, too, and then would be asked to add the needed routes. Let me cite something:

# ip link set nat64 up
# ip addr add dev nat64      (replace with your router's IPv4 address)
# ip addr add 2001:db8:1::1 dev nat64    (replace with your router's IPv6 address)
# ip route add dev nat64
# ip route add 2001:db8:1:ffff::/96 dev nat64

I'm not sure what to do. What addresses should I use? Just use some private IPv4/IPv6 addresses? And what else is needed? One source talks about adding some forward rules (I already changed eth0 to br0, as I use br0):

iptables -t nat -A POSTROUTING -o br0 -j MASQUERADE
iptables -A FORWARD -i br0 -o nat64 -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -i nat64 -o br0 -j ACCEPT

Thing is, I tried thing's and once I could

ping6 2a01:0:0:0:64::

on my host. But I couldn't manage to get my LXC talk to any system. Not 2a01:0:0:0:64:: or maybe 2a01:0:0:0:64:: (Google).

Right now I don't care about the not yet fully implemented DNS64. I installed some debian package and (think to) know how to configure it, just didn't try it yet.

The sources I consulted:

Update 1:

From 2a01::64:0:c0a8:ff01 icmp_seq=1 Destination unreachable: Unknown code 5

That's the address tayga choose on its own. I tried pinging From 2a01:0:0:0:64:: I added those mentioned iptables rules and did this:

ip link set nat64 up
ip addr add dev nat64
ip addr add 2a01::1 dev nat64
ip route add dev nat64
ip route add 2a01: dev nat64

Still, I can ping 2a01:0:0:0:64::, but only from my host. My LXC can't even reach that address.

Yes, I ruled out wrong ip6tables rules.

share|improve this question

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.