Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm trying to implement NAT64 with tayga on my server and came to a point where I'm not sure how to proceed.

My server is connected via one IPv4 address and one /64 IPv6 address block to the internet. It servers all kind of stuff. For reasons I'm also running some LinuX Containers (LXC). These are IPv6 exclusive. I implemented a bridge (br0) on my host system and switched addresses from eth0 to br0. My containers successfully communicate with each other on IPv6. Via mod_proxy on my host I could connect my ipv6 only webservers (LXC) to the IPv4 internet, too. But just in one direction, you could say.

For some auto-update functionalities I need NAT64+DNS6, because some update servers don't speak IPv6.

Let's assume the following and beware that the IP addresses are not really in use.

Host br0:

inet address: 10.0.0.1 # external IP
inet6 address: 2a01::1/64 # external IP

LXC eth0:

# external IP, some ip6tables forward rules implemented on the host 
inet6 address: 2a01::2/64

I installed tayga on my host and configured it like that:

tun-device nat64
ipv4-addr 192.168.255.1
prefix 2a01:0:0:0:64::/96
map 192.168.255.2 2a01::2

Tayga auto chooses an IPv6 address from that /96 subnet. Then I created the interface.

$>tayga --mktun

Now, you ought to add each an IPv4 and IPv6 address to the nat64 interface. According to the FAQ it's not a good idea to use the same IP addresses to host uses. On the other hand it's stated to use the routers (internal) addresses. But I could take totally different ones, too, and then would be asked to add the needed routes. Let me cite something:

# ip link set nat64 up
# ip addr add 192.168.0.1 dev nat64      (replace with your router's IPv4 address)
# ip addr add 2001:db8:1::1 dev nat64    (replace with your router's IPv6 address)
# ip route add 192.168.255.0/24 dev nat64
# ip route add 2001:db8:1:ffff::/96 dev nat64

I'm not sure what to do. What addresses should I use? Just use some private IPv4/IPv6 addresses? And what else is needed? One source talks about adding some forward rules (I already changed eth0 to br0, as I use br0):

iptables -t nat -A POSTROUTING -o br0 -j MASQUERADE
iptables -A FORWARD -i br0 -o nat64 -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -i nat64 -o br0 -j ACCEPT

Thing is, I tried thing's and once I could

ping6 2a01:0:0:0:64::192.168.255.1

on my host. But I couldn't manage to get my LXC talk to any system. Not 2a01:0:0:0:64::192.168.255.1 or maybe 2a01:0:0:0:64::8.8.8.8 (Google).

Right now I don't care about the not yet fully implemented DNS64. I installed some debian package and (think to) know how to configure it, just didn't try it yet.

The sources I consulted: http://www.litech.org/tayga/ http://www.litech.org/tayga/faq.html http://www.litech.org/tayga/README-0.9.2 http://ipvsix.me/?p=106 http://stuartl.longlandclan.yi.org/blog/2011/06/23/nat64dns64-in-gentoo/ http://blog.raorn.name/2012/02/ipv6-only-lan-with-dual-stack-openwrt.html

Update 1:

From 2a01::64:0:c0a8:ff01 icmp_seq=1 Destination unreachable: Unknown code 5

That's the address tayga choose on its own. I tried pinging From 2a01:0:0:0:64::8.8.8.8. I added those mentioned iptables rules and did this:

ip link set nat64 up
ip addr add 192.168.255.1 dev nat64
ip addr add 2a01::1 dev nat64
ip route add 192.168.255.0/24 dev nat64
ip route add 2a01:0.0.0.64::/96 dev nat64

Still, I can ping 2a01:0:0:0:64::192.168.255.1, but only from my host. My LXC can't even reach that address.

Yes, I ruled out wrong ip6tables rules.

share|improve this question
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.