2012-12-25

A quick guide to setting up a IPv6 Tunnel using public 6to4 relays under GNU/Linux

Setting up a 6to4 tunnel will allow IPv6 (or dualstack) hosts on networks that only have Public IPv4 addresses to access sites and services that are available via IPv6. The main steps are calculating the IPv6 version of your Public IPv4 address; establishing a 6to4 tunnel to one of the free IPv6 relays available; and configuring the local network to route IPv6 via the tunnel.


Overview of the Topology

  


  



Calculate IPv6 version of Public IP and Setup 6to4 tunnel


Calculate the 6to4 prefix (/48) of your Public IPv4 Address (http://checkip.dyndns.org) using WYAE's IPv6 Tunnel Calculator at http://www.wyae.de/docs/ipv6calc/



Alternatively, calculate the prefix from a Bash prompt, as below:
# printf "2002:%02x%02x:%02x%02x\n" `echo 123.187.233.132 | tr . ' '`
2002:7bbb:e984




Create the tunnel named '6to4' and allow any traffic to leave via the IPv4 WAN address (the address of the network card that is the next hop towards the Internet, 192.168.0.17 in the below example):
# ip tunnel add 6to4 mode sit remote any local 192.168.0.17

Bring up the tunnel:
# ip link set 6to4 up

Assign an IPv6 address to the tunnel interface, beginning with the prefix calculated earlier:
# ip addr add 2002:7bbb:e984::1/16 dev 6to4

Set the default IPv6 route to use the standard 6to4 Anycast address:
# ip -6 route add default via ::192.88.99.1 dev 6to4



Enable IPv6 routing


Enable forwarding:
# echo 1 > /proc/sys/net/ipv6/conf/all/forwarding

Install radvd (Router Advertisement Daemon) if not present:
# apt-get install radvd

Add an entry for your LAN interface to /etc/radvd.conf (use /64 prefix made up of combination of public IPv6 + padding. eg: 'f00d' as below)

interface eth1 {

  AdvSendAdvert on;

  prefix 2002:7bbb:e984:f00d::/64 {

    AdvOnLink on;

    AdvAutonomous on;

  };

};

Assign an address in the range specified in prefix to the LAN adaptor (eg: 2002:7bbb:e984:f00d::1/64) by setting in /etc/network/interfaces:

allow-hotplug eth1
iface eth1 inet6 static
address 2002:7bbb:e984:f00d::1
netmask 64

Start radvd:
# /etc/init.d/radvd start

On a client, bring up the network interface:
# ip link set dev eth3 up

radvd should have assigned it an address starting with the prefix specified in radvd.conf. Check the address, paying attention to the address shown in the global scope:
# ip -6 addr show dev eth3
2: eth3: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qlen 1000
inet6 2002:7bbb:e984:f00d:a00:27ff:fe37:a19c/64 scope global dynamic
valid_lft 85969sec preferred_lft 13969sec
inet6 fe80::a00:27ff:fe37:a19c/64 scope link
valid_lft forever preferred_lft forever



DNS Resolution


Modify /etc/resolv.conf to use Google's free IPv6 servers:
nameserver 2001:4860:4860::8888
nameserver 2001:4860:4860::8844



Testing


Show neighbors on the radvd router
# ip -6 neigh show
2002:7bbb:e984:f00d:a00:27ff:fe37:a19c dev eth1 lladdr 08:00:27:37:a1:9c REACHABLE

Show neighbors on the autoconfigured client
# ip -6 neigh show
fe80::a00:27ff:fe87:9124 dev eth3 lladdr 08:00:27:87:91:24 router STALE
2002:7bbb:e984:f00d::1 dev eth3 lladdr 08:00:27:87:91:24 REACHABLE

Show address of the interface:
# ip -6 addr show dev eth3
2: eth3: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qlen 1000
inet6 2002:7bbb:e984:f00d:a00:27ff:fe37:a19c/64 scope global dynamic
valid_lft 86359sec preferred_lft 14359sec
inet6 fe80::a00:27ff:fe37:a19c/64 scope link
valid_lft forever preferred_lft forever

Optionally, on the client: manually add the radvd router as the default gateway:
# ip -6 route add default via 2002:7bbb:e984:f00d::1

# ip -6 route show
2002:7bbb:e984:f00d::/64 dev eth3 proto kernel metric 256 expires 86187sec mtu 1500 advmss 1440 hoplimit 4294967295
fe80::/64 dev eth3 proto kernel metric 256 mtu 1500 advmss 1440 hoplimit 4294967295
default via fe80::a00:27ff:fe87:9124 dev eth3 proto kernel metric 1024 expires 1581sec mtu 1500 advmss 1440 hoplimit 64
default via 2002:7bbb:e984:f00d::1 dev eth3 metric 1024 mtu 1500 advmss 1440 hoplimit 4294967295

Test by pinging Google's DNS server. Use ping6 rather than ping.
# ping6 2001:4860:4860::8888
PING 2001:4860:4860::8888(2001:4860:4860::8888) 56 data bytes
64 bytes from 2001:4860:4860::8888: icmp_seq=1 ttl=56 time=299 ms
64 bytes from 2001:4860:4860::8888: icmp_seq=2 ttl=56 time=298 ms
64 bytes from 2001:4860:4860::8888: icmp_seq=3 ttl=56 time=297 ms
^C
--- 2001:4860:4860::8888 ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2002ms
rtt min/avg/max/mdev = 297.606/298.244/299.020/0.585 ms


Ping Google's IPv6 site:
# ping6 ipv6.google.com

PING ipv6.google.com(fra07s07-in-x69.1e100.net) 56 data bytes
64 bytes from fra07s07-in-x69.1e100.net: icmp_seq=1 ttl=58 time=431 ms
^C
--- ipv6.google.com ping statistics ---
2 packets transmitted, 1 received, 50% packet loss, time 1000ms
rtt min/avg/max/mdev = 431.460/431.460/431.460/0.000 ms


Test web access with lynx:





Example Bash script to automatically configure 6to4 tunnel and update radvd.conf

(requires that lynx be installed and obviously needs to be modified to reflect different interfaces, etc.)

#!/bin/bash

# find WAN address
WAN_ADDR=`ifconfig eth0 | grep inet\ addr | awk -F: '{ print $2 }' | awk '{ print $1 }'`
echo "WAN Address: $WAN_ADDR"

# find public IP address
/usr/bin/lynx -dump http://checkip.dyndns.org > /tmp/public-ip.txt
PUBLIC_IPv4=`cat /tmp/public-ip.txt | grep Addr | awk '{print $4}'`
export PUBLIC_IPv4
echo "Public IPv4 address: $PUBLIC_IPv4"

# convert public IP address to create IPv6 prefix
PUBLIC_IPv6=`printf "2002:%02x%02x:%02x%02x\n" \`echo $PUBLIC_IPv4 | tr . ' '\``
export PUBLIC_IPv6
echo "Public IPv6 prefix: $PUBLIC_IPv6"

echo 1 > /proc/sys/net/ipv6/conf/all/forwarding

# create the tunnel and allow any traffic to leave via the WAN address
ip tunnel add 6to4 mode sit remote any local $WAN_ADDR

# bring up the tunnel
ip link set 6to4 up

# add the converted public IP to the tunnel
ip addr add $PUBLIC_IPv6::1/16 dev 6to4

# route all IPv6 traffic to the 6to4 converter via the tunnel
ip -6 route add default via ::192.88.99.1 dev 6to4

# add dns servers to resolv.conf
echo "
nameserver 2001:4860:4860::8888
nameserver 2001:4860:4860::8844
" > /etc/resolv.conf

# update radvd.conf
cp /etc/radvd.conf /tmp/radvd.conf.BAK
echo "interface eth1 {
AdvSendAdvert on;

prefix $PUBLIC_IPv6:f00d::/64 {
AdvOnLink on;
AdvAutonomous on;
};
};" > /etc/radvd.conf

# restart radvd
/etc/init.d/radvd restart

No comments:

Post a Comment