View Source: 6to4 - Waikato Linux Users Group

Edit PageHistory Diff Info LikePages
!!!What is 6to4
6to4 addressing is a type of [IPv6] address created by your IPv4 address.  It allows you to set up tunnels over the [IPv4] Internet automatically.

The range for this is 2002:<first two bytes of an ipv4 address>:<second two bytes of an ipv4 address>::/16.

This gives you a /48 to play around with, great if you have to put up with [NAT], now all the boxes behind your firewall will have realworld [IPv6] addresses at no extra cost!

Why would you want to use 6to4 instead of [FreeNet] addresses?  The major advantage is that 6to4 addresses will set up tunnels automagically to other 6to4 addresses.  This means you don't have to be constrained to the 6bone routing which can be rather inefficient (especially from NewZealand).  The advantage of using FreeNet addresses is that they are static even if your [IPv4] address is dynamic.

If you exclusively use 6to4 addresses, then you can use the 192.88.99.1 AnyCast address to get onto the 6bone which is probably far more efficient than using a 6bone tunnel, as the AnyCast address is likely to be far closer to you than FreeNet.  (In fact, in NewZealand this isn't true, the nearest AnyCast is in Germany, and FreeNet is "only" in America)
(If you're in Australia or NewZealand, you could try AARNET's endpoint, at 192.231.212.5.  Sometimes the routing tables seem to direct 192.88.99.1 to this address, but more often than not they're broken at the moment).

!!!How does it work?
The idea is that you create an IPv6 tunnel, (in these examples we call it tun6to4) where you route all your 6to4 packets to.  This tunnel has a "remote" of "any" which means that the kernel will figure out the remote point by looking at the 6to4 address, it will encapsulate the packet and send it to the IPv4 address embedded in the packet.

Packets that arrive at your machine that are encapsulated arrive through that tunnel and are deencapsulated.

Apparently you need a 2002:ip:v4::1 address somewhere on your gateway, although I'm not sure why.

Packets that transverse your machine are normally __not__ deencapsulated.  You need a tunnel with "remote any local any".  sit0 exists and has these charactoristics, but it's not up.  If you want packets to transverse your machine you should bring this tunnel up.

!!!Configuration Under Linux
!How do I get a 6to4 address?

You don't need to 'get' one - if you have an IPv4 addresss (even a dynamic one) you can get a 6to4 address.

To figure out your 6to4 address based on your IPv4 address:
<pre>
 printf "2002:%02x%02x:%02x%02x::1\n" `echo $IPV4ADDR | tr . ' '`
</pre>
Where $IPV4ADDR is your IPv4 address. Eg, if your IPv4 address is 192.0.2.23, then:
<pre>
 printf "2002:%02x%02x:%02x%02x::1\n" `echo 192.0.2.23 | tr . ' '`
 2002:c000:0217::1
</pre>
The network should be "/16".

There are two cases for setting this up under linux: if your IPv4 address is a static IP, or if its dynamic.
In either case you'll need to know what your 6to4 address is. The script mentioned above will help here.

See http://www.tldp.org/HOWTO/Linux+IPv6-HOWTO/configuring-ipv6to4-tunnels.html for more information.

!!Static IP

Static IP is obviously preferable, as you can set up DNS properly for it. Thats another issue entirely however :)
The following commands should set up a 6to4 tunnel for you:
<pre>
 ip tunnel add tun6to4 mode sit remote any local __''your-ipv4-address''__
 ip link set dev tun6to4 mtu 1472 up
 ip -6 addr add __''your-6to4-address''__/16 dev tun6to4
</pre>
So for our example IP above:
<pre>
 ip tunnel add tun6to4 mode sit remote any local 192.0.2.23
 ip link set dev tun6to4 mtu 1472 up
 ip -6 addr add 2002:c000:0217::1/16 dev tun6to4
</pre>
If you don't have the 6bone configured, run the following two commands:
<pre>
 ip -6 route add ::/96 dev tun6to4 metric 1 # setup route for v4mapped IPv6 addresses via the tunnel device.
 ip -6 route add 2000::/3 via ::192.88.99.1 dev tun6to4 metric 1
</pre>
192.88.99.1 is an AnyCast address for places that provide connectivity to non-6to4 addresses to 6to4 hosts.

To take the tunnel down again, run
<pre>
 /sbin/ip -6 route flush dev tun6to4
 /sbin/ip link set dev tun6to4 down
 /sbin/ip tunnel del tun6to4
</pre>

!Static IP under Debian:

Add the following stanza to /etc/network/interfaces, making obvious substitutions. It should "just" work.

If you are using woody (stable) then you'll need a backport of ifupdown from testing/unstable; available from http://debian.zugschlus.de/zg/pool/main/ifupdown/ifupdown_0.6.4-4.5zg6_i386.deb
<pre>
 auto tun6to4
 iface tun6to4 inet6 v4tunnel
        address __''your-6to4-address''__
        netmask 16
        endpoint any local __''your-ipv4-address''__
        up ip -6 route add ::/96 dev tun6to4 metric 1
        up ip -6 route add 2000::/3 via ::192.88.99.1 dev tun6to4 metric 1
        down ip -6 route flush dev tun6to4
        mtu 1472
        ttl 255
</pre>
!!Dynamic IP

This is a bit of a hassle. You need to update your 6to4 configuration every time you change IP. If your dynamic IP address isn't terminated on your Linux box (that is, you have a DSL router or similar, which handles NAT and so on for you), this might be tricky.

The best way to do this is to put a script in /etc/ppp/ip-up.d/  or whatever is most appropriate for your system

An example ip-up.d script.
<pre>
 #!/bin/bash
 # Kill any existing tunnels
 /sbin/ip -6 route flush dev tun6to4
 /sbin/ip link set dev tun6to4 down
 /sbin/ip tunnel del tun6to4

 # Create the new tunnel
 ip tunnel add tun6to4 mode sit remote any local $4
 ip link set dev tun6to4 mtu 1472 up

 # Route outgoing 6to4 addresses out via the tunnel
 ip -6 route add 2002::/16 dev tun6to4

 # Add an IPv6 address to eth0
 ip -6 addr add $(printf "2002:%02x%02x:%02x%02x::1/64" $(echo $4 | tr '.' ' ')) dev eth0

 # Uncomment the following lines if you want non 6to4 IPv6 addresses to be routed over
 # the 6to4 anycast address
 #
 # You DO want this if this is your only connection to the IPv6 backbone
 # You DO NOT want this if you have some other way of connecting to the IPv6 backbone (eg: Freenet6)
 # ip -6 route add ::/96 dev tun6to4 metric 1 # Obsolete "IPv4-compatible", See RFC4291 paragraph 2.5.5.1
 # ip -6 route add 0:0:0:0:0:ffff::/96 dev tun6to4 metric 1 # IPv4-mapped, see RFC4291 paragraph 2.5.5.2
 # ip -6 route add 2000::/3 via ::192.88.99.1 dev tun6to4 metric 1

 # Restart radvd (if you have it running)
 killall -1 radvd
</pre>

! Dynamic IP under Debian

I have prepared a (hackish, I'll admit) init script for Debian.

* Copy [this init script|http://www.wlug.org.nz/archive/6to4/6to4.init] to /etc/init.d/6to4
* Read over it to make sure you understand it, and make note of any suggested changes that might work better for you
* Copy [this default config|http://www.wlug.org.nz/archive/6to4/6to4.default] to /etc/default/6to4  and then edit it appropriately. (Like using 192.88.99.1 as the default router as stated higher up.)
* Copy these [ip-up|http://www.wlug.org.nz/archive/6to4/ipv6-6to4-up] and [ip-down|http://www.wlug.org.nz/archive/6to4/ipv6-6to4-down] fragments to /etc/ppp/ip-up.d/ and /etc/ppp/ip-down.d/, respectively
* If you use freenet6 as well, you might want to make sure freenet drops on [ip-down|http://www.wlug.org.nz/archive/6to4/freenet6-down] as well. It doesn't do this by default, but I suspect it causes issues.

To start your 6to4 tunnel, run /etc/init.d/6to4 start, to stop it run /etc/init.d/6to4 stop.  These should be run automatically whenever your ppp connection starts and stops.

If you don't use freenet6, then make sure that ONLYCONN in /etc/default/6to4 is set to 'yes' - this will enable a gateway route for non-6to4 addresses out via your 6to4 tunnel.

!!Testing
Use the __ping6__ program. (On Debian, you need to install the iputils-ping package to get the ipv6 version of ping).

The WLUG server has 6to4 set up, so you should be able to do:
<pre>
 $ ping6 2002:3cea:4272::1
 PING 2002:3cea:4272::1(2002:3cea:4272::1) 56 data bytes
 64 bytes from 2002:3cea:4272::1: icmp_seq=1 ttl=53 time=0.203 ms
 64 bytes from 2002:3cea:4272::1: icmp_seq=2 ttl=53 time=0.077 ms
 64 bytes from 2002:3cea:4272::1: icmp_seq=3 ttl=53 time=0.080 ms
</pre>


!!Using 6to4 addresses on your internal network

First you need to configure radvd. Zebra is not recommended as it cannot handle dynamic 6to4 address advertising (as radvd can) and also has a bug where it will write out a configuration to it's file that is invalid and then die when it tries to reload it again.

Your config file should look something like:
<pre>
 interface eth0
 {
   ~AdvSendAdvert on;
   prefix fec0::/64
   {

   };
   prefix 3ffe:''your-freenet-allocation'':1::/64
   {
   };
   prefix 0:0:0:0::/64
   {
           Base6to4Interface ppp0;

   };
   prefix 0:0:0:0::/64
   {
           Base6to4Interface lo:1;
   };
 };
</pre>


You can omit any of the prefix stanza's you don't like.
In the config above the timers have been turned down in anticipation that you are advertising a 6to4 address generated from a dynamic IP on ppp0. Note that if you do this you __must__ turn down the retransmit time on the unsolicited announcements. In particular ensure that ''~MaxRtrAdvInterval'' and ''~AdvPreferredLifetime'' are less than ''~AdvValidLifetime''. If you don't understand why this is important then you can just go with what is shown above.

You also need at least one SIT tunnel with a "remote any local any".  It doesn't need an ipv6 (or ipv4) address associated with it.  This is used for transpanret deencapsulation of IPv6 packets that are forwarded to your internal network.

If you've done all this, it should just work.  In practise, it requires some tinkering.

!!!Other Notes

See also:
* RFC:3056 (Connection of IPv6 Domains via IPv4 Clouds)
* RFC:3068 (An Anycast Prefix for 6to4 Relay Routers)
* RFC:3964 (Security Considerations for 6to4)

For information about setting up 6to4 under FreeBSD see http://www.nevada.net.nz/~pmurray/6to4.html (someone feel free to import that if you want to comment about it)

For information about setting up windows see http://research.microsoft.com/msripv6/docs/6to4.htm

Instead of using the 6to4 anycast address, you can use one of the addresses listed on http://www.kfu.com/~nsayer/6to4/ (the aarnet relay is highly recommended)

An howto on how to get this working under Fedora Core 2 is available here: http://yyz.us/ipv6-fc2-howto.html

!!!Problems
!!I'm getting ~400ms pings to places
You're using a non-2002 space address as your source address so the return route is going via freenet and adding 350ms to your [RTT].
This seems to occur semi-randomly, and is probably to do with the order in which your machine obtains its 6to4 and freenet6 addresses.

!!I can ping via 6to4 fine, but I cant view webpages?
This almost definitely means you have an MTU issue. If you can ping to a site (such as hoiho.wlug.org.nz) and can get a small file via HTTP (eg,
GET /robots.txt HTTP/1.0) but not the main index page, then your MTU is wrong.
I'm pretty sure this can be fixed by making sure the MTU on tun6to4 is set to 1472 bytes. I tested this on my link at home, where I was seeing this, and it worked fine (after I changed hoiho's MTU as well)

!!I can ping to a 6to4 host fine, but I can't ping a native IPv6 speaker
This means you don't have a gateway for 6to4 to non-6to4 addresses set up. You need to add a route for one of the AnyCast gateways. Re-read the above notes on 6to4 to see which lines you missed.
9 pages link to 6to4:
Last edited on Saturday, August 23, 2008 4:55:28 pm by "StephaneAlnet"
Edit PageHistory Diff Info LikePages