IPv6 and thoughts regarding its implementation

Steps to getting your self onto IPv6:

  1. Get yourself an IPv6 address, either from your ISP or from a tunnel broker such as Hurricane Electric.
  2. Get your router (or a suitable PC or VM with bridged interface on your network) talking IPv6
  3. Run a route advertisement daemon, configure forwarding, and firewall rules
  4. Watch the dancing turtle

How many addresses do you get?

A heptillion (2^64) is standard. If that's not enough then you can request an additional /48 block which is 2^(128-48) addresses, or roughly 65,536 worth of the previous amount.

Look at it this way: you get more addresses than the entire routeable (non-RFC1918) Internet all for yourself.

What do you do with these addresses? What are privacy extensions?

Use a new address for every request. Or change it every couple of hours. Seriously. Your operating system should be able to rotate addresses every 24 hours or so which keeps you having a fresh one every time.

Refer to RFC3041 Privacy Extensions for Stateless Address Autoconfiguration in IPv6 for more details and considerations on how to do that.

You probably have one you want to keep, which is based on your MAC address:

inet6 fe80::a00:27ff:fe78:fe64%em0 prefixlen 64 scopeid 0x1

He starts with fe80::, has the first couple of chunks of your MAC address with a bit flipped, ff:fe, then the rest of your MAC address. If you want it on your routable address space, then you will automatically get fe80:: replaced with your /64.

2001:db8:1234:abcd:a00:27ff:fe78:fe64

This particular MAC address (08:00:27:78:fe:64) was randomly assigned by VirtualBox when I spun up the VM, so 08:00:27 indicates that this is a VirtualBox adapter.

A traceroute

From a VM at home (the one that hosts my IPv6 router), to a VM in a data center overseas (both ends are using tunnels from he.net as the ISP and host do not have native IPv6 support):

traceroute6 to 2001:470:d:eac:0:dead:beef:face (2001:470:d:eac:0:dead:beef:face) from 2001:470:36:b6f:a00:27ff:fe78:fe64, 64 hops max, 12 byte packets
 1  tipene-3.tunnel.tserv25.sin1.ipv6.he.net  10.389 ms  9.277 ms  7.161 ms
 2  gige-g2-13.core1.sin1.he.net  4.613 ms  12.133 ms  4.993 ms
 3  10gigabitethernet1-4.core1.tyo1.he.net  72.57 ms  72.108 ms  84.587 ms
 4  10gigabitethernet15-2.core1.lax2.he.net  170.124 ms  188.61 ms  170.284 ms
 5  10gigabitethernet2-1.core1.lax1.he.net  1094.18 ms  173.009 ms  172.035 ms
 6  tserv1.lax1.he.net  178.548 ms  176.246 ms  175.682 ms
 7  dead-beef-face.obvi.us  180.397 ms  176.464 ms  173.055 ms

Other hosts on the network see one more hop at the start: the VM that hosts the IPv6 end point.

Different operating systems as a router

Here I will attempt to explain how to use one of Ubuntu 12.04, Fedora 19, Debian 7, or OpenBSD 5.3 as a router for your Hurricane Electric tunnel.

Note that you only need one IPv6 router on your network and once you set it up to broadcast its services, all other hosts will fall into line and Just Work(tm). Even Windows XP!

In my examples I am being lazy: a VM hosted in VirtualBox has a single bridged network adapter that allows it to communicate on the LAN. All hosts on the LAN then send their IPv6 traffic to this host, which then packages it up and sends it off to the tunnel broker.

Naturally, you can add N NICs, allowing IPv6 to come in one interface and go streaming back out another. You can even use real physical hardware. If you just want to play, this is sufficient.

Please note that tunnelbroker.net generates completely adequate instructions for all these operating systems and you'll be talking to the Internet over IPv6 and using your endpoint (::2) as your source address. That's fine. But for extra brownie points I now describe how to add a router advertisement to your network so that ALL your devices can talk IPv6 without any effort on their part, and you use your routed /64 so you can use privacy extensions and all that good stuff.

CentOS / RHEL 5

Just follow the instructions on he.net.

eth0 will continue to use the local endpoint address (::2) as its default address for everything. You can alias this to an address within your /64 to give more options for incoming traffic, or for outgoing traffic from applications that support specifying a source address.

I have not use this as a gateway, but it is feasible.

Ubuntu 12.04

The instructions for configuring /etc/network/interfaces did not work for me. Instead I killed NetworkManager then use the Linux net-tools instructions.

Later after some fooling around (and killed NetworkManager) I was able to get /etc/network/interfaces working.

Setup a standard radvd configuration to advertise your /64 on eth0.

Run: service radvd start

Add: sysctl net.ipv6.conf.eth0.forwarding = 1

Fedora 19

Instructions work fine.

The firewall is quite restrictive by default. Add your /64 to FORWARD_SOURCE_ZONE (check this name).

Setup a standard radvd configuration to advertise your /64 on p2p1.

Run: systemctl start radvd.service

Run: systemctl enable radvd.service

Add: sysctl net.ipv6.conf.p2p1.forwarding = 1

Debian 7

Instructions work fine.

Setup a standard radvd configuration to advertise your /64 on eth0.

Run: service radvd start

Run: update-rc.d radvd enable

Add: sysctl net.ipv6.conf.eth0.forwarding = 1

OpenBSD 5.3

Instructions work fine.

Your NIC (em0) is left using the standard router address (::2) so you can manually alias anything you want (based on your MAC and /64):

ifconfig em0 inet6 alias 2001:db8:36:b6f:a00:27ff:fe78:fe64

Setup a standard rtadvd configuration to advertise your /64 on em0.

/etc/rc.d/rtadvd start

Add: sysctl net.inet6.ip6.forwarding=1

Add firewall rules to /etc/pf.conf .

Different operating systems on the network

If it's modern, IPv6 works straight out of the box. Check your network interface right now. You'll see IPv6 addresses beginning with ff80:: and containing parts of your MAC address (as described above). Excellent. All you now need is a router advertisement sent by a suitable gateway (which you can configure above).

Microsoft Windows 8.1 / 8

Works straight out of the box.

I find that it is difficult to get to the classic adapter information box. Hit your Windows key, type "network", select "Settings" on right, click "View network connections".

You will see your IPv6 address, as well as a "Temporary IPv6 address", which is a privacy address.

Windows 7

Works straight out of the box.

You will see your IPv6 address, as well as a "Temporary IPv6 address", which is a privacy address.

Windows XP SP3

Open a terminal. Type: ipv6 install

Hope for the best. You may need to delete some of the Teredo and other bullshit adapters: ipv6 ifd 5 (assuming Teredo is interface 5)

In my most perverse setup I have a Fedora 19 VM providing the IPv6 gateway for a Windows XP host.

Debian 7

Works straight out of the box.

Fedora 19

Works straight out of the box.

OpenBSD 5.3

Do you want to use rtsol to configure your adapter? Yes, you do.

You will get privacy addresses automatically rotating in and out.


http://sdc.org.nz/notes/