A quick introduction to: DNS64, NAT64, 464XLAT, SIIT-DC, SIIT-DC-2XLAT RUNNING IPV6-ONLY SERVERS IN MS A quick introduction to: DNS64, NAT64, 464XLAT, SIIT-DC, SIIT-DC-2XLAT Tore Anderson tore@redpill-linpro.com Redpill Linpro AS, Managed Services RL Gathering, Sunne, September 2015

Motivation for IPv6-only Limited availability of public IPv4 addresses ~80% used today, can't get more from RIPE NCC Private RFC1918 is a band-aid only No real support for NAT44 in our infrastructure Might overlap with customers' VPN ranges We do want to deliver IPv6 to our customers Facebook: IPv6 is ~15% faster than IPv4 Soon mandated by Norwegian government Dual stack (IPv4 + IPv6) means dual work, dual complexity, dual monitoring, dual firewall rules, etc. Single stack preferred (even IPv4-only...)

DNS64 + NAT64 Provides every IPv6(-only) node in our network with outbound access to the IPv4 Internet DNS64 synthesises IPv6 IN AAAA records for IPv4- only hostnames that have IN A records only The closest NAT64 gateway receives packets destined for the DNS64-synthesised addresses, then performs stateful NAPT to a shared pool of public IPv4 addresses baseconfig::dns will automatically provision DNS64 resolvers to nodes without IPv4 addresses Demo time!

464XLAT A CLAT agent creates a virtual network interface with a private IPv4 address on an IPv6-only host Provides outbound access to the IPv4 Internet Works around legacy soft- and wetware that are using IPv4-only (AF_INET) APIs, commands, etc. IPv4 packets are translated locally to IPv6, then routed to the closest NAT64 gateway where they are translated back to IPv4 Demo time!

SIIT-DC Provides an IPv6-only node/service/application in our network with an public IPv4 personality / front- end reachable from the IPv4 Internet Our SIIT-DC Border Relay nodes perform stateless IPv4<->IPv6 translation An 1:1 IPv4:IPv6 mapping is configured in Hiera for each IPv6 service made reachable through SIIT-DC SIIT-DC BRs in all our data centres - anycast provides High Availability and optimal routing Client's source IPv4 source address is mapped into IPv6, no loss of information occurs Demo time!

SIIT-DC-2XLAT Similar to 464XLAT, only that it works in concert with SIIT-DC instead of NAT64 Supports bi-directional traffic, fully stateless Provides a virtual IPv4 interface with a public IPv4 address on the IPv6-only node No address translation end-to-end Allows IPv4-only applications/services/humans to successfully use IPv4-only AF_INET sockets, commands, and so on Demo time!

Firewall rules / ACLs NAT64 uses translation prefix 2a02:c0::64:0:0:0/64 SIIT-DC uses translation prefix 2a02:c0::46:0:0:0/64 IPv4 address embedded in last 32 bits, e.g.: 192.0.2.1 = 2a02:c0::64:0:192.0.2.1 (NAT64) 192.0.2.2 = 2a02:c0::46:0:192.0.2.2 (SIIT-DC) IPv6 prefix length = 128 - 32 + IPv4_prefix_length: 192.0.2.0/24 = 2a02:c0::64:0:192.0.2.0/120 (NAT64) PFW ingressfilter6 example (allows DNS towards Google via NAT64): -p udp --dport 53 -d 2a02:c0::64:0:8.8.8.8 -j ACCEPT PFW egressfilter6 example (allows IPv4 SSH from RL MS via SIIT-DC): -p tcp --dport 22 -s 2a02:c0::46:0:87.238.42.0/122 -j ACCEPT Protip: PFW uses DNS64 servers when resolving hostnames

Summary We're ready for IPv6-only production environments! One missing piece: Kickoff (PXE-boot/network install) Workaround: Use RFC1918 for that, but disable IPv4 after installation (in /etc/network/interfaces or /etc/sysconfig/network-scripts/ifcfg-*) Puppet module for clatd (host agent for 464XLAT/SIIT-DC-2XLAT) is coming https://github.com/toreanderson/clatd https://wiki.redpill-linpro.com/SIIT_and_NAT64 Questions?