Subject: A host who has private IPv4 address can communicate with IPv6 host globaly by 6to4 tunnel

From: "Jisuek.Lim" <[email-masked]>
Date: Wed, 22 Oct 2003 19:03:44 +0900

Hello all,
I have a idea about communication method with 6to4 tunnel.
Generally, we think a host who has private IPv4 address(because it is
behind NAT device) can not communicate with IPv6 host globally by
tunneling(6to4, config tunnel ..) But there is a way using 6to4 tunnel.
When we config 6to4 config on a host(for example windows2000 station) we
assign the host’s IPv4 address to the host’s 6to4 address(next to
2002:). And we know the host’s IPv4 address shoud be public IPv4
address. 
But, if we use the public IPv4 address which is on NAT device’s external
interface to make the host’s 6to4 address, the host can communicate with
IPv6 host globally using 6to4 tunnel and relay router. Following are do
list.
1.       Map the NAT device’s public address(select one) to the host’s
private address(configure on the NAT)
2.       On the NAT device, make a policy which permit incomming traffic
which has protocol number 41 to the host’s private address
3.       Change the NAT device’s public IPv4 address(which you selected)
to hex. format.
4.       Configure the host’s 6to4 address using upper hex.
5.       Add route table for 2002 traffic to tunnel interface, and ::/0
to relay router(relay router is provided by some orgnization)
 
And then,...try ping6 to any IPv6 address. following is the result of my
own test.
 
C:\>ping6 6to4.ipv6.fh-regensburg.de
Pinging 6to4.ipv6.fh-regensburg.de [2002:c25f:6cbf:1::1] with 32 bytes
of data:
 
Reply from 2002:c25f:6cbf:1::1: bytes=32 time=330ms
Reply from 2002:c25f:6cbf:1::1: bytes=32 time=329ms
Reply from 2002:c25f:6cbf:1::1: bytes=32 time=329ms
 
C:\>
C:\>ping6 www.kame.net
 
Pinging orange.kame.net [2001:200:0:8002:203:47ff:fea5:3085] with 32
bytes of data:
 
Reply from 2001:200:0:8002:203:47ff:fea5:3085: bytes=32 time=117ms
Reply from 2001:200:0:8002:203:47ff:fea5:3085: bytes=32 time=72ms
Reply from 2001:200:0:8002:203:47ff:fea5:3085: bytes=32 time=68ms
Reply from 2001:200:0:8002:203:47ff:fea5:3085: bytes=32 time=71ms
 
C:\>
 
Following is my computer’s IP config
 
C:\>ipconfig
 
Windows 2000 IP Configuration
 
Ethernet adapter : 
 
        Connection-specific DNS Suffix  . :
        IP Address. . . . . . . . . . . . : 192.168.1.60
        Subnet Mask . . . . . . . . . . . : 255.255.255.0
        Default Gateway . . . . . . . . . : 192.168.1.254
 
C:\>
 
as you know 192.168.1.60 is private address !!
Try it.
Thanks.
Jisuek. Lim

---

From: Tim Chown <[email-masked]>
Date: Wed, 22 Oct 2003 11:28:31 +0100

Hi,

Yes, this will work.  This technique is quite widely used, and is one
reason for this draft:
http://www.ietf.org/internet-drafts/draft-palet-v6ops-proto41-nat-01.txt

Essentially you forward the protocol 41 from the NAT to the internal host.

It is quite a popular "trick" with our students in their home DSL LANs.

The problem is that this only works for one host within the NAT network,
so if the NAT encompasses many sites, you're stuck.

Cheers,
Tim

On Wed, Oct 22, 2003 at 07:03:44PM +0900, Jisuek.Lim wrote:
>    When  we config 6to4 config on a host(for example windows2000 station)
>    we  assign  the host's IPv4 address to the host's 6to4 address(next to
>    2002:).  And  we  know  the  host's  IPv4 address shoud be public IPv4
>    address.
> 
>    But,  if  we  use  the  public  IPv4  address which is on NAT device's
>    external  interface  to  make  the  host's  6to4 address, the host can
>    communicate  with  IPv6  host  globally  using  6to4  tunnel and relay
>    router. Following are do list.
> 
>    1.       Map the NAT device's public address(select one) to the host's
>    2.        On  the  NAT  device,  make  a policy which permit incomming
>    traffic which has protocol number 41 to the host's private address
> 
>    3.        Change  the  NAT  device's  public  IPv4  address(which  you
>    selected) to hex. format.
> 
>    4.       Configure the host's 6to4 address using upper hex.
> 
>    5.        Add  route  table  for 2002 traffic to tunnel interface, and
>    ::/0 to relay router(relay router is provided by some orgnization)
> 
> 
>    And  then,...try ping6 to any IPv6 address. following is the result of
>    my own test.
> 
> 
>    Following is my computer's IP config
> 
> 
>    C:\>ipconfig
> 
> 

--------------------------------------------------------------------
IETF IPv6 working group mailing list
[email-masked]
Administrative Requests: https://www1.ietf.org/mailman/listinfo/ipv6
--------------------------------------------------------------------

---

From: "JORDI PALET MARTINEZ" <[email-masked]>
Date: Wed, 22 Oct 2003 23:57:10 +0800

In fact, it will be very good if you can tell me (private email to avoid brands/models here) what router or NAT box are you using,
so I can include it in my survey.

Same for other people that has used this ;-)

Regards,
Jordi

PS: By the way, yes, you can use any of the computers after the NAT as the IPv6 router. I'm doing it right now, in my hotel room,
and I see some other people using my IPv6 prefix, for free, being my laptop the router ! You can read the last draft (-02 waiting in
the editors queue) and also this document
http://www.euro6ix.org/documentation/euro6ix_co_upm-consulintel_wp4_ipv6_tunnels_nat_v1_6.pdf.

----- Original Message ----- 
From: "Tim Chown" <[email-masked]>
To: <[email-masked]>
Sent: Wednesday, October 22, 2003 6:28 PM
Subject: Re: A host who has private IPv4 address can communicate with IPv6 host globaly by 6to4 tunnel

> >    as you know 192.168.1.60 is private address !!

**********************************
Madrid 2003 Global IPv6 Summit
Presentations and videos on line at:
http://www.ipv6-es.com

This electronic message contains information which may be privileged or confidential. The information is intended to be for the use of the individual(s) named above. If you are not the intended recipient be aware that any disclosure, copying, distribution or use of the contents of this information, including attached files, is prohibited.

---

From: Tim Chown <[email-masked]>
Date: Wed, 22 Oct 2003 16:59:48 +0100

The same also goes for tunnel brokers and other mechanisms using the
proto41 forwarding.   But this is a v6ops thing not ipv6 wg.

tim

---

From: Juan Rodriguez Hervella <[email-masked]>
Date: Thu, 23 Oct 2003 19:07:11 +0200

Just to finish this thread, one more comment :)

I think it should be much better
if you upgrade your NAT to support the 6to4 mechanism,
or even better, get rid of the NAT and ask for IPv6 native
connectivity, try it, IPv6 will give you more addresses, sure :)

Cheers.

On Wednesday 22 October 2003 17:59, Tim Chown wrote:
> > In fact, it will be very good if you can tell me (private email to avoid
> > brands/models here) what router or NAT box are you using, so I can
> > include it in my survey.
> >
> > PS: By the way, yes, you can use any of the computers after the NAT as
> > the IPv6 router. I'm doing it right now, in my hotel room, and I see some
> > other people using my IPv6 prefix, for free, being my laptop the router !
> > You can read the last draft (-02 waiting in the editors queue) and also
> > this document
> > > The problem is that this only works for one host within the NAT
> > > network, so if the NAT encompasses many sites, you're stuck.
> > >
> > > Cheers,
> > > Tim
> > >
> > > >    Generally,  we think a host who has private IPv4 address(because
> > > > it is behind  NAT  device)  can  not  communicate with IPv6 host
> > > > globally by tunneling(6to4,  config  tunnel  ..)  But  there  is  a
> > > > way using 6to4 tunnel.
> > > >
> > > >    When  we config 6to4 config on a host(for example windows2000
> > > > station) we  assign  the host's IPv4 address to the host's 6to4
> > > > address(next to 2002:).  And  we  know  the  host's  IPv4 address
> > > > shoud be public IPv4 address.
> > > >
> > > >    But,  if  we  use  the  public  IPv4  address which is on NAT
> > > > device's external  interface  to  make  the  host's  6to4 address,
> > > > the host can communicate  with  IPv6  host  globally  using  6to4 
> > > > tunnel and relay router. Following are do list.
> > > >
> > > >    1.       Map the NAT device's public address(select one) to the
> > > > host's private address(configure on the NAT)
> > > >
> > > >    2.        On  the  NAT  device,  make  a policy which permit
> > > > incomming traffic which has protocol number 41 to the host's private
> > > > address
> > > >
> > > >    3.        Change  the  NAT  device's  public  IPv4  address(which 
> > > > you selected) to hex. format.
> > > >
> > > >    And  then,...try ping6 to any IPv6 address. following is the
> > > > result of my own test.
> > > >
> > > >
> > > >    Pinging 6to4.ipv6.fh-regensburg.de [2002:c25f:6cbf:1::1] with 32
> > > > bytes of data:
> > > >
> > > >
> > > >    Pinging  orange.kame.net  [2001:200:0:8002:203:47ff:fea5:3085]
> > > > with 32 bytes of data:
> > > >
> > > >
> > This electronic message contains information which may be privileged or
> > confidential. The information is intended to be for the use of the
> > individual(s) named above. If you are not the intended recipient be aware
> > that any disclosure, copying, distribution or use of the contents of this
> > information, including attached files, is prohibited.
> >
> >
> >

-- 
JFRH

---

From: "JORDI PALET MARTINEZ" <[email-masked]>
Date: Fri, 24 Oct 2003 01:27:22 +0800

Yes, but we know very well that most of the (cheap) router/NAT manufacturers will not implement 6to4 or any other IPv6 code until
there is market to make business, so meanwhile we need to take advantages of any possible solutions.

Regards,
Jordi

---

From: Fred Templin <[email-masked]>
Date: Thu, 23 Oct 2003 17:38:41 -0700

The same would work also for ISATAP (see: isatap.com), except
that ISATAP can use any IPv6 prefix, i.e., not just 2002::/16.
(Besides; 2002 was *last* year...)

Fred
[email-masked]

---

From: "Jeroen Massar" <[email-masked]>
Date: Fri, 24 Oct 2003 02:39:29 +0200

-----BEGIN PGP SIGNED MESSAGE-----

> (Besides; 2002 was *last* year...)

They are talking about 6to4 (proto-41 :) which can use both
prefixes from 2001::/16 (the year before that) and 3ffe::/16
(thats a long time from now :) and basically anything one invents ofcourse ;)

Personally I have to admit that I never used isatap... I should
look into it some time.

Greets,
 Jeroen