diff options
Diffstat (limited to 'README.html')
| -rw-r--r-- | README.html | 78 |
1 files changed, 21 insertions, 57 deletions
diff --git a/README.html b/README.html index a46d22f..7a0674c 100644 --- a/README.html +++ b/README.html @@ -1,14 +1,14 @@ <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> -<html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><title>NPTv6 (IPv6-to-IPv6 Network Prefix Translation) for Linux</title><meta name="generator" content="DocBook XSL Stylesheets V1.76.1" /></head><body><div class="article" title="NPTv6 (IPv6-to-IPv6 Network Prefix Translation) for Linux"><div class="titlepage"><div><div><h2 class="title"><a id="id363330"></a>NPTv6 (IPv6-to-IPv6 Network Prefix Translation) for Linux</h2></div><div><div class="author"><h3 class="author"><span class="firstname">Sven-Ola</span> <span class="surname">Tuecke</span></h3><div class="affiliation"><span class="orgname">Freifunk<br /></span></div></div></div><div><div class="author"><h3 class="author"><span class="firstname">Matthias</span> <span class="surname">Schiffer</span></h3><div class="affiliation"><span class="orgname">Freifunk Lübeck<br /></span></div></div></div><div><p class="pubdate">10-NOV-2011</p></div></div><hr /></div><div class="toc"><p><strong>Table of Contents</strong></p><dl><dt><span class="section"><a href="#install">Installation</a></span></dt><dt><span class="section"><a href="#dkms">DKMS Integration</a></span></dt><dt><span class="section"><a href="#config">Configuration</a></span></dt><dd><dl><dt><span class="section"><a href="#config-brief">Brief Version</a></span></dt><dt><span class="section"><a href="#config-nat-behaviour">NAT Behavioral Requirements</a></span></dt></dl></dd><dt><span class="section"><a href="#precedence">IPv6/IPv4 Precedence</a></span></dt><dd><dl><dt><span class="section"><a href="#precedence-gai">Change gai.conf</a></span></dt><dt><span class="section"><a href="#precedence-addrs">Use Changed Internal Address</a></span></dt></dl></dd><dt><span class="section"><a href="#motivation">Motivation</a></span></dt></dl></div><p>These files implement a Linux netfilter target that changes the IPv6 +<html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><title>NPTv6 (IPv6-to-IPv6 Network Prefix Translation) for Linux</title><meta name="generator" content="DocBook XSL Stylesheets V1.76.1" /></head><body><div class="article" title="NPTv6 (IPv6-to-IPv6 Network Prefix Translation) for Linux"><div class="titlepage"><div><div><h2 class="title"><a id="id463568"></a>NPTv6 (IPv6-to-IPv6 Network Prefix Translation) for Linux</h2></div><div><div class="author"><h3 class="author"><span class="firstname">Sven-Ola</span> <span class="surname">Tuecke</span></h3><div class="affiliation"><span class="orgname">Freifunk<br /></span></div></div></div><div><div class="author"><h3 class="author"><span class="firstname">Matthias</span> <span class="surname">Schiffer</span></h3><div class="affiliation"><span class="orgname">Freifunk Lübeck<br /></span></div></div></div><div><p class="pubdate">10-NOV-2011</p></div></div><hr /></div><div class="toc"><p><strong>Table of Contents</strong></p><dl><dt><span class="section"><a href="#install">Installation</a></span></dt><dt><span class="section"><a href="#dkms">DKMS Integration</a></span></dt><dt><span class="section"><a href="#config">Configuration</a></span></dt><dd><dl><dt><span class="section"><a href="#config-brief">Brief Version</a></span></dt><dt><span class="section"><a href="#config-nat-behaviour">NAT Behavioral Requirements</a></span></dt></dl></dd><dt><span class="section"><a href="#precedence">IPv6/IPv4 Precedence</a></span></dt><dd><dl><dt><span class="section"><a href="#precedence-gai">Change gai.conf</a></span></dt></dl></dd></dl></div><p>These files implement a Linux netfilter target that changes the IPv6 address of packets. The address change is done checksum neutral, thus no checksum re-calculation for the packet is necessary. You can change the IPv6 source address of outgoing packets as well as the IPv6 destination address of incoming packets. This allows you to map an internal IPv6 address range to a second, externally used IPv6 address range. IPv6 address mapping is not very similar to IPv4 network address translation, but one can describe it as - some sort of stateless NAT. The implementation is based on the expired IETF - discussion paper published here:</p><p><a class="ulink" href="https://tools.ietf.org/html/rfc6296" target="_top">https://tools.ietf.org/html/rfc6296</a></p><div class="warning" title="Warning" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Warning</h3><p>Using NPTv6 rules together with connection tracking rules such as + some sort of stateless NAT. The implementation is based on RFC 6296 published + here:</p><p><a class="ulink" href="https://tools.ietf.org/html/rfc6296" target="_top">https://tools.ietf.org/html/rfc6296</a></p><div class="warning" title="Warning" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Warning</h3><p>Using NPTv6 rules together with connection tracking rules such as <strong class="userinput"><code>--ctstate</code></strong> is currently untested and may not work or may cause dysfunctions.</p></div><div class="section" title="Installation"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="install"></a>Installation</h2></div></div></div><p>NPTv6 implements two pieces of software: a shared library that extends the ip6tables command and a Linux kernel module. The shared @@ -16,40 +16,41 @@ and the '-j DNPTV6' target (for destination address translation) to the ip6tables command. To build and install, you need ip6tables installed as well as the necessary headers. The Linux kernel module requires the Linux + source file tree and kernel configuration files to compile. On a Debian/(EKU)buntu, the following command prepares the build environment:</p><pre class="programlisting">sudo apt-get install build-essential linux-headers iptables-dev</pre><p>Unpack the source tgz archive below <code class="filename">/usr/src</code>, change to the new sub-directory and issue "make" to build. If this compiles without errors, install the ip6tabless extension by copying libip6t_SNPTV6.so and libip6t_DNPTV6.so to the iptables module directory, which is probably located under <code class="filename">/lib/xtables</code> or - <code class="filename">/usr/lib/iptables</code>.</p><div class="note" title="Note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>The kernel module (<code class="filename">ip6t_MAP66.ko</code> is not - automatically installed nor loaded into the kernel. You can copy the - kernel module file manually, e.g. with <strong class="userinput"><code>sudo cp ip6t_MAP66.ko - /lib/modules/$(uname -r)/</code></strong>.</p></div></div><div class="section" title="DKMS Integration"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="dkms"></a>DKMS Integration</h2></div></div></div><p>If the next system update needs to install a new kernel version, you - also need to re-compile/re-install the MAP66 kernel module. With + <code class="filename">/usr/lib/iptables</code>.</p><div class="note" title="Note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>The kernel modules (<code class="filename">ip6t_SNPTV6.ko</code> and + <code class="filename">ip6t_DNPTV6.ko</code>) is not automatically installed nor loaded + into the kernel. You can copy the kernel module file manually, e.g. with + <strong class="userinput"><code>sudo cp ip6t_SNPTV6.ko ip6t_DNPTV6.ko /lib/modules/$(uname -r)/</code></strong>.</p></div></div><div class="section" title="DKMS Integration"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="dkms"></a>DKMS Integration</h2></div></div></div><p>If the next system update needs to install a new kernel version, you + also need to re-compile/re-install the NPTv6 kernel modules. With Debian/(EKU)buntu, this can be automated with the Dynamic Kernel Module Support Framework (DKMS). For this, the <code class="filename">dkms.conf</code> - file is included with the MAP66 source file package. Install DKMS with the - following command:</p><pre class="programlisting">sudo apt-get install dkms</pre><p>If not already in place, move/unpack the MAP66 source file archive - below <code class="filename">/usr/src/</code>. To register the MAP66 source to DKMS + file is included with the NPTv6 source file package. Install DKMS with the + following command:</p><pre class="programlisting">sudo apt-get install dkms</pre><p>If not already in place, move/unpack the NPTv6 source file archive + below <code class="filename">/usr/src/</code>. To register the NPTv6 source to DKMS and compile/install, issue these commands:</p><pre class="programlisting">sudo dkms add -m ip6t_NPTV6 -v 0.6 sudo dkms build -m ip6t_NPTV6 -v 0.6 sudo dkms install -m ip6t_NPTV6 -v 0.6</pre><p>Read DKMS details here: <a class="ulink" href="Read DKMS details here: https://wiki.kubuntu.org/Kernel/Dev/DKMSPackaging" target="_top">https://wiki.kubuntu.org/Kernel/Dev/DKMSPackaging</a></p></div><div class="section" title="Configuration"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="config"></a>Configuration</h2></div></div></div><div class="section" title="Brief Version"><div class="titlepage"><div><div><h3 class="title"><a id="config-brief"></a>Brief Version</h3></div></div></div><p>You always need to add two ip6tables-rules to your netfilter configuration. One rule matches outgoing packets and changes their IPv6 source address. The second rule matches incoming packets and reverts the address change by altering their IPv6 destination address. To following - commands correspond to the <span class="quote">“<span class="quote">Address Mapping Example</span>”</span> given - in the IETF discussion paper:</p><pre class="programlisting">ip6tables -t mangle -A PREROUTING -i eth0 -d 2001:0DB8:0001::/48 -j DNPTV6 --to-destination FD01:0203:0405::/48 + commands correspond to the <span class="quote">“<span class="quote">/48 Prefix Mapping Example</span>”</span> given + in RFC6296:</p><pre class="programlisting">ip6tables -t mangle -A PREROUTING -i eth0 -d 2001:0DB8:0001::/48 -j DNPTV6 --to-destination FD01:0203:0405::/48 ip6tables -t mangle -A POSTROUTING -o eth0 -s FD01:0203:0405::/48 -j SNPTV6 --to-source 2001:0DB8:0001::/48</pre><p>This example is also printed to the screen if you issue <strong class="userinput"><code>ip6tables -j SNPTV6 --help</code></strong>. By design, you cannot use prefix lengths longer than 64.</p></div><div class="section" title="NAT Behavioral Requirements"><div class="titlepage"><div><div><h3 class="title"><a id="config-nat-behaviour"></a>NAT Behavioral Requirements</h3></div></div></div><p>RFC 6296 states that NPTv6 translators must support hairpinning behaviour. This means that when an NPTv6 Translator receives a datagram on the internal interface that has a destination address that matches the site's external prefix, it will translate the datagram and forward it - internally. While it is possible that the translator works correctly - without this depending on the network configuration, it is desiarable - to have hairpinning behaviour. The following iptables rules will enable - this:</p><pre class="programlisting">ip6tables -t mangle -A PREROUTING -d 2001:0DB8:0001::/48 -j MARK --set-mark 42 + internally. While it is possible that the network works correctly + without this depending on the configuration of the external router, it + is desirable to have hairpinning behaviour. The following iptables rules + will enable this:</p><pre class="programlisting">ip6tables -t mangle -A PREROUTING -d 2001:0DB8:0001::/48 -j MARK --set-mark 42 ip6tables -t mangle -A PREROUTING -d 2001:0DB8:0001::/48 -j DNPTV6 --to-destination FD01:0203:0405::/48 ip6tables -t mangle -A POSTROUTING -m mark --mark 42 -s FD01:0203:0405::/48 -j SNPTV6 --to-source 2001:0DB8:0001::/48 ip6tables -t mangle -A POSTROUTING -o eth0 -s FD01:0203:0405::/48 -j SNPTV6 --to-source 2001:0DB8:0001::/48</pre></div></div><div class="section" title="IPv6/IPv4 Precedence"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="precedence"></a>IPv6/IPv4 Precedence</h2></div></div></div><p>With (EKU)buntu and eventually with RedHat, you will notice that @@ -62,55 +63,18 @@ ip6tables -t mangle -A POSTROUTING -o eth0 -s FD01:0203:0405::/48 -j SNPTV6 --to address higher than the ULA IPv6 address when choosing the transport protocol for a new Internet connection if this add on to the RFC 3484 rules is compiled in. For this reason, you may want to change the - precedence rules within <code class="filename">/etc/gai.conf</code> (see <a class="xref" href="#precedence-gai" title="Change gai.conf">Change gai.conf</a>) or use another - prefix (see <a class="xref" href="#precedence-addrs" title="Use Changed Internal Address">Use Changed Internal Address</a>).</p><div class="section" title="Change gai.conf"><div class="titlepage"><div><div><h3 class="title"><a id="precedence-gai"></a>Change gai.conf</h3></div></div></div><p>The getaddrinfo() library function manages lists of label, + precedence rules within <code class="filename">/etc/gai.conf</code> (see <a class="xref" href="#precedence-gai" title="Change gai.conf">Change gai.conf</a>).</p><div class="section" title="Change gai.conf"><div class="titlepage"><div><div><h3 class="title"><a id="precedence-gai"></a>Change gai.conf</h3></div></div></div><p>The getaddrinfo() library function manages lists of label, precedence, and scope4 type entries. If the <code class="filename">/etc/gai.conf</code> file does not provide a single entry for a particular type, the compiled-in list is used. For this reason, you cannot uncomment a single entry to overwrite the default. You need to uncomment all entries of a particular type for this. The <span class="quote">“<span class="quote">label</span>”</span> lines compare source addresses, the - <span class="quote">“<span class="quote">precedence</span>”</span> lines compare destination addresses.</p><div class="procedure" title="Procedure 1. Change IPv6 Precedence"><a id="id398835"></a><p class="title"><strong>Procedure 1. Change IPv6 Precedence</strong></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p>Open the <code class="filename">/etc/gai.conf</code> file as root user, + <span class="quote">“<span class="quote">precedence</span>”</span> lines compare destination addresses.</p><div class="procedure" title="Procedure 1. Change IPv6 Precedence"><a id="id499064"></a><p class="title"><strong>Procedure 1. Change IPv6 Precedence</strong></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p>Open the <code class="filename">/etc/gai.conf</code> file as root user, e.g. by executing <strong class="userinput"><code>sudo nano /etc/gai.conf</code></strong>.</p></li><li class="step" title="Step 2"><p>Remove the leading hash character from the 8 lines starting with <span class="quote">“<span class="quote">#label</span>”</span>.</p></li><li class="step" title="Step 3"><p>Re-add the hash character to the line stating <span class="quote">“<span class="quote">#label fc00::/7 6</span>”</span>.</p></li><li class="step" title="Step 4"><p>Save the file.</p></li><li class="step" title="Step 5"><p>Restart your browser and re-try to browse to a multi-homed web site.</p></li></ol></div><p>The above procedure removes the difference between standard IPv6 source addresses and ULA type private IPv6 source addresses. Anything - else is unchanged.</p></div><div class="section" title="Use Changed Internal Address"><div class="titlepage"><div><div><h3 class="title"><a id="precedence-addrs"></a>Use Changed Internal Address</h3></div></div></div><p>As an alternative solution, you may use an arbitrary address - prefix in your LAN that is not mentioned in the - <code class="filename">gai.conf</code> file nor compiled in. This will work but - introduces a double mapping: one map (Inet-ULA) on the Internet gateway - router and a second map (ULA-Intern) on the internal router. </p><div class="note" title="Note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>While the well known IPv4 addresses 10.0.0.0/8, 172.16.0.0/12, - and 192.168.0.0/16 still exist, it is unlikely that their 6to4 - counterparts 2002:0a00::/24, 2002:ac10::/28, and 2002:c0a8::/32 will - be routed on the Internet. Sadly, the (EKU)buntu defaults penalize - 6to4 addresses also.</p></div></div></div><div class="section" title="Motivation"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="motivation"></a>Motivation</h2></div></div></div><p>My Internet access at home is realized by a wireless community mesh - network not owned by me. The mesh is operated with small embedded devices - (nodes aka. WLAN routers) that are interconnected via radio links (WLAN - IBSS / AdHoc). Routing is done with a specialized protocol such as Batman - or OLSR. The routing protocol selects the nearest out of a dozen Internet - gateways and configures a default route or an IPIP tunnel accordingly. - Each Internet gateway is connected to a different ISP and provides the - service with the help of IPv4 network address translation (NAT). Using NAT - has the following effects:</p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p>Address amplification - something not necessary with IPv6 any - more</p></li><li class="listitem"><p>Anonymization - nice to have as an option but not mission - critical</p></li><li class="listitem"><p>ISP independence - no reverse routing, no - "buy-a-number-range"</p></li></ul></div><p>The last point <span class="bold"><strong>is</strong></span> mission critical. - One can obtain a provider independent IPv6 address range, but you need the - cooperation of an ISP to use that address range for Internet connectivity. - If you e.g. move to another ISP you need your address range to be - re-routed to your new location.</p><p>ISP independence is also possible with some tunneling technique, - such as VPN or mobile IP. Tunneling can be implemented on client PCs and - Internet gateways/servers one day. But there is no need to implement the - same tunneling technique on every mesh node. Why? Because the mesh nodes - can use private IP addresses (or "ULA") to transport the tunnel data - between the client PC and the gateway/server. Each tunneling technique - typically needs a single instance (the "server") which forms a single - point of failure. Rule-of-thumb1: avoid a SPOF for the infrastructure. - Rule-of-thumb2: KISS (keep it simple stupid).</p><p>Using private IP addresses on the mesh nodes has a drawback: mesh - node software updates e.g. a download via HTTP from an Internet server is - not possible. This is where I start to think: <span class="quote">“<span class="quote">hey, some kind of - address mapping may be nice to have</span>”</span>. While opening Pandora's NAT66 - box, I discovered that IPv6 nerds do not like the acronym. It is always a - good tactic in info wars to rename, hence the name "MAP66".</p><p>// Sven-Ola</p></div></div></body></html> + else is unchanged.</p></div></div></div></body></html> |