From db4e555129a0c6143023b919783d2a6573d170bc Mon Sep 17 00:00:00 2001 From: sven-ola Date: Wed, 6 Oct 2010 07:20:24 +0000 Subject: doc git-svn-id: https://map66.svn.sourceforge.net/svnroot/map66@3 3484d885-4da6-438d-b19d-107d078dd756 --- README.dbk | 170 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 170 insertions(+) create mode 100644 README.dbk (limited to 'README.dbk') diff --git a/README.dbk b/README.dbk new file mode 100644 index 0000000..2a50e00 --- /dev/null +++ b/README.dbk @@ -0,0 +1,170 @@ + + +
+ + MAP66 (NAT from IPv6 to IPv6, NAT66) for Linux + + + Sven-Ola + + Tücke + + + Freifunk + + + + 06-OCT-2010 + + + These files implement a Linux netfilter target to change the IPv6 + address of packets. The address change is done checksum neutral, thus no + checksum re-calculation for the IPv6 packet is necessary. You can change the + IPv6 source address of outgoing packets as well as the IPv6 destination + address of incoming packets. This allows you to map an internal IPv6 address + range to a second, externally used IPv6 address range. IPv6 address mapping + is not very similar to IPv4 network address translation, but one can + describe it as some sort of stateless NAT. The implmementation is based on + the expired the IETF discussion paper published here: + + http://tools.ietf.org/html/draft-mrw-behave-nat66-02 + +
+ Installation + + MAP66 implements two pieces of software: a shared library that + extends the ip6tables command and a Linux kernel module. The shared + library file adds the '-j MAP66' target to the ip6tables command. To build + and install, you need ip6tables installed as well as the necessary + headers. The Linux kernel module requires the Linux source file tree and + Linux configuration files to compile. On a Debian/(EKU)buntu, the + following command prepares the build environment: + + sudo apt-get install build-essential linux-headers iptables-dev + + Unpack the source tgz archive, change to the directory and issue + "make" to build. If this compiles without errors, install the ip6tables + extension with the following command: + + sudo make install + + + The kernel module (ip6t_MAP66.ko for + Linux-2.6 or ip6t_MAP66.o for Linux-2.4) is not + automatically installed nor loaded into the kernel. You can copy the + kernel module file manually, e.g. with sudo cp ip6t_MAP66.ko + /lib/modules/$(uname -r)/. + +
+ +
+ DKMS integration + + If the next system update needs to install a new kernel version, you + also need to re-compile/re-install the MAP66 kernel module. With + Debian/(EKU)buntu, this can be automated with the Dynamic Kernel Module + Support Framework (DKMS). For this, the dkms.conf file is included with + the MAP66 source file package. Install DKMS with the following + command: + + sudo apt-get install dkms + + Move/unpack the MAP66 source files below /usr/src and adapt the + directory name to the version mentioned in the dkms.conf file. For + example, issue "mkdir /usr/src/ip6t_MAP66-0.3" and "cp * + /usr/src/ip6t_MAP66-0.3/". To register the MAP66 source to DKMS and + compile/install, issue these commands: + + sudo dkms add -m ip6t_MAP66 -v 0.3 +sudo dkms build -m ip6t_MAP66 -v 0.3 +sudo dkms install -m ip6t_MAP66 -v 0.3 + + Read DKMS details here: https://wiki.kubuntu.org/Kernel/Dev/DKMSPackaging +
+ +
+ Configuration + + Note for me: svn propedit svn:ignore. + + Note: on ubuntu, you need to enable prefer-family in /etc/wgetrc. + after this e.g. "wget -O /dev/null http://ftp.se.debian.org" should + connect to the IPv6 addrs of that server. + + /etc/gai.conf + + for wget --prefer-family=IPv6 -O - http://6to4.nro.net/ one needs + ip6tables -t mangle -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS + --clamp-mss-to-pmtu + + Mention --nocheck for speedup (if you do not expect the outer iface + in the mapping range) + + Fieses zeugs: ein sixxs und ein 6to4. Kommt rein via sixxs, geht + raus ueber 6to4 wenn ping von einem anderen 6to4-rechner (route hat + 2002::/16)! Ping geht, ssh aber nicht == boinks kann evnt. mit TOS + markiert werden und mit einer policyroute aussortiert. Brrr. + + Idea to think about: --salt 3b5b91c5a2 XOR client addresses for some + more privacy +
+ +
+ Motivation + + My internet access at home is realized by a wireless community mesh + network not owned by me. The mesh is operated with small embedded devices + (nodes aka. WLAN routers) that are interconnected via radio links (WLAN + IBSS / AdHoc). Routing is done with a specialized protocol such as Batman + or OLSR. The routing protocol selects the nearest out of a dozen Internet + gateways and configures a default route or an ipip tunnel accordingly. + Each Internet gateway is connected to a different ISP and provides the + service with the help of IPv4 network address translation (NAT). Using NAT + has the following effects: + + + + Address amplification - something not necessary with IPv6 any + more + + + + Anonymization - nice to have as an option but not mission + critical + + + + ISP independance - no reverse routing, no + "buy-a-number-range" + + + + The last point _is_ mission critical. One can use a provider + independant IPv6 address range, but you need the cooperation of an ISP to + use that address range for Internet connectivity. If you e.g. move to + another ISP you need that address range to be re-routed to your new + location. + + ISP independance is also possible with some tunneling technique, + such as VPN or mobile IP. Tunneling can be implemented on client PCs and + Internet gateways/servers one day. But there is no need to implement the + same tunneling technique on every mesh node. Why? Because the mesh nodes + can use private IP adresses (or "ULA") to transport the tunnel data + between the client PC and the gateway/server. Each tunneling technique + typically needs a single instance (the "server") which forms a single + point of failure. Rule-of-thumb1: avoid a SPOF for the infrastructure. + Rule-of-thumb2: KISS. + + Using private IP addresses on the mesh nodes has a drawback: mesh + node software updates e.g. via http downloads from an Internet server is + not possible. This is where I start to think: "hey, some kind of address + mapping may be nice to have". While opening pandoras NAT66 box, I + discovered that IPv6 nerds do not like the acronym. It is always a good + tactic in infowars to rename, hence the name "MAP66". + + // Sven-Ola +
+
-- cgit v1.2.3