Jim's Depository

Let’s say you have a Debian Squeeze based gateway machine and your ISP wasn’t reading ahead far enough in the RFCs to get to the IPv6 chapter.

Don’t let that hold you back, you can go to IPV6 without your ISP.

What we are going to do is use a little thing called 6to4 to make your only little bubble of the IPv6 internet and stitch it to the rest of IPv6 land with your existing IPv4 connection.

1. Find out the 6to4 tunneled IPV6 address for your IPv4 address: I use 6to4 address calculator
2. You are going to get a /48 subnet, that is, you will have the equivalent of 65536 entire IPv4 internets to allocate inside your machine. I generally use the one with all zeroes and a single one at the end as the address of my 6to4 gateway, so my IPv6 address ends up looking like: 2002:dead:beef::1. Notice that ‘::‘? That is IPv6 for “all the 16 bit blocks between here are zero”.
3. Edit your /etc/network/interfaces file to add this interface:
   ~~~~~~~~ iface tun6to4 inet6 v4tunnel address 2002:YOUR-IPV6-ADDRESS-GOES-HERE!!!!!! netmask 16 remote 192.88.99.1 # anycast gateway endpoint any local YOUR-IPv4-ADDRESS-GOES-HERE!!!!! tty 255 up ip -6 route add 2000::/3 via ::192.88.99.1 dev tun6to4 down ip -6 route flush dev tun6to4 ~~~~~~~~
4. Turn on your interface: ifup tun6to4
5. Ping google’s machine: ping6 ipv6.google.com
6. Go back and add the auto tun6to4 to your /etc/network/interfaces

Well that was easy. If you are a single machine you could be done.

But let’s say you are a gateway and you want to provide access to all of the machines behind you…

1. Pick a subnet number. I’m going to use 1101 in this example, because it is the one I’m using. Any 4 digit hex number will suffice.
2. Edit your /etc/network/interfaces again to add the subnet to your internal ethernet device:
   ~~~~~~~~ iface eth1 inet6 static address YOUR-FIRST-THREE-PARTS:1101::1 # 1101 is 17.1, it cohabits my 172.17.1.* net mask 64 ~~~~~~~~
3. Bounce your internal interface to bring it up. (You could also skip the ifdown and use the force flag on ifup if you didn’t want to risk chopping your legs off if something goes wrong.)   ~~~~~~~~ ifdown eth0 ; ifup eth0 ~~~~~~~~
4. Note: I have a problem here. It doesn’t add the route for that network, so I have to ip route add YOUR-FIRST-THREE-PARTS:1101::/64 dev eth0 I have no idea why. If you see  Dead loop on virtual device tun6to4, fix it urgently! in your syslog, you forgot this step.

That was also easy. Now you need to advertise the IPv6 network so clients can use it.

1. aptitude install radvd  (route advertiser. It won’t start without a config)
2. Turn on IPv6 forwarding, edit /etc/sysctl.conf and uncomment the line that says
   net.ipv6.conf.all.forwarding=1 Then echo 1 > /proc/sys/net/ipv6/conf/all/forwarding to make it happen without a reboot.

3. Create your /etc/radvd.conf file, something like this should work…
   ~~~~~~~~ interface eth1 <<<<<< make that your network device { AdvSendAdvert on;

   prefix YOUR-FIRST-THREE-PARTS:1101::/64 { AdvOnLink on; AdvAutonomous on; AdvRouterAddr on; }; }; ~~~~~~~~

4. Restart radvd: /etc/init.d/radvd restart

Now THINK! You just blew open your firewall and are allowing access to all of your internal machines over IPv6! Time to look at ip6tables. Yes, you have to do all those rules again. You might do something basic like this to prevent anyone from coming in, except to your defined ports, and allow yourself to go out as you wish…

#
# IPv6 rules 
/sbin/ip6tables -F # flush all 
/sbin/ip6tables -X # delete all 
/sbin/ip6tables -t mangle -F 
/sbin/ip6tables -t mangle -X

# open loopback wide 
/sbin/ip6tables -A INPUT -i lo -j ACCEPT
/sbin/ip6tables -A OUTPUT -o lo -j ACCEPT

# drop everything inbound by default 
/sbin/ip6tables -P INPUT DROP
/sbin/ip6tables -P FORWARD DROP 
/sbin/ip6tables -P OUTPUT ACCEPT

# forwarding basis: outgoing is fine, incoming is not 
/sbin/ip6tables -A FORWARD -i tun6to4 -m state --state ESTABLISHED,RELATED -j ACCEPT # allow established 
/sbin/ip6tables -A FORWARD -o tun6to4 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT # allow outgoing 
/sbin/ip6tables -A FORWARD -i eth0 -o eth0 -j ACCEPT # we can talk amongst ourselves 
# I don't like the preceding rule, it combinatorially explodes with more
than 1 interface

# by default, allow my own outgoing but no incoming 
/sbin/ip6tables -A INPUT -i tun6to4 -m state --state ESTABLISHED,RELATED -j ACCEPT # no new incoming

# allow ICMP 
/sbin/ip6tables -A INPUT -p ipv6-icmp -j ACCEPT

# open my ports 
/sbin/ip6tables -A INPUT -i tun6to4 -p tcp --destination-port 80 -j ACCEPT /sbin/ip6tables -A INPUT -i tun6to4 -p tcp --destination-port 22 -j ACCEPT

# see the failures 
/sbin/ip6tables -A FORWARD -m limit --limit 15/minute -j LOG --log-level info /sbin/ip6tables -A INPUT -m limit --limit 15/minute -j LOG --log-level info

Most of your machines with IPv6 enabled will just work at this point. You may wish to give some of them static addresses so you can get to them from outside (after added a firewall rule of course). The IETF took mercy on us poor old IPv4 folk and made a syntax for using IPv4 dotted quads in IPv6 addresses so you don’t have to invent all new numbers. Like this…

iface eth0 inet static

address 172.17.1.214

...
iface eth0 inet6 static 
   address 2002:63b2:9d39:1101::172.17.1.214 <<<< see me using my IPv4 for sanity netmask 64

… that will make the IPv6 address 2002:63b2:9d39:1101::ac11:1d6

That about does it. Someday you will get real IPv6 addresses from your ISP and need to renumber everything to add those addresses in parallel with your 6to4 addresses.