IPv6 Tunneling Mechanisms

What it is

A tunnel carries IPv6 packets across a network that does not support IPv6, by wrapping them in IPv4 packets.

Suppose two IPv6 sites are connected only by an IPv4 network. A router at each site puts the IPv6 packet inside an IPv4 packet and sends it across. The router at the far end removes the wrapper and forwards the IPv6 packet.

This is called encapsulation. The IPv4 network never looks inside, so it does not need any IPv6 support.

How it works

Tunnel mechanisms differ in how the endpoints are found and how addresses are built.

6in4, the manual tunnel

6in4 is a fixed tunnel between two configured endpoints. The IPv6 packet is placed directly inside an IPv4 packet, and the IPv4 header uses protocol number 41.

You must know the IPv4 address of both endpoints in advance, so this is a point to point tunnel. It is predictable and easy to troubleshoot. It is the type most tunnel providers use.

The IPv4 header adds 20 bytes. The tunnel MTU is lower than the MTU of the link under it, which links back to the Path MTU Discovery topic.

6to4, the automatic tunnel

6to4 builds the IPv6 prefix from a public IPv4 address, so no per tunnel setup is needed. The prefix is 2002::/16 followed by the 32 bit IPv4 address. That gives a /48 prefix to the site.

For example, the IPv4 address 192.0.2.1 is c000:0201 in hex. The site prefix is 2002:c000:201::/48.

Traffic to a destination outside 2002::/16 goes to a relay router, which connects 6to4 sites to the native IPv6 network. 6to4 needs a public IPv4 address, so it fails behind NAT. It also depends on relays outside your control, so it is no longer recommended.

Tunnel brokers

A tunnel broker is a service that gives you a 6in4 tunnel and a routed IPv6 prefix. You sign up, and the broker provides the endpoint addresses and the prefix.

This suits a site whose ISP does not offer IPv6. The broker's server forwards your IPv6 traffic to the Internet. The tunnel carries all your traffic, so its location affects delay.

Teredo and ISATAP

These two are mainly host level tunnels:

• Teredo: wraps IPv6 in UDP, so it passes through NAT. It uses the 2001::/32 prefix.
• ISATAP: treats an IPv4 network as an IPv6 link, and builds the interface ID from the IPv4 address. It suits a site that runs IPv4 internally.

Both are transition tools, and neither is a good choice for new designs. For the exam, know what each one does and that Teredo works through NAT.

6rd, the provider version of 6to4

6rd (IPv6 rapid deployment) works like 6to4, but the prefix belongs to the ISP and not to the fixed 2002::/16 block. The customer router (CE) builds its prefix from the ISP's own IPv6 prefix plus all or part of its IPv4 address. Traffic leaves through a border relay run by the ISP, and the packets still travel in IPv4 protocol 41.

For example, the ISP prefix 2001:db8::/32 and the address 192.0.2.1 (c000:0201) give the customer prefix 2001:db8:c000:201::/64.

DS-Lite, IPv4 over an IPv6 only network

DS-Lite (Dual-Stack Lite) goes the other way: the ISP access network carries only IPv6, and IPv4 packets travel inside IPv6. The customer router, called the B4, builds an IPv4 in IPv6 tunnel to the ISP's AFTR (address family transition router). The AFTR removes the wrapper and applies carrier grade NAT44, which translates the private IPv4 addresses of many customers to shared public ones.

On RouterOS the CPE side is an /interface ipipv6 tunnel whose remote address is the AFTR, with an IPv4 default route into it.

/interface ipipv6 add name=dslite1 local-address=2001:db8:a::2 remote-address=2001:db8:b::1
/ip route add dst-address=0.0.0.0/0 gateway=dslite1

Comparing the mechanisms

Tunnelling versus translation

A tunnel carries IPv6 packets unchanged. A translation mechanism changes IPv6 packets into IPv4 packets, and back. Translation lets an IPv6 only host talk to an IPv4 only server.

NAT64 and DNS64 are translation tools, and they are different from tunnels. Do not confuse them with the mechanisms above.

Tunnels on RouterOS

RouterOS has a 6to4 interface type, found in the /interface 6to4 menu. Despite its name, it carries a point to point IPv6 over IPv4 tunnel, which is how a broker tunnel is built. The interoperability chapter shows the configuration.

/interface 6to4 print

IPv4 tunnels such as GRE and IPIP can also carry IPv6 traffic as the payload, because a tunnel interface is a link that holds an IPv6 address like any other.