Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Enabling IPv6 support for IPv4 only apps on Linux

pavel.network

Post reply on HN
Print view View original

31–40 of 45 posts

Re: Enabling IPv6 support for IPv4 only apps on Linux

#31

Post by pavel_odintsov »

csdvrx wrote: post #7

Using LD_PRELOAD for IPv4 seems to me like using the wrong tool for the job. > "Most of the apps I use support IPv6 but there are some cases when lack of IPv4 connectivity on my machine negatively affects experience." Just install clatd to get 464XLAT so hardcoded ipv4 get routed to 192.0.0.1 (the clat iface is the default gw for ipv4) which does NAT64 through tayga too. IMHO the best strategy is a mix of strategies:…

The main idea of my experiment was to run IPv6 only setup without any IPv4 connectivity: sudo ip route get 8.8.8.8 RTNETLINK answers: Network is unreachable

So I intentionally decided not to have IPv4 connectivity system wide to catch apps with issues in IPv6 only environment and then carefully evaluate issues and report them to authors: https://github.com/mozilla-mobile/mozilla-vpn-client/issues/... https://github.com/signalapp/Signal-Desktop/issues/4121

Dual stack setups tend to hide IPv6 implementation issues and may create illusion that app is IPv6 compatible but in reality it's not.

Clearly my setup is too hostile for home users but as developer I enjoy it a lot.

Re: Enabling IPv6 support for IPv4 only apps on Linux

#32

Post by csdvrx »

pavel_odintsov wrote: post #31
csdvrx wrote: post #7

Using LD_PRELOAD for IPv4 seems to me like using the wrong tool for the job. > "Most of the apps I use support IPv6 but there are some cases when lack of IPv4 connectivity on my machine negatively affects experience." Just install clatd to get 464XLAT so hardcoded ipv4 get routed to 192.0.0.1 (the clat iface is the default gw for ipv4) which does NAT64 through tayga too. IMHO the best strategy is a mix of strategies:…

The main idea of my experiment was to run IPv6 only setup without any IPv4 connectivity: sudo ip route get 8.8.8.8 RTNETLINK answers: Network is unreachable So I intentionally decided not to have IPv4 connectivity system wide to catch apps with issues in IPv6 only environment and then carefully evaluate issues and report them to authors: https://github.com/mozilla-mobile/mozilla-vpn-client/issues/... https://github.c…

Oh I may have misunderstood the purpose then!

> Clearly my setup is too hostile for home users but as developer I enjoy it a lot.

If you want to discover which apps need IPv4, that's indeed a great way!

Re: Enabling IPv6 support for IPv4 only apps on Linux

#33

Post by pavel_odintsov »

csdvrx wrote: post #32
pavel_odintsov wrote: post #31

Earlier quoted context omitted.

The main idea of my experiment was to run IPv6 only setup without any IPv4 connectivity: sudo ip route get 8.8.8.8 RTNETLINK answers: Network is unreachable So I intentionally decided not to have IPv4 connectivity system wide to catch apps with issues in IPv6 only environment and then carefully evaluate issues and report them to authors: https://github.com/mozilla-mobile/mozilla-vpn-client/issues/... https://github.c…

Oh I may have misunderstood the purpose then! > Clearly my setup is too hostile for home users but as developer I enjoy it a lot. If you want to discover which apps need IPv4, that's indeed a great way!

I have idea of even more hostile environment in my mind. My plan for next phase is to get rid of 127.0.0.1 on lo interface. I've tried it once and I had to reboot my machine as all things stopped working.

As another angle to make it even more interesting but on network scale I've implemented option for Unbound to suppress A records even if they do exist: https://github.com/NLnetLabs/unbound/pull/819 and push dual stack apps to be IPv6 only.

Re: Enabling IPv6 support for IPv4 only apps on Linux

#34

Post by csdvrx »

fghorow wrote: post #30
csdvrx wrote: post #19

Earlier quoted context omitted.

I do. Ask your questions. And please post the results of `dig -t AAAA ipv4only.arpa @$DNS` with $DNS being each of the DNS servers from your ISP: "Using draft-ietf-behave-nat64-discovery-heuristic, the CLAT discovers the Pref64/n. The CLAT component sends an AAAA query to the DNS64 for the well-known IPv4-only name “ipv4only.arpa”. The Pref64/n is derived from the received AAAA response. The CLAT determines the used…

OK, dig responses: DNS1 8.8.8.8 (google, obviously) """ dig -t AAAA ipv4only.arpa @8.8.8.8 ; > DiG 9.18.13 > -t AAAA ipv4only.arpa @8.8.8.8 ;; global options: +cmd ;; Got answer: ;; ->>HEADER ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 512 ;; QUESTION SECTION: ;ipv4only.arpa. IN AAAA ;; AUTHORITY SECTION: ipv4only.arpa. 568 IN SOA sns.dns.icann.org. noc.dns.icann.org. 2022072100 7200 3600 604800 3600 ;; Qu…

> Major question: is something like this feasible with Opnsense as a router, or should I only try it with a Linux solution?

It should be possible but I'm not familiar with opensense. If you can't use clatd there, you will need some other implementation of 464XLAT.

Then, if you want to offer IPv4 on your network, you'll have to use DHCP on a RFC1918 block (ex: offer IPs in 10.1.2.3) and masquerade to the 192.0.0.1 gateway you've created with your 464XLAT implementation (whether clatd or something else)

Here you'll have to use tayga as you don't seem to have a GW provided by your ISP level3.

> How much does this complicate my firewalling

Not much. The ip4 rules would be as before, but the clat interface would be your default ipv4 route so you'd need to replace all instances of `eth0` or `wlan0` by `clat` in your scripts on the machine running clatd

> Do I deal with firewalling IPV6 only from the outside world?

It depends if you want to firewall IPv6? If you fear some services are reachable by IPv6 while they shouldn't be, use ip6tables. Just remember in IPv6 you should keep icmp flowing as it serves many purposes.

You can also decide to not offer IPv6 at all on your lan (making it IPv4 only on 10.1.2.3, with the packets going to clatd 192.0.0.1 on your router)

> Or do I need to worry about RFC1918 addresses on my LAN "leaking" out to the IPv4 world via the IPv6 connection?

It shouldn't: IIRC 464XLAT implementations will only route non RFC1918 packets. Check the RFCs if you want to be sure, or forge packets to try.

Re: Enabling IPv6 support for IPv4 only apps on Linux

#35

Post by iam-TJ »

pavel_odintsov wrote: post #31
csdvrx wrote: post #7

Using LD_PRELOAD for IPv4 seems to me like using the wrong tool for the job. > "Most of the apps I use support IPv6 but there are some cases when lack of IPv4 connectivity on my machine negatively affects experience." Just install clatd to get 464XLAT so hardcoded ipv4 get routed to 192.0.0.1 (the clat iface is the default gw for ipv4) which does NAT64 through tayga too. IMHO the best strategy is a mix of strategies:…

The main idea of my experiment was to run IPv6 only setup without any IPv4 connectivity: sudo ip route get 8.8.8.8 RTNETLINK answers: Network is unreachable So I intentionally decided not to have IPv4 connectivity system wide to catch apps with issues in IPv6 only environment and then carefully evaluate issues and report them to authors: https://github.com/mozilla-mobile/mozilla-vpn-client/issues/... https://github.c…

I've been operating IPv6-only networks for enterprise and domestic use since late 2019, with DNS64/NAT64 on the gateway. Since 2021 some networks are behind Starlink CGNAT so I tunnel those networks over Wireguard to the gateway.

Like you I've detected a handful of applications that couldn't cope without local IPv4 - if they couldn't be patched they got dropped.

The issue I do hit - and report - from time to time is services that advertise both IPv6 and IPv4 addresses in DNS but do not respond to IPv6. Those are really annoying and even when I manage to get a response from the admins very rarely do they fix it either by accepting IPv6 connections or dropping the DNS AAAA record.

Another solution when emergency IPv4 is required (e.g. if the gateway has died!) is an IPv4 in IPv6 tunnel on the local network to the local IPv4-only gateway - think Starlink terminal.

This article made me put into a script the code I had for setting those tunnels up to make it easier, and avoid forgetting!

https://gist.github.com/iam-TJ/135b47d29bd8ee4e0f3330aef7324...

Re: Enabling IPv6 support for IPv4 only apps on Linux

#36

Post by csdvrx »

Spivak wrote: post #29
jacob019 wrote: post #5

Indeed, the transition to IPv6-only networks is a timely and important step, and this is an interesting approach. In my opinion, NAT64 in combination with DNS64 presents the most practical solution for home networks. This approach can be fully implemented by consumer routers, eliminating the need for any changes to client devices. If router manufacturers were to make NAT64 with DNS64 a default feature or, at the very…

Then add NAT 46, 44, and 66 and give no shits about any nonsense that happens outside your network while supporting any device and allowing people to go ipv6 only at any time. If v6 people didn't hate nat with the white hot intensity of a thousand suns [1] we could have had a smooth ipv6 path with the only necessary change being on consumer routers. [1] https://lwn.net/Articles/451914/

This is a link to a thesis. Can you recommend some implementations for linux and talk about your experience?

Re: Enabling IPv6 support for IPv4 only apps on Linux

#37

Post by csdvrx »

pavel_odintsov wrote: post #33
csdvrx wrote: post #32

Earlier quoted context omitted.

Oh I may have misunderstood the purpose then! > Clearly my setup is too hostile for home users but as developer I enjoy it a lot. If you want to discover which apps need IPv4, that's indeed a great way!

I have idea of even more hostile environment in my mind. My plan for next phase is to get rid of 127.0.0.1 on lo interface. I've tried it once and I had to reboot my machine as all things stopped working. As another angle to make it even more interesting but on network scale I've implemented option for Unbound to suppress A records even if they do exist: https://github.com/NLnetLabs/unbound/pull/819 and push dual sta…

127/8 is fun!

I'm using it to run electron-like apps, abusing Bonjour to provide .local domains with reverse (ex: spreadsheet.local could go to 127.1.2.3 if you forge and send the right mDNS packet on port 5353)

Unfortunately, I haven't found a way to do the same in IPv6: fec0::/10 for site-local address precedence 1 was deprecated by RFC3879

See my proof of concept https://github.com/csdvrx/PerlPleBean/blob/main/experiments/... and the IPv6 explanations around line 70

For your usecase, if you don't want to be restricted to ::1/128 you could maybe replace the 127/8 by fc00::/7 but it would require setting the link up while I want everything to be automatic

Re: Enabling IPv6 support for IPv4 only apps on Linux

#39

Post by pavel_odintsov »

realid wrote: post #38

Kinda sad that https://news.ycombinator.com/ is still only available via legacy IPv4. Any idea who could fix this and enable IPv6 on this site?

Great catch. I did not notice it:

dig -t aaaa news.ycombinator.com @8.8.8.8 +short

Returns empty result.

Post reply on HN