IPv6

IPv6 overview

• Global Unicast Address –Scope Internet- routed on Internet (GUA)

• Unique Local — Scope Internal Network or VPN internally routable, but Not routed on Internet (fc00::/8 and fd00::/8 )

• Link Local – Scope network link- Not Routed internally or externally. (*fe80*)

• PA - provider aggregatable GUA

• PI - provider independent GUA

• SLAAC - stateless address auto configuration

thisisunsafe

Header

Ipv6 address range

Ubuntu wiki ipv6 introduction

NAT64 - 64:ff9b::/96

PA -

6to4 tunnels

• Tunnel via 6to4 (RFC3068). Your firewall has to pass protocol 41 (IPv6 in IP) and you need a global, public IPv4 address. The relay address is the special anycast destination 192.88.99.1 or a relay that is local; your IPv6 address uses the special 2002::/16 prefix. A good script to bring a 6to4 tunnel up or down can be found at anyweb

• Mirredo/Teredo tunnel, using UDP

Transition strategies

​

Configure IPv6

Configure dhcp IPv6 on ubuntu

• Provide IPv6 information in your local network

• DHCPv6 using the Prefix Delegation Feature Configuration Example

• SETTING UP A DHCP SERVER FOR IPV6

• Configure DHCPv6-PD (Prefix Delegation) Client & Server on Mikrotik RouterOS 6.48.2

/usr/sbin/dhcpd -6 -d -cf /etc/dhcp/dhcpd6.conf ens192

root@alex:~# cat /etc/radvd.conf

AdvManagedFlag on;
AdvSendAdvert on;
MinRtrAdvInterval 3;
MaxRtrAdvInterval 60;
prefix 2001:470:xxxx:186:1::/80
{ 
};
};

dhcpd6.conf :

authoritative;

subnet6 2001:470:xxxx:186:1::/80 {
    option dhcp6.name-servers 2001:470:20::2, 2001:4860:4860::8888, 2001:4860:4860::8844;
    option dhcp6.domain-search "lab.incoma";
    range6 2001:470:xxxx:186:1::100 2001:470:xxxx:186:1::600;
#    range6 2001:470:xxxx:186:1::/80 temporary;

}

Macbook

networksetup -setv6off USB_ETHER
networksetup -setv6automatic USB_ETHER

Mikrotik

6to4

Hurricane Electric

/interface 6to4 add comment="Hurricane Electric IPv6 Tunnel Broker" disabled=no local-address=95.31.44.126 mtu=1280 name=sit1 remote-address=216.66.80.30
/ipv6 route add comment="" disabled=no distance=1 dst-address=2000::/3 gateway=2001:470:xxxx:1cc::1 scope=30 target-scope=10
/ipv6 address add address=2001:470:xxx:1cc::2/64 advertise=no disabled=no eui-64=no interface=sit1

/ipv6 address add address=2001:470:xxxx:1cc::1/64 disabled=no eui-64=no interface=ether1
/ipv6 nd set [ find default=yes ] advertise-dns=yes

/ip dns set allow-remote-requests=yes servers=2001:470:20::2,2001:4860:4860::8888,2001:4860:4860::8844

IPV6 tunnel broker

• https://wiki.gentoo.org/wiki/IPv6_router_guide/ru

• https://wiki.archlinux.org/index.php/IPv6_tunnel_broker_setup

• https://texts.xexyl.net/docs/ipv6-howto.html

• https://journeymangeek.com/?p=228

• https://rotelok.com/centos-7-with-ipv6-at-server4you/

• https://blog.mapstrata.com/post/6in4/

• https://gist.github.com/threedaymonk/1021042

• Hurricane Electric IPv6 Gateway on Raspbian for Raspberry Pi

• IPv6 Explained for Beginners

• Github how configure HE tunnel

• How to configure a MikroTik (RouterBoard) router to accept IPv6

• Mikrotik 6to4 автоматизация при динамическом IPv4

HE.net (cloud3 eve-ng )

Tunnel 2001:470:xxxx:1cc::/64

Lan : 2001:470:xxxx:1cc::/64

Networks : 2001:470:70f6::/48

Ping some sites

IPv6 speed test

Ping by Hostname or IPv6 Address

ping6 ipv6.google.com
ping6 ip6.me
ping6 -I en0 ff02::1
ping6 ff02::1%en0
2001:4860:4860::8888
2001:4860:4860::8844

ipv6 traffic-filter outside-in-ipv6 in

ip -6 neighbor show
ndp -an

DNS Resolvers Anycast IPv6 Caching Nameserver: 2001:470:20::2

Configure Linux for tunnel

https://wiki.ubuntu.com/IPv6

net.ipv6.conf.all.forwarding=1 >>/etc/sysctl.conf
sysctl -p /etc/sysctl.conf 
disable netplan

root@alex:~# cat /etc/network/interfaces
auto lo
iface lo inet loopback

auto ens160
iface ens160 inet static
address 10.121.1.4
netmask 255.255.255.0
gateway 10.121.1.1

auto ens192
iface ens192 inet6 static
address 2001:470:xxxx:186:1::2
netmask 80

auto he-ipv6
iface he-ipv6 inet6 v4tunnel
address 2001:470:xxxx:186::2
netmask 80
mtu 1280
local 10.121.1.4
endpoint 216.66.80.30
ttl 255
gateway 2001:470:xxxx:186::1

Configure Cisco for tunnel

configure terminal
ipv6 unicast-routing
ipv6 cef

interface Tunnel0
 description Hurricane Electric IPv6 Tunnel Broker
 no ip address
 ipv6 enable
 ipv6 address 2001:470:xxxx:1a87::2/64
 !tunnel source 95.165.137.87
 tunnel source 192.168.180.7
 tunnel destination 216.66.80.30
 tunnel mode ipv6ip
ipv6 route ::/0 Tunnel0
end

int tunnel0
 ipv6 inspect v6firewall in
 ipv6 inspect v6firewall out
 ipv6 traffic-filter v6Outside_ACL in

ipv6 dhcp pool DHCPv6
 dns-server 2001:470:20::2
 domain-name yourdomain.com

Zone-Based firewall

zone security INSIDE
 description Inside zone
zone security OUTSIDE
 description Outside zone

interface Tunnel0
 zone-member security OUTSIDE
interface FastEthernet0/1
 zone-member security INSIDE

class-map type inspect match-any IN-TO-OUT-CLASS
 match protocol http
 match protocol https
 match protocol dns
 match protocol icmp
!
!
policy-map type inspect IN-TO-OUT-POLICY
 class type inspect IN-TO-OUT-CLASS
  inspect 
 class class-default
  drop
!
zone-pair security IN-TO-OUT source INSIDE destination OUTSIDE
 service-policy type inspect IN-TO-OUT-POLICY
!
show zone-pair security
sh policy-map type inspect zone-pair sessions

ipv6 access-list outside-in-ipv6
 permit tcp any any established
 permit icmp any any

 permit tcp any host 2001:470:66:758::2 eq 22
 permit icmp any 2001:470:4A73::/48