Hacker News Reader

Comment by tzakrajs | Hacker News Reader

It's just a novelty, as my sibling comment mentions, nat64 and dual stacking allows you do everything you need.

Nat64 requires a static route added to your gateway or each node, requires a custom DNS resolver and a daemon which manages iptables on a secondary gateway host for rewriting packets to/from IPv4 destination. It's pretty clever since it uses a /96 (32-bits) on the secondary gateway to return AAAA record for all IPv4 addresses.

Dual Stack is more straight forward requiring only an additional IPv6 address to be allocated to each machine requiring access.

View on HN

Someone suggested the same thing. I'll ask the same question:

How do v4 clients (dual stacked) connected to the Internet with v4 talk to a v6 server?

A IPv4-only client cannot talk to a IPv6-only server: a 128-bit address does not fit in a 32-bit address. In a dual-stacked network, you get an IPv4 and an IPv6 address, and the network speaks both IPv4 and IPv6. So you speak IPv6 to IPv6 servers and IPv4 to IPv4 servers.

NAT64 has your ISP be an IPv6-only network--you get an IPv6, no IPv4 address--and your gateway to the Internet is an IPv4 server that translates public IPv4 addresses to IPv6 addresses for you to talk to. The server at that IPv6 address translates the IPv6 address you requested into the original IPv4 address, and acts as an IPv4 client to the IPv4 server.

(First I want to make a point/clarification. When I say v4-only, I mean a dual stacked host connected to Internet only via v4. Likewise for v6.)

If you don't have v4 and v6 interoperability - that is v4-only cannot connect to v6-only and vice-versa, how does the Internet (mostly v4-only hosts) go to v6?

NAT64/DNS64 allow a v6-only host to connect to v4-only hosts. If you are a T-Mobile US customer this is literally how you have all IPv4 connectivity. Here are AAAA records I get for amazon.com from my T-Mobile iPhone:

amazon.com. 2S IN AAAA 2607:7700::19:0:1:cdfb:f267 amazon.com. 2S IN AAAA 2607:7700::19:0:1:b020:67cd amazon.com. 2S IN AAAA 2607:7700::19:0:1:b020:62a6

These are NAT64 addresses within TMoUS’ prefix, if I try to ping an IPv4 address it is rewritten automatically as well (though this is a feature of iOS).

If you get people to v6 they can continue to access v4 with numerous transition tools like this, even if dual-stack isn’t an option. You can’t go the other way though.

So NAT64/DNS64 is really about connectivity to v4-only. This only adds more value to the v4 network by giving it more reach.

If you want to reach the v6 Internet, the best way is to have a transition mechanism for v4-only hosts to talk to v6.

Unfortunately that’s not possible, v6 has plenty of address space so you can carve a /96 out of your network to implement a transition layer so clients can be v6-only before the larger internet. There’s no way to represent the v6 network in 32-bit v4 addresses, so you have to start getting clients to v6 first.

v4-only means (as specified earlier) that connectivity is over a routable v4 address; a v4 host in a v4-only network can be dual stack, so it's possible to talk to v6 addresses, which this proposal actually addresses.

For all practical purposes, every OS networking stack is dual-stacked, so v4-only/v6-only is taken to mean that there is only a routable IPv4/IPv6 address.

v4-only and v6-only cannot in general talk to each other. There needs to be some intermediary to convert between IPv4 and IPv6 somehow. The transition from IPv4 to IPv6 is mostly progressing by having servers dual-stack (give them both IPv4 and IPv6 addresses) and dual-stacking the residential networks, or giving up on IPv4 for your internal network and using NAT64. You could in principle do the same thing for servers, but doing that 4-to-6 translation for the initial recipient of a connection request (i.e., the server) is more difficult than the initial sender (i.e., the client).

SOCKS and other forward proxies can allow IPv4-only clients to hit IPv6.

Reply on news.ycombinator.com