Enabling IPv6 support for IPv4-only apps on Linux
blog.apnic.net
blog.apnic.net
If you have a working NAT64/DNS64 setup, macOS can make a AAAA (ipv6 DNS) request to ipv4only.arpa, and observe the form the result comes back as, in order to learn the IPv6 prefix used for IPv4 compatibility on the network (eg. 64:ff9b::/96), and if it's not given an IPv4 address via DHCP, will set up a local interface at 192.0.0.1 that is the default route for all IPv4 traffic. Anything sent to this interface will translate the address to the corresponding IPv6 compatibility address and send it to your IPv6 router (which should use NAT64 to send it to the destination.)
In this sense, you don't need any IPv4 infrastructure at all in your network (no DHCP, etc) and all traffic on your LAN will be IPv6, but IPv4-only apps (including those that hardcode IPv4 addresses and try to connect to them) work fine.
A quick web search says that linux has a similar thing implemented as a userspace daemon (clatd) which presumably does something similar, and importantly doesn't rely on LD_PRELOAD hacks like this article suggests (LD_PRELOAD doesn't work with static binaries like those written in Go, for instance.)
https://archive.nanog.org/sites/default/files/wednesday_gene...
And this causes a massive headache when it comes to systems that track you based on your IPv4 address. For example there are applications that track you by your IP address. And if you want to opt-out they refuse because the IPv4 address you give them is owned by T-Mobile.
Also, it completely breaks stateless applications.
When you have an IPv4 <> IPv4 UDP tunnel you can just send traffic. If one device is behind NAT you set up port forwarding. It'll work today, it'll work tomorrow, and in 2 years.
The tunnel that the NAT64 system sets up is time-bound. So while outgoing traffic re-establishes the route, incoming traffic is not stateless. It stops.
I have this issue with WireGuard and iOS. The iOS implementation sadly prefers A over AAAA. So when I'm on 5G it connects over a NAT64 route, but due to the NAT64 route dropping after x time push notifications break. When you then turn on the phone, some traffic re-establishes the NAT64 tunnel and all of the sudden you get a whole bunch of notifications.
I use my own router which supports NAT64. I use OpenBSD which supports it natively in-kernel, but you can get NAT64 with any competent router software (OpenWRT, pfsense, etc.)
> And this causes a massive headache when it comes to systems that track you based on your IPv4 address. For example there are applications that track you by your IP address. And if you want to opt-out they refuse because the IPv4 address you give them is owned by T-Mobile.
Huh? I don't follow what you're saying... websites see an IPv4 address when I connect. I'm using NAT64, after all. It's just the _client OS_ that thinks it doesn't have an IPv4 address. My OS sends traffic as IPv6 to 64:ff9b::/96, but the router turns around and makes an IPv4 request with the IPv4 address I get from my ISP. I have IPv4 at the gateway but nothing else in my network sees it.
> Also, it completely breaks stateless applications.
I don't know what this means but I haven't seen a single broken application?
> When you have an IPv4 <> IPv4 UDP tunnel you can just send traffic. If one device is behind NAT you set up port forwarding. It'll work today, it'll work tomorrow, and in 2 years.
I can NAT inbound IPv4 requests to my internal IPv6 machines too, I don't know what the issue is for you here. I choose not to, since I don't want to deal with it, but the option is available if I want.
> The tunnel that the NAT64 system sets up is time-bound. So while outgoing traffic re-establishes the route, incoming traffic is not stateless. It stops.
I don't know what you're referring to here... it's exactly the same as how NAT works in IPv4. Outbound requests from my internal network are tracked with NAT, and return traffic is rewritten back to the IPv6 address that sent it. There's no difference between that and IPv4 outbound NAT here. I don't know what you're talking about with "tunnels" or anything.
This phrase:
> The tunnel that the NAT64 system sets up is time-bound. So while outgoing traffic re-establishes the route, incoming traffic is not stateless. It stops.
Makes it seem like NAT64 is doing something conceptually different from what we’ve had for decades with every IPv4 network. It’s not.
And when OP says:
> When you have an IPv4 <> IPv4 UDP tunnel you can just send traffic. If one device is behind NAT you set up port forwarding. It'll work today, it'll work tomorrow, and in 2 years
Everything they just said applies to NAT64 too. You can “set up port forwarding” of your public IPv4 address to forward to an internal IPv6 address too. It’s just NAT!
Edit: I think what’s happening in this discussion, is that WirelessGigabit responded to my comment about my home setup, with drawbacks about their T-Mobile setup, which was a bit of a change of subject. It took a few re-readings of their comment for this to become clear. In my toplevel post I’m referring to a scenario where my ISP gives me an IPv4 address, but I don’t have IPv4 enabled in my LAN. (No IPv4 DHCP addresses are being handed out, my router does not have a v4 address on its LAN link.) WirelessGigabit is referring to a setup like in T-Mobile, where they’re putting the NAT64 box somewhere in T-Mobile’s infrastructure, and thus WirelessGigabit has no control over doing things like setting up port forwarding rules, etc. Basically they’re complaining about things I never mentioned about my setup. And as others have pointed out, T-Mobile’s XLAT setup is basically CGNAT by another name, but one where if your use case is pure IPv6, there’s a path to avoiding the NAT issues. This is very different from my case.
Our best hope to avoid CGNAT is more/better IPv6 support.
Thank you for sharing! Yes, macOS has such logic and it works just fine. The main issue from clatd that it's pretty tricky to setup and it emulates presence of IPv4 on machine which is not very desirable as it tends to hide issues with other tools.
My plan was to explicitly disable IPv4 connectivity for machine and hide it from other app but keep it active for subset of well known broken tools and then fix them one by one and switch to IPv6 only setup.
I pretty much stopped submitting patches enabling v6 functionality to various projects back in 2005 as everything I cared about was working at that point. (Side note, I was just trying to search a few of those - but seems that period pretty much doesn't exist in search engine caches anymore. I knew the state of preserving internet history is bad, but I didn't expect it to be _that_ bad)
If I don't have IPv4 connectivity, yet a 6-to-4 gateway exists and I have IPv6 connectivity, and some app tries to use IPv4, then clearly the gateway should be used.
How about some sysfs config option that says "redirect ipv4 to 6to4 gateway if no default ipv4 route exists", enabled by default.
It would probably have undesired effect... effects! Why does it autocorrect to effect??... in some cases.
There are various 6to4 on-ramps that solve this. Popular ones are NAT64/DNS64, 464Xlat, and DS-Lite. In my experience, DS-Lite works nicely with v4-only apps/services or v6-only apps/services.
The top level reply here discussing how MacOS handles it seems like something that should be able to be recreated with iptables, but when searching I am extremely surprised to discover that Linux does not seem to have the ability to do anything similar. It seems most solutions focus on using socat in userspace to proxy data between the sockets which is not really a practical solution.
I think the only way IPv6 will ever become mainstream is if either the EU or US Congress pass a bill making it the preferred IP standard.
Still, for a company like discord, not even using host names to allow DNS64 is really sad.
128 is no different to 33 bits, or 32 bits plus extension header in that regard.
Perhaps you meant to suggest that they should own 1.1.1.1::/64 or 1.1.1.1/128 (or 1:1:1:1::/64)?
Even if it's the latter case, both the actual ::ffff:1.2.3.4 (or it's predecessor ::1.2.3.4) have the problem that some middle box receives a packet for 1.1.1.1::abcd:1234, doesn't understand the header the abcd:1234 portion is encoded in, throws it away, and the router at 1.1.1.1 receives a packet which is destined for some unknown device behind the router with no info for how to get the packet to that device.
The only other way to get them to invest in alternatives to IPv4 before IPv4 stopped meeting their business needs would have been via regulation.
But the limitations of v4 and of existing v4 devices limit the ways that can work. Reinventing stuff and calling it "4.1" won't change that. You'll still face all of the same limitations.
> They'd focus on getting everyone onto the v6 protocol first, then open up the new addresses for use. That's the transition period that never happened.
That's basically the transition period that _is_ happening, except we aren't delaying the "open up the new addresses" stage -- the new addresses are usable straight away for anything you've migrated.
Another would be that government customers need to have IPv6-enabled sites. This could get a lot of companies to add IPv6 hosting.
My understanding is they largely do. It's the ISPs that have enough IPv4 addresses that don't feel a need to upgrade, and the website operators who $3/server/month for an IPv4 address is a rounding error.
I know v6 supports NAT, but it was basically designed to remove it with the whole random addressing scheme, and that isn't necessary for solving this problem (idk if things were different in the 1990s).
Swap in v4.1-compatible stuff and you'd be done. Sending to short address uses v4, sending to long uses v4.1.
Why bother? IPv6 is available today and has been here for over 20 years. The truth is it is actually simpler to deploy than v4. For example, the address format makes it easier to understand subnetting (because it's hex.) NAT is an abomination and we should be glad to see it go: end-to-end connectivity is how the internet is supposed to work. I remember the old days (the 90's) where we all had public IP addresses on our desktops. VPNs are much simpler: there's no potential for overlapping RFC-1918 addresses because v6 is globally unique. I could go on.
> end-to-end connectivity is how the internet is supposed to work
This is the secondary motive of ipv6 that makes it not happen, cause not enough people agree with this statement. Most home and corporate users have little interest in outside connectivity, or when they do, it's easy to forward ports. And it's important how even the cheapest router or least savvy user won't accidentally expose local devices to inbound connections; see another user's note on unsafe defaults https://news.ycombinator.com/item?id=37765946
If you personally would like to go NAT-free on your network, still all you need is plentiful addresses like v4.1, but it wouldn't be the default that everything is optimized around.
A new header format is a new version of IP. That's how it was designed. That's the compatibility story of IP. There is no way (there never was a way) to change the IPv4 header format without incrementing the version number. There is no way to not create a "second" stack when you increment the version number. Different versions are always different "stacks". They are always going to have different mechanics and need different hardware.
All the other things that IPv6 changed didn't make it a different stack. Making a version 6 at all made a new stack and all the other things were changed to throw in additional improvements (and make things simpler) since there needed to be a different stack anyway. If version 6 had changed "just" the header it still would have been just as hard to upgrade to, but people would have even fewer reasons to upgrade.
This is unlike v6, which cannot address anything inside the v4 space. v6 and v4 are totally separate planes.
If you really want extra compatibility, idk if this is a good idea but it's an option... Go v4.1 using up to 40-bit addresses for now (but leave room for more). Translate a v4.1 TCP/IP packet with a 40-bit src and 32-bit dst to v4, truncating the last 8 bits of the src IP, provided the last 8 of the src port matches them. IPv4-only dst can respond fine. When that /32 v4.1 router receives the v4 response, set the last 8 bits of the dst IP to the last 8 of the dst port. So it's kinda like NAT except translating to a public /40 IPv4.1 instead of a private IPv4. Actual NAT on the /40 addrs gets the remaining 8 bits for the src port. And you just speak v4.1 without all this if the dst is >32 bits.
Also, you know NAT64 exists, right? You can have a v6 only network connecting to v4 hosts. Is that not enough compatibility if you don't want dual stack hosts?
You are doing a lot of magic heavy lifting in "You'd update BGP and the routers" as if there was a way to do that with a "small point update", especially once you realize how much firmware and hardware was always the issue that needed changing; updating IP was never an easy software-only problem. Just because you think you can imagine it doesn't mean it was technically feasible, especially at internet scale. Engineers spent years exploring options before they arrived at the IPv6 proposals. The space/memory inefficiency of v4 BGP was one of the problems they had to address. Sure, they felt a need to address it with a brand new protocol with less resemblance to BGP than some would have liked, but that wasn't because they were a priori trying to make life more difficult for everyone: they wanted devices to be able to route IPv6 without needing GBs to TBs of RAM just for routes and were afraid that "just use good old BGP but massively extended with a larger address space" was going to go that way and possibly quickly.
There are major IPv6-only consumer networks (it's now quite common among the mobile carriers). IPv6 routing is starting to be generally faster and more reliable for consumers. Consumers have easily adopted v6 mostly without realizing it. ("Happy Eyeballs", indeed.)
There's no "adoption problem". It is adopted. It is working as intended. Will there be a day that we "turn off v4 for good"? Probably not, but every engineer who helped build v6 should have been well aware of Postel's Law and its many corollaries and the root "Internet law" that "no matter how many networks exist, they will always communicate and cooperate; there are many networks but only one Internet". IPv1 and IPv2 likely will always be the only IP versions to truly die and that will always be an historic accident of when IPv4 was devised while the Internet was still mostly young and "just" a research project among academics. Killing IPv4 was never the goal of IPv6, it had to live side-by-side, and everyone knew it. Is IPv6 a "success" at current adoption rates? Success is subjective. Obviously we disagree on how successful it is/has been. That may not change, because they are and always will be opinions.
The point of IPv6 was always to build an internet that could address the next several billion devices. IPv4 addressed way more devices than its developers ever intended and did an arguably above-and-beyond job at addressing the first billion or so. (We can argue for hours though on how hacks like NAT44 have broken some of the original spirit of IPv4, of course, in the course of prolonging its useful device addressing lifespan.) IPv6 is succeeding in that. There are emerging world devices getting addressed that could never afford a cramped IPv4 address. There are nearly as many mobile devices running IPv6-only or IPv6-first as servers in the first couple of decades of IPv4.
Will all of the "first billion" devices move to the new protocol? On the one hand, probably not. On the other hand, does it matter? The dream of the internet was always about bridging a bunch of networks that had no right talking to each other and that many people thought it impossible that they would ever speak common protocols. There's only one internet because no matter how complicated it gets, people are still cobbling together incredible ways for different stacks to talk to each. This is how the internet was built, this is how the internet will always exist. This was true in the era when internet tools were built out of putty around unix-to-unix copy somehow speaking to VAX servers across an Appletalk bridge to a token ring ethernet adapter to a proprietary IBM Mainframe protocol. It is still the case with IPv4 and IPv6 acting as side-by-side "friends" working together for the common good of the internet.
The internet doesn't really care if you only want to run "one stack" instead of two if you are fine that an increasing amount of your traffic is going through the equivalents of an Appletalk bridge, who may start charging for it at some point (or are volunteers running it for fun and might get bored). (I think in this analogy the biggest one of those Appletalk bridges is Cloudflare? Even I can't tell if I'm joking or not. It does explain some things about CF's business model.) It will take decades for it to get to that, though.
Anecdotally, my home ISP grants me an IPv6 allotment and I've noticed quite a bit of traffic using it. It's kind of fascinating because my current Wifi router indeed has some sort of memory pressure issue with some combo of IPv4 BGP routes and NAT44 firewall states and just entirely falls apart routing IPv4 at some point when it has been running for long enough. My previous employer's IPv4-only VPN seemed to especially stress it for whatever reasons, during WFH life, and I'd have to restart the router somewhat regularly for it to start routing IPv4 correctly again. IPv6 traffic just worked even when the router was dying on IPv4 traffic. If I wasn't on my work laptop or trying to use a site like HN or GitHub, I could go sometimes hours to days before realizing IPv4 addressing was broken again. My "prosumer" perspective is IPv6 is the reliable stack I use most often (gaming, lots of daily browsing, key apps I rely on, even many of my consumer devices just quietly falling back to 464XLAT and "Teredo" tunnels and still reaching IPv4 stuff despite my local router falling apart) and IPv4 the increasingly weird and flaky stack. I only know I can point a finger at IPv4 because I'm just enough of a nerd to do small bits of debugging when it happens out of curiosity, but it is an interesting pattern, anecdotally.
Presumably the next several billion devices want to talk to the current ones. There will always be old devices left behind on old protocols, same as how old versions of SSL get rejected everywhere, and they can deal with it via compatibility layers like 4-to-6 NAT.
The problem areas are with hosting and corporate networks. The Google numbers are smaller during the week as people use IPv4-only corporate networks.
It is not well publicized.
It turns out when you have a government that can tell you "move to IPv6 or we'll have your legs broken and your family thrown in prison" it's a bit easier to get things moving.
- enough addresses for everyone on the planet, but we can't freely give out permanent static allocations to everyone because it would explode the routing tables
- so we never got our permanent roaming addresses we were promised
- NAT66 exists
- IPv6 was (still is?) a moving target for implementors
It's worse than an insult
Best practices changing applies to IPv4 too.
NAT exists but you don't need it and even if you do use it you don't have to track connections.
https://meta.trac.wordpress.org/ticket/3090
"The WordPress.org systems team DO have IPv6 plans, but at present there are higher priority tasks and there's no widespread requirement for IPv6 connectivity."
Its not possible to run a WordPress instance and auto-update with IPv6-only and without any kind of adress translation.
This is sad, but not surprising.
(Also that may be done on routers which today deal with NAT anyway)
And after transition is done, in theory, all you’d do would be turn off the translation box. In practice you’ll have to keep it up until the end of days, but that’s a separate matter.
Every time someone runs a linter over upstream, you're going to have to remake that patch. Sure, it's only 20 mins... But that multiplied by every bit of software you patch and every release, and you quickly realise that a huge chunk of your life was wasted doing what is effectively busywork.
Instead, contribute your time and efforts back to upstream, and now your efforts can help millions of people not just one. If others do the same, you'll see far more improvements to the software you use than you alone could ever write and maintain.
Even staying still in the world of software involves some level of effort.
Offering changes back to upstream is always encouraged, but whether or not it is accepted is largely irrelevant to the patch author.
One main benefit of software/computers/the internet is that work done by one person can benefit millions - thats what sets us apart from cavemen who had to do everything for themselves, and got a worse quality of life as a result.
This bogus assumption is the whole problem with the "upstream or nothing" attitude.
You're letting a single project -- and usually a single individual -- be the gatekeeper between you and the entire remainder of humanity. That is stupid.
> This sort of negates that advantage
LD_PRELOAD trickery doesn't negate the advantage of having full source access, patching SSH would also have been a perfectly valid option, but is perhaps a better tool for this particular job.
For another use of the trick see https://github.com/mariusae/trickle (the project looks stale, though that may be because it is properly done and there have been no security/other bugs to fix in recent history) which slips its own functions in the call chain to apply user controlled (rather than firewall/routing level) throughput shaping to utilities that don't offer it out of the box.
You'll quickly discover that "open source" doesn't make everything easier.
Turns out actually doing this with the Linux kernel is exceptionally difficult. You can swap out the underlying sk, but doing it safely is damn near impossible because the two data structures aren’t really built like that.
One day, I’d love if someone added the ability to swap Unix sockets for TCP sockets at runtime to the kernel — for other reasons.
The other problem is that we found runtimes that would immediately send data after a non blocking connect (or receive data), and you needed a way to kick these off again. It was really a nightmare to restore all that state in a running socket.
The real solution was to add a new address family, and patch the kernel (as opposed to a module), that could dynamically switch back and forth (think AF_KCM). Unfortunately, I never got around to that.
No one is debating it's not ready for production use. It's just that it's a lot easier to configure clients in dual stack than do a 6 to 4 translation.
When I disabled IPv4 a few weeks ago, I couldn't use: HN, GitHub, Reddit, Discord, Duckduckgo.
EUI-64 is a part of SLAAC, not NDP.
Finally, NDP is not really any more secure at least than ARP (at least not if you don't implement SEND as well, which I'm not sure if anyone does, at least in consumer networks). Not sure about reliability or scalability either.
Designing the internet with lots of unused space at the edges will probably be useful in 100 years.
That is an argument for forcing ISPs to support SLAAC, so it's difficult to bill a customer based on the number of devices in their home. ISP-friendly often means user-hostile.
If ISPs can deploy device-counting DHCPv6, then router manufacturers will respond with IPv6 NAT, and then the IPv6 landscape will be as shitty as IPv4.
To be clear, I'm talking of ISP-provided (usually wifi) routers, which at least in my country are extremely common. Those could receive an IPv6 prefix and do DHCPv6 inside your own network.
So I think SLAAC is good because ND Proxy is less evil than NAT.
Pedantically, it doesn’t force that but it can, right?
So if you want to define subnets within that, you're "doing it wrong"? Nah. Just use DHCPv6 and be happy.
SLAAC just tells the endpoint device to self-assign an address and to roll with it. For example, there’s no way to pass in DNS servers with SLAAC.
In corporate-y environments it allows for easier tracking of user-MAC-IP mappings for auditing purposes. If you use SLAAC there is no auto-logging as the client simply picks an address itself.
One way to do tracking with SLAAC could be to SNMP scrape/trap ipNetToPhysicalTable of RFC 4293. Another would be 802.1X or MAC authentication (interim) accounting via RADIUS (RFC 2866).
There are other advantages too, like if you want to assign specific addresses to specific devices without having to configure each device separately.
None of those sites have v6 though, so you'll need some form of backwards compatibility running to reach them. Presumably you were missing that.
Update - 23 Aug 2023 — Today, we are pleased to announce the general availability of IPv6 support for the Docker Hub Registry
Apparently it can be done now, I wont be finding out in a hurry.
I recently had to setup a non-encrypted website because I have a few old devices that can no longer do HTTPS.
IPv4 on local networks will probably exist for a very long time.
That sounds like they haven't been updated for TLS>1.1 – if that is the case then rather than going all the way down the HTTP you could enable TLS1.1 (and maybe 1.0). It is open to POODLE/BEAST/others that way, but still have some protection and the site's configuration differs less from the rest of your infrastructure.
Unless the site is completely internal only of course, in which case just sticking with HTTP may be less faf.
And I have an old Blackberry Bold that now show current electricity prices, so I know when to starte my washing machine. That can also run on own webserver.
As a side note, barely anything supports TLS 1.1 but not TLS 1.2
ssh 64:ff9b::1.3.3.7
Edit: RFC1884 from 1995 already had it, nothing has changed in that aspect.
In the example, 64:ff9b::103:307 is equivalent. A more complicated example might be akin to 64:ff9b::198.51.100.231, equivalent to 64:ff9b::c633:64e7.
I started to look into CLAT and really didn't want to have to go through the hassle of a whole new virtual interface with routes etc, when one single app can't just pass a couple different args to connect().
I actually had thought about trying to write something exactly like this myself.
I'm glad to learn it already exists.
Also, isn't trying to run both IPv4 and IPv6 inherently a security issue coming from the complexity of dealing with two overlapping networks with very different logic ?
If you do the 4-to-6 translation on your own machine, your local router doesn't need to know about v4 at all. This is already happening with mobile networks.
It works by having several IPv6-only subnets and a dual stack router (running openwrt) that performs stateful NAT64 [1] using Jool. This allows to access both the IPv4 internet and local IPv4 islands[2] (basically old devices like printers).
There's no DHCP or NAPT involved: the router gets a /56 prefix from the ISP and performs prefix delegation, so every device does SLAAC and assigns itself a fully routable IPv6 address.
For DNS I use dnscrypt-proxy2: it's very easy to set up and it can do DNS64 and static hostnames mapping. Since prefix is stable, I just assign names to the stable EUI-64 addresses of the hosts I care about. Alternatively you can use bind for DNS64 and mDNS if you don't like manually assigning names. There's also a script to automatically assigns names based on ICMPv6 neighbours discovery [3].
I also host some services on the IPv4 internet from IPv6-only hosts: for this you need the NAT64 equivalent of port forwarding, which is setting up static BIB entries [4].
[1]: https://nicmx.github.io/Jool/en/intro-xlat.html#stateful-nat...
[2]: https://ungleich.ch/u/blog/managing-ipv4-islands-with-jool-a...
(they say my or most ISP can enable ipv6 on reuest; country : Slovenia, year : 2023)
host *.*.*.*
hostname 64:ff9:%h
(without the empty line)
Also work with scp, rsync,
The only thing missing is DHCPv6, and that's a deliberate decision - albeit a somewhat controversial one.
In general, consumer apps and consumer APIs are being developed with IPv6 support.
The new apps to name and shame for not natively supporting IPv6 in 2023 are mostly corporate and Big Enterprise.
I don't understand why IPv6 has not become more prevalent over the coming years. Seems like we're taking baby steps and growing in our dependence on IPv4 IPs, although based on other comments here it sounds like at least Linux and Mac have a way to handle this transparently, not sure about Windows.
shodan.io has support for ipv6. With ipv4 you're somewhat restricted to devices that get public ip (corporate networks) or devices that drill a hole (uPnP/port forward). IPv6 devices are publicly visible by default and you need to manually setup firewall to filter this out (not trivial - especially for UDP and ICMP)
In fact one of the warnings on dd-wrt official IPv6 tutorial: """ Keep in mind it can be dangerous to enable IPv6 without also having a firewall on each client that handles IPv6 packets, or having ip6tables on your router to filter incoming connections. ip6tables is NOT included by default with DD-WRT, which means your clients will be directly exposed to the Internet once you have enabled IPv6. """
If anything, NAT makes you less secure by tricking you into a false sense of security.
(It's also worse if you're deliberately running servers, because it catastrophically reduces the search space needed for a hostile actor to find those servers via network scanning. At least, it does on v6 -- on v4 the search space is already too small to be a relevant factor.)
The dst is going to be the router's address, not one of the LAN's private IPs.
Your router will happily "take" that destination IP. The only reason it won't is because of a firewall, not because of NAT.
IPv6 support is sufficiently widespread that pretty much the only place I can't access IPv6-only services from is the office :P.
I was thinking that there should be movement that IPv6 is the new default protocol. That includes requesting IPv6 from sites. Also, lots of docs on how to enable IPv6 with routers, program to label gear as IPv6-ready, and persuading manufacturers to enable IPv6 by default.
Finally, have best practices for IPv6 on corporate networks. With NAT64, it is possible to have IPv6-only network with IPv4 on the edge. I think it needs docs that describe how to do it, and lots of work in changing opinions of network engineers.
The trouble is definitely corporate networks. Changing opinions is hard, especially when network engineers have sunk cost fallacies and bad security training to worry about. Probably the only thing that's going to start making a difference for corporate networks is to let IPv4 costs continue to increase until enough corporate accountants start to notice that in financial reports and start to ask hard questions. Too bad there's no easy way to associate a market cost to 10.0.0.0/8 somehow.