Subject: RE: IPv6 Home Use to stimulate deployment over IPv4-NAT

From: "Bound, Jim" <[email-masked]>
Date: Mon, 17 Feb 2003 20:02:47 -0500

If we have tunnel brokers we don 't need teredo right?  That's my take
now.  

/jim

> -----Original Message-----
> From: Jeroen Massar [mailto:[email-masked]] 
> Sent: Sunday, February 16, 2003 2:16 PM
> To: 'JORDI PALET MARTINEZ'; [email-masked]
> Cc: 'Alain Durand'; Bound, Jim; [email-masked]
> Subject: RE: IPv6 Home Use to stimulate deployment over IPv4-NAT
> 
> 
> JORDI PALET MARTINEZ [mailto:[email-masked]] wrote:
> 
> > I've observed, that in most of the cases, a NAT box forwards
> > proto-41 as any other UPD or TCP traffic, so I can use my IPv6
> > elsewhere ... In my home, hotels, conferences, ...
> 
> I wonder to which box (IPv4) behind the NAT it is forwarding 
> the proto-41 packets then. Unless you configured a 
> default/unmatched target ofcourse. But then you already 
> configured it correctly ;)
> 
> > In my case never requires changing my DSL router
> > configuration, but I agree that if the hotel is filtering 
> > proto-41, I will not be able to change it either ;-)
> 
> If you are in a hotel you won't have any access to the CPE 
> either. And the CPE won't know what to do with the proto-41 
> packets when it reaches it then. But that's why we've got 
> Teredo. Though one can always ask himself if it where a 
> policy decision for not having IPv6 in their network but 
> let's not go there...
> 
> Greets,
>  Jeroen
> 
> > ----- Original Message -----
> > From: "Tim Chown" <[email-masked]>
> > To: "Jeroen Massar" <[email-masked]>
> > Cc: "'Alain Durand'" <[email-masked]>; "'Bound, Jim'"
> > <[email-masked]>; <[email-masked]>; <[email-masked]>
> > Sent: Sunday, February 16, 2003 6:58 PM
> > Subject: Re: IPv6 Home Use to stimulate deployment over IPv4-NAT
> > 
> > 
> > > On Sun, Feb 16, 2003 at 03:18:28PM +0100, Jeroen Massar wrote:
> > > >
> > > > Which one can do now by simply installing eg the 
> freenet6 client 
> > > > onto one of the existing windows/*nix boxes which will 
> advertise 
> > > > the IPv6 prefix onto the local subnet. The only trick 
> here is to 
> > > > have the CPE forward proto-41 to your v6-gate or using 
> Teredo. Btw 
> > > > 'just have to add' is sometimes expensive for some people.
> > >
> > > This is what our IPv6 students tend to do in their homes.
> > It works nicely,
> > > but still requires a tweak in the DSL router.
> > >
> > > Tim
> 
>

---

From: Erik Nordmark <[email-masked]>
Date: Fri, 21 Feb 2003 14:42:11 +0100 (CET)

> If we have tunnel brokers we don 't need teredo right?  That's my take

Agreed in principle.

Two things though:
Firstly, for the access router to ISP tunnel config
something simpler (like a DHCPv4 option) might make sense - depends
on what type of authentication the ISP wants to do specifically
for the IPv6 tunnel. If it is sufficient for the ISP to check that
the IPv4 source is one of its customers then the TSP authentication
features and flexibility isn't needed.

Secondly, 
I've been told that tunnel broker can work trough NAT but the RFC
(RFC 3053) says:
3. Known limitations

   This mechanism may not work if the user is using private IPv4
   addresses behind a NAT box.

Thus I think it would be useful to have a specification on how tunnel
broker works across a NAT.

  Erik

---

From: Marc Blanchet <[email-masked]>
Date: Fri, 21 Feb 2003 09:04:11 -0500

> broker works across a NAT.

done:
draft-parent-blanchet-blanchet-ngtrans-tsp-teredo-00.txt

(forget the teredo in the filename, it is more appropriate to say: udp
encapsulation)

Marc.

---

From: "Jeroen Massar" <[email-masked]>
Date: Fri, 21 Feb 2003 15:20:26 +0100

> broker works across a NAT.

The only thing is that the NAT box needs to know where to send incoming
proto-41 packets to.

- Some NAT boxes can be configured with a 'default'.
  Those boxes will then forward any unrelated traffic to that default
IP.
- Some others explicitly allow to NAT proto-41, or to
  match the source of the tunnelbroker and forward any traffic from that
  IP to the endpoint.
- And other NAT boxes can base the real destination based on
'established'
  rules, though this does require that the local machine keeps sending
  traffic to the tunnel broker to keep the tunnel in the NAT table.

Configuration for the local host changes only fractionally;
Eg, if we've got a tunnel from 195.64.92.136 (my machine)
to 212.19.192.219 (IPng / nlams02.sixxs.net) normally I would use:

iface ipng inet6 v4tunnel
        address 3ffe:8114:1000::27
        netmask 127
        local 195.64.92.136
        endpoint 212.19.192.219
        ttl 64

When using any of the three options from above you would need:

iface ipng inet6 v4tunnel
        address 3ffe:8114:1000::27
        netmask 127
        local 10.100.13.66
        endpoint 212.19.192.219
        ttl 64

The NAT box will rewrite the 10.100.13.66 to 195.64.92.136 and
forward the packets to the TB. On the way back from the TB to
the 10.100.13.66 address, the TB will actually only know about
195.64.92.136 and send it there, which is the NAT box which will
rewrite the destination of the packet to 10.100.13.66 and pass it
to the local host. Note that under some OS's you can avoid setting
the local endpoint.

Greets,
 Jeroen

---

From: "Jeroen Massar" <[email-masked]>
Date: Fri, 21 Feb 2003 15:22:56 +0100

> >> If we have tunnel brokers we don 't need teredo right?  

<SNIP>

> (forget the teredo in the filename, it is more appropriate to say: udp

You probably mean: draft-parent-blanchet-ngtrans-tsp-teredo-00.txt ;)

Greets,
 Jeroen

---

From: Erik Nordmark <[email-masked]>
Date: Fri, 21 Feb 2003 16:29:05 +0100 (CET)

>   Those boxes will then forward any unrelated traffic to that default

That's nice for those that have control of the NAT box.
The Telco that provides me service at home provides me with a NAT box
that they control - and they are uninterested in doing anything special.
I can't bypass/replace the NAT box because it speaks some odd and probably
proprietary stuff on the other side (it's an ISDN line).

So I prefer solutions that don't have to rely on configuration in
the NAT box yet are simpler than Teredo.
 
  Erik

---

From: "Jeroen Massar" <[email-masked]>
Date: Fri, 21 Feb 2003 17:06:58 +0100

Erik Nordmark wrote:

> I can't bypass/replace the NAT box because it speaks some odd 
> and probably proprietary stuff on the other side (it's an ISDN line).
> 

Make a ssh/pptp/vtund/<fill in>/* tunnel to the outside and
route your packets over there. These mechanisms then ofcourse
should be supplied and supported by the Tunnel Broker in question.
So if we want a good deployment we need to support all of these
options (unfortunatly). Marc can you create such TSP drafts ?

Eg: draft-parent-blanchet-ngtrans-tsp-<application>-00.txt

Which means that an external application is needed for tunneling
the packets to the tunnel broker.

application ::= ssh|pptp|vtund|httptunnel|<fill in>

Some networks unfortunatly will want to avoid the possibility
of using them as a 'transit' service only, eg tunneling to a
friendly AS and then routing a own prefix over that, basically
only using the ISP's IP for the tunnel.

Sidenote:
IMHO you don't have a complete IPv4 internet connection
either as with your current setup you can't do most thing that
have an embedded IP in the packets (read: Netmeeting). Also
setting up your own SSH, apache, gameserver etc will not work :(
If I had a chance of ISP's in your situation I would surely
not go for them, I hate NAT's and I require at least one
public IPv4 thats completely unfiltered. In your current
situation they could have put you all their customers
behind a big rfc1918 subnet and NAT there too and that is
what I call localnet access (with an internet gate) and not
internet access.

Greets,
 Jeroen

---

From: "Jeroen Massar" <[email-masked]>
Date: Fri, 21 Feb 2003 17:20:05 +0100

Paul Timmins [mailto:[email-masked]] wrote:

> On Fri, 2003-02-21 at 10:29, Erik Nordmark wrote:
> I agree here as well. I've seen -alot- of firewalls that either block,
> or don't statefully forward proto-41. Even if they did, that 
> limits IPv6
> to one end user behind the NAT. If I was using this at a Mariott for
> example, they NAT the users of their in room ethernet. I'd be
> disappointed if someone else was using v6 tunneling in the hotel,
> because it means I couldn't (Assuming they forward proto-41 to begin
> with).

IMHO we should differentiate between places where the Network
Administrator
allows such activities and places where those activities are not
allowed. If the NetAdmin doesn't want to cooperate you got a big
problem which can only be solved by playing naughty sly old fox.

A rule of thumb is that as long as you are not in control of the
local infrastructure you are not the network administrator and
should abide by the policies which are laid upon you how freakish
they might be. You are a guest of the network...

Yes, I know that sounds bad and yes it will stop 'deployment' but
if you want IPv6 at that place you might better start talking to
the people administrating that network and educate them so next
time you are there they might have it for you as a bonus.

You should note that you are opening up the local network for a
firewall bypass. And that is not always a wanted situation.
You can protect yourself, but are you also protecting other people
eg if you announce a /64 with RA and then nicely route over the tunnel ?

Clued people can always make a hole in the network if they want
it or not, but non-clued people will just break things as they
are unaware of the implications that arise from it.

Also checking the subject, we where talking about "IPv6 Home Use",
in that case you usually are the 'owner' of the IPv4 endpoint...

Though for both problems a ssh/pptp and other tunneling solutions
could work out just as well, see the other message to Erik.

Greets,
 Jeroen

---

From: Erik Nordmark <[email-masked]>
Date: Fri, 21 Feb 2003 17:48:10 +0100 (CET)

> setting up your own SSH, apache, gameserver etc will not work :(

What, I thought the Internet = web page access :-) :-)

Tunneling IPv4 over UDP/IPv4 works just fine (with effectively
a static tunnel server at work). Not efficient but ...

But I want something less static with IPv6.

  Erik

---

From: Paul Timmins <[email-masked]>
Date: 21 Feb 2003 10:56:23 -0500

I agree here as well. I've seen -alot- of firewalls that either block,
or don't statefully forward proto-41. Even if they did, that limits IPv6
to one end user behind the NAT. If I was using this at a Mariott for
example, they NAT the users of their in room ethernet. I'd be
disappointed if someone else was using v6 tunneling in the hotel,
because it means I couldn't (Assuming they forward proto-41 to begin
with). With UDP tunneling, we could both have our own tunnels. I think a
limitation on how many machines behind a NAT can have a tunnel would
slow transition in places like this, because if I were offering
enterprise services over v6, and had my employees tunneling back to the
office, I'd be pretty upset if they couldn't get their job done because
another employee (or just another user, depending on the proto-41
forwarding implementation) has a tunnel open at the hotel at the same
time.

My 0.02.
-Paul

-- 
Paul Timmins
[email-masked] / http://www.timmins.net/
H: 313-586-9514 / C: 248-379-7826 / DC: 130*116*24495
AIM: noweb4u / Callsign: KC8QAY

---

From: "JORDI PALET MARTINEZ" <[email-masked]>
Date: Sat, 22 Feb 2003 01:10:28 +0100

Paul,

My experience is that if the NAT box is forwarding the proto-41, then is forwarded just as any other ICMP, UDP, or TCP, so is
reaching the appropriate host in the private network. That means that several tunnels can be setup w/o any problem.

Of course, the "manager" of the NAT box can setup a single tunnel for all proto-41 packets, but this is something out of our
control, specially in an hotel.

Regards,
Jordi

----- Original Message -----
From: "Paul Timmins" <[email-masked]>
To: "Erik Nordmark" <[email-masked]>
Cc: "Jeroen Massar" <[email-masked]>; "'Bound, Jim'" <[email-masked]>; "'JORDI PALET MARTINEZ'" <[email-masked]>;
<[email-masked]>; "'Alain Durand'" <[email-masked]>; <[email-masked]>
Sent: Friday, February 21, 2003 4:56 PM
Subject: RE: IPv6 Home Use to stimulate deployment over IPv4-NAT

> forwarding implementation) has a tunnel open at the hotel at the same

*********************************
Madrid 2003 Global IPv6 Summit
12-14 May 2003 - Pre-register at:
http://www.ipv6-es.com
Interested in participating or sponsoring ?
Contact us at [email-masked]