IPv6-only LAN with dual-stack OpenWRT router

I've managed to set up IPv6-only LAN behind a dual-stack OpenWRT router (not a Rocket Science, set up radvd on a router and don't configure IPv4 on LAN hosts). But I want to access IPv4-only hosts from this network and maybe provide services for these IPv4-only hosts.

First of all I'd like to thank Hurricane Electric for their amazing services, Jonathan McCrohan who made me write this howto and OpenWRT Team for their router software.

It's dangerous to go alone. Tayga, I choose you!

Tayga provides simple NAT64 service, it's good enough for small network.

First, install tayga package on your router (it is available from OpenWRT packages repository, be sure to use revision 30582 or later).

Next, configure NAT64 interface:

# /etc/config/network
config 'interface' 'nat64'
        option 'proto' 'tayga'
        option ipv4_addr 192.0.2.1
        option ipv6_addr 2001:470:1f09:xxxx::7f00:1
        option prefix 64:ff9b::/96
        option dynamic_pool 192.0.2.0/24
        option accept_ra 0
        option send_rs 0

where 2001:470:1f09:xxxx::/64 is IPv6 prefix used in my LAN, 192.0.2.0/24 is tayga's prefix for 4-to-6 mappings and 64:ff9b::/96 is the prefix I chose for IPv6-mapped IPv4 addresses.

It is safe to add nat64 to lan firewall zone since you need to explicitly NAT44 packets for 4-to-6 inbound connections:

# /etc/config/firewall
config 'zone'
        option 'name' 'lan'
        option 'input' 'ACCEPT'
        option 'output' 'ACCEPT'
        option 'forward' 'ACCEPT'
        option 'network' 'lan nat64'

Let's try it (ifup nat64 interface and apply new firewall rules):

# ping6 -c3 64:ff9b::194.87.0.50
PING 64:ff9b::194.87.0.50(64:ff9b::c257:32) 56 data bytes
64 bytes from 64:ff9b::c257:32: icmp_seq=1 ttl=56 time=3.42 ms
64 bytes from 64:ff9b::c257:32: icmp_seq=2 ttl=56 time=3.35 ms
64 bytes from 64:ff9b::c257:32: icmp_seq=3 ttl=56 time=4.04 ms

--- 64:ff9b::194.87.0.50 ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2040ms
rtt min/avg/max/mdev = 3.354/3.610/4.049/0.319 ms

It's super effective!

So if a stranger calls you / Don't let him whisper his name / 'Cause it's Voodoo, oh!

Now we need a source for AAAA records for hosts that only have A's. This is called DNS64 and is supported by bind version 9.8.0 and up. It is also available from OpenWRT packages repository.

I've modified default named.conf:

# /etc/bind/named.conf
acl rfc1918 { 10/8; 192.168/16; 172.16/12; };

options {
        directory "/tmp";

        auth-nxdomain no;    # conform to RFC1035

        allow-query { localnets; localhost; };

        listen-on { any; };

        listen-on-v6 { any; };

        dns64 64:ff9b::/96 {
                clients { any; };
                mapped { !rfc1918; any; };
                exclude { 64:ff9b::/96; ::ffff:0000:0000/96; };
                suffix ::;
        };

        edns-udp-size 512;
        max-udp-size 512;
};

// prime the server with knowledge of the root servers
zone "." {
        type hint;
        file "/etc/bind/db.root";
};

// be authoritative for the localhost forward and reverse zones, and for
// broadcast zones as per RFC 1912

zone "localhost" {
        type master;
        file "/etc/bind/db.local";
};

zone "127.in-addr.arpa" {
        type master;
        file "/etc/bind/db.127";
};

zone "0.in-addr.arpa" {
        type master;
        file "/etc/bind/db.0";
};

zone "255.in-addr.arpa" {
        type master;
        file "/etc/bind/db.255";
};

All hosts in LAN uses this bind as nameserver (announced via radvd and processed by dnssd). Let's try:

$ host www.ru
www.ru has address 194.87.0.50
www.ru has IPv6 address 64:ff9b::c257:32
www.ru mail is handled by 5 hq.demos.ru.

$ host 194.87.0.50
50.0.87.194.in-addr.arpa domain name pointer www.ru.

$ host 64:ff9b::c257:32
2.3.0.0.7.5.2.c.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.b.9.f.f.4.6.0.0.ip6.arpa is an alias for 50.0.87.194.in-addr.arpa.
50.0.87.194.in-addr.arpa domain name pointer www.ru.

Cry me a river, you'll learn Voodoo!!

Close the city and tell the people that something's coming to call.

So what about giving IPv4 hosts access to services in my IPv6-olny network? It's easy, just need to configure NAT44 to an address from tayga's dynamic pool:

# /etc/config/firewall

# rule for tayga to create static mapping
config 'nat64'
        option 'ipv4_addr' '192.0.2.32'
        option 'ipv6_addr' '2001:470:1f09::xxxx::yyyy:zzzz'

# rule for OpenWRT firewall to redirect traffic on port 25
config 'redirect'
        option 'src' 'wan'
        option 'proto' 'tcp'
        option 'src_dport' '25'
        option 'dest_ip' '192.0.2.32'
        option 'target' 'DNAT'
        option 'dest' 'lan'

# rule OpenWRT firewall to permit access to port 25 to LAN host
config 'rule'
        option 'target' 'ACCEPT'
        option 'src' 'wan'
        option 'dest' 'lan'
        option 'proto' 'tcp'
        option 'dest_ip' '2001:470:1f09:xxxx::yyyy:zzzz'
        option 'dest_port' '25'
        option 'family' 'ipv6'

Last rule is only needed to provide access to my SMTP service via native IPv6. Since nat64 interface belongs to lan firewall zone there's no need to premit traffic from 64:ff9b::/64, it is already done by permitting traffic to 192.0.2.32 (processed by redirect rule).

An now we can see some dirty spammers in maillog:

Feb 17 12:23:31 hell postfix/smtpd[12288]: connect from 114-42-157-193.dynamic.hinet.net[64:ff9b::722a:9dc1]
Feb 17 12:23:31 hell postfix/smtpd[12288]: warning: non-SMTP command from 114-42-157-193.dynamic.hinet.net[64:ff9b::722a:9dc1]: GET http://www.scanproxy.com:80/p-25.html HTTP/1.0

The Mob Rules!