In less than 230 days, no more new IPv4 blocks will be available. Despite the fact that many IP operators have already deployed IPv6 on their backbones, native IPv6 connectivity is taking a long time to reach end users. Limited native IPv6 availability does not encourage content providers to migrate their services to a dual IPv4/IPv6 stack. In this context, an IPv6 tunnel appears to be an ideal transition solution that is cheap and easy to deploy.

In this article, we are going to configure a FreeBSD machine to use a tunnel to provide safe IPv6 connectivity to local network computers.

Typology

We are going to use a FreeBSD 8.1 machine with a single NIC (em0), connected to our local area network. IPv4 connectivity is provided via a virtual interface (vlan1), whos parent interface is em0.

Basic tunnel configuration

There are several IPv6 tunnel providers. We are going to use the Hurricane Electric Tunnelbroker service because it offers several useful options such as RDNS delegation and multiple subnet allocation.

Start by creating an account on HE's website.

Choose "Create Regular Tunnel" and enter your (static) IPv4 address. You can now create a routed /64 prefix and generate the configuration file for many OS's, including FreeBSD. In this example we'll assume that your public IP is 85.1.2.3 and that your alloted /64 is 2001:11:22:33::/64.

Enter the following commands (after changing the various IP addresses):



Ifconfig can be used to verify the tunnel has been created:



Finally, use the ping6 command to check the tunnel is working:



If the ping command does not work and you are using a firewall on your gateway, you might need to configure it to allow tunneled IP traffic. Here's an example using PF to allow the tunnel (replace 216.66.84.42 with the IP of your tunnel's endpoint):



Assuming this part works, let's move on to providing IPv6 connectivity to your local network.

Subnet routing

Open the Tunnelbroker interface again and allocate a routed /48; we'll use a smaller /64 subnet from this /48 to connect the local network. In this example we'll assume the alloted /48 subnet is 2001:44:55::/48 and that the /64 "LAN" subnet is 2001:44:55:1::/64.

Start by configuring an IP from the "LAN" subnet on the em0 interface::



To activate kernel routing between the "LAN" subnet and the "WAN" subnet, you will need to enable IP forwarding:



To check everything is working correctly, manually configure an IPv6 address (for example 2001:44:55:1::2) on a computer connected to the "LAN" network and use the traceroute command:



We can see the IP of the router (2001:44:55:1::1), and after that, the IP on the endpoint (2001:11:22:33::1).

IPv6 filtering with PF

By now you should have a operational routed IPv6 network. However, it cannot be considered 'safe' as all IP addresses are public and no IP filtering is occuring. To rectify this, we shall use PF to provide router-level filtering. To make this example as clear as possible, only rules associated with the IPv6 tunnel are listed in the example below:



This configuration denies all incoming traffic except ICMP, Web to "macmini_v6" and SSH to "ext_server". ICMP, TCP and UDP outgoing traffic is allowed.

Autoconf

One of the very useful features of IPv6 is auto-configuration that allows machines to receive static IPs without the use of DHCP, thanks to the MAC addresses of their network cards. FreeBSD provides this feature using the router advertisement daemon or rtadvd. To configure it, edit rc.conf and rtadvd.conf :

/etc/rc.conf


/etc/rtadvd.conf


Start the rtadvd daemon to enable IPv6 autoconf.

Automatic starting of services

So that everything starts automatically with the system, we'll add some stuff to rc.conf :

rc.conf


Next time you reboot the machine, everything should start automatically.

Conclusion

Using a tunnelbroker service, it is fairly simple to deploy a transition IPv6 network, until more durable solutions come along (like native IPv6).

Changelog

- 20th October 2010: first version