1. Types of tunnels

There are more than one possibility to tunnel IPv6 packets over IPv4-only links.

1.1. Static point-to-point tunneling

A point-to-point tunnel is a dedicated tunnel to an endpoint, which knows about your IPv6 network (for backward routing) and the IPv4 address of your tunnel endpoint and defined in RFC 4213 / Basic Transition Mechanisms for IPv6 Hosts and Routers. Requirements:

  • IPv4 address of your local tunnel endpoint must be static, global unique and reachable from the foreign tunnel endpoint

    • If no static IPv4 address is available, the tunnel provider must support authentication of the dynamic IPv4 address, like SixXS / AICCU (3740/udp) or gogo6 (3653/udp).

  • A global IPv6 prefix assigned to you

    • It is also possible that additional IPv6 networks are routed through this tunnel.

  • A foreign tunnel endpoint which is capable to route your IPv6 prefix to your local tunnel endpoint (mostly remote manual configuration required)

Tunnel provider for static point-to-point tunneling:

1.2. Automatically tunneling

Automatic tunneling occurs, when a node directly connects another node gotten the IPv4 address of the other node before.

1.3. 6to4-Tunneling

6to4 tunneling (RFC 3056 / Connection of IPv6 Domains via IPv4 Clouds) uses a simple mechanism to create automatic tunnels. Each node with a global unique IPv4 address is able to be a 6to4 tunnel endpoint (if no IPv4 firewall prohibits traffic). 6to4 tunneling is mostly not a one-to-one tunnel. This case of tunneling can be divided into upstream and downstream tunneling. Also, a special IPv6 address indicates that this node will use 6to4 tunneling for connecting the world-wide IPv6 network

1.3.1. Generation of 6to4 prefix

The 6to4 address is defined like following (schema is taken from RFC 3056 / Connection of IPv6 Domains via IPv4 Clouds):

|   3+13   |    32     |    16  |            64 bits             | 
+---+------+-----------+--------+--------------------------------+ 
|  FP+TLA  |  V4ADDR   | SLA ID |           Interface ID         | 
|  0x2002  |           |        |                                | 
+---+------+-----------+--------+--------------------------------+

FP and TLA together (16 bits) have the value 0x2002. V4ADDR is the node's global unique IPv4 address (in hexadecimal notation). SLA is the subnet identifier (65536 local subnets possible) and are usable to represent your local network structure.

For gateways, such prefix is generated by normally using SLA ”0000” and suffix ”::1” (not a must, can be an arbitrary one with local-scope) and assigned to the 6to4 tunnel interface. Note that Microsoft Windows uses V4ADDR also for suffix.

1.3.2. 6to4 upstream tunneling

The node has to know to which foreign tunnel endpoint its in IPv4 packed IPv6 packets should be send to. In ”early” days of 6to4 tunneling, dedicated upstream accepting routers were defined. See NSayer's 6to4 information for a list of routers.

Nowadays, 6to4 upstream routers can be found auto-magically using the anycast address 192.88.99.1. In the background routing protocols handle this, see RFC 3068 / An Anycast Prefix for 6to4 Relay Routers for details.

1.3.3. 6to4 downstream tunneling

The downstream (IPv6 backbone -> your 6to4 enabled node) is not really fix and can vary from foreign host which originated packets were send to. There exist two possibilities:

  • Foreign host uses 6to4 and sends packet direct back to your node (see below)

  • Foreign host sends packets back to the world-wide IPv6 network and depending on the dynamic routing a relay router of an ISP which announces 2002::/16 via BGP will create a automatic tunnel back to your node.

1.3.4. Possible 6to4 traffic

  • from 6to4 to 6to4: is normally directly tunneled between the both 6to4 enabled hosts

  • from 6to4 to non-6to4: is sent via upstream tunneling

  • non-6to4 to 6to4: is sent via downstream tunneling

Note, that because of possible asymmetric routing problems with a broken 6to4 relay can be hard to troubleshoot.

1.4. UDP encapsulated IPv6 tunneling

UDP encapsulated IPv6 tunneling is usally used if no global IPv4 address is available on the internal endpoint, but using Network Adress Translation (NAT) it can still reach related endpoints using UDP ports described below.

1.4.1. Teredo Tunnel

RFC 4380 / Teredo: Tunneling IPv6 over UDP through Network Address Translationsdescribes tunneling of IPv6 packets via IPv4 UDP bubbles, see also Wikipedia / Teredo. It uses usually 3544/udp. Linux client is named miredo and usable out-of-the-box. This tunnel method can only connect a single client to the global IPv6 network..

1.4.2. AYIYA Tunnel

Tunnel provider SixXS has also IPv6-in-UDP-in-IPv4 (5072/udp) capability, for using it, the AYIYA mode must be enabled.

1.4.3. gogo6 Tunnel

Tunnel provider gogo6 has also IPv6-in-UDP-in-IPv4 (3653/udp) capability, for using it, the v6udpv4 mode must be enabled.