Last week I got a software update for my VDSL Router at home which included IPv6 functionality. Very nice, so finally I could finally get some hands-on IPv6 experience. Here are some of my findings of this exercise:
6to4 Tunnel Setup on the VDSL Router
As my network provider does not yet offer IPv6 natively, I decided to activate the IPv6 6to4 tunnel option on the VDSL router which then gets an IPv6 address space and redistributes that into the local network. Each device in my home network that is IPv6 capable can then assign itself a public IPv6 address out of that pool. Very easy to set up with nothing but to configure the router and then let my Windows 7 and Ubuntu machines grab IPv6 addresses automatically.
IPv6 Firewalling
As the local machines now have public IPv6 addresses they can be reached by any outside node. As this might be a security risk, the VDSL router also has a built in IPv6 firewall and any unsolicited incoming IPv6 packets are discarded unless allowed via a configuration table. In effect, this is a similar scheme as the individual incoming port forwarding of traditional IPv4 NAT (Network Address Translation) but with fewer potential application issues, as IP addresses and TCP/UDP ports don’t have to be mapped.
Allow IPv6 use in Firefox again
You might remember that some time ago, I wrote a post of how to disable IPv6 DNS support in Firefox to speed up web loading times. For details see here. Obviously, that this needs to be disabled again when you have real IPv6 connectivity and want to make use of it.
Ubuntu – Activate IPv6 Privacy Extensions
Strangely enough unlike Windows 7, Ubuntu doesn’t have the IPv6 privacy extensions enabled by default. With the feature, the host part of the IPv6 address is changed regularly to ensure that a particular device can’t be identified over days based on the IP address. To enable the feature, the following to lines need to be added to /etc/sysctl.conf to activate it for the Wi-Fi (wlan0) interface:
net.ipv6.conf.default.use_tempaddr=2
net.ipv6.conf.wlan0.use_tempaddr=2
To see the privacy extensions in action, i.e. to verify that the interface has now several global IPv6 addresses the “ip -6 addr” command is quite helpful.
Ubuntu – Prefer an IPv6 address of a 6to4 tunnel over IPv4
Another thing that stands in the way of is that IPv6 addresses generated out of 6to4 tunnels are recognizable by hosts. This means that in case a website offers both IPv4 and IPv6 connectivity, IPv4 will be preferred by the operating system. This makes sense as the IPv6 packet is tunneled and hence performance with IPv4, which is not tunneled, is likely to be better. However, there is a way to change this preference and make IPv6 addresses of 6to4 tunnels preferable to IPv4 addresses. This is done by uncommeting following lines in /etc/gai.conf:
label ::1/128 0
label ::/0 1
#label 2002::/16 2
label ::/96 3
label ::ffff:0:0/96 4
label fec0::/10 5
label fc00::/7 6
label 2001:0::/32 7
Ensure that the label for 2002:: remains commented! Afterwards, a reboot is required. For details see RFC 3484 chapter 2.1 (Policy Table).
Windows – Prefer an IPv6 address of a 6to4 tunnel over IPv4
The same preference of IPv4 over 4to6 IPv6 applies to Windows 7 as well. Here’s how to change it via an admin comannd line here:
1. Start -> Run -> “cmd” -> “netsh” -> “interface” -> “ipv6”
2. To set IPv6 (6to4) as the default protocol on Microsoft Windows…set prefix 2002::/16 30 1
–> Only the 2002::/16 line (6to4 prefix policy) is changed.3. To make things goes back to original mode (IPv4 preference)…
set prefix 2002::/16 30 2
Firefox Add-On to Show IPv6 in Action
The best way to monitor IPv6 in action is of course to use Wireshark. But in case it is not running all the time while you experiment and you just want to know when IPv6 is used while web browsing, the “ShowIP” add-on for Firefox is most helpful as it shows the IPv4 or IPv6 address from which the current web page was delivered.
There you go, hope you’ll find this helpful. And for a general introduction on IPv6, I’ve written a 4 piece intro some time ago. For deatils see here, here, here and here.