0

I'm trying to create a small gateway for a home project. I have a NODE, GATEWAY and EXTERNAL machine, running on a public IPv6 network. Though the NODE is not connected via ethernet, but my goal is to connect it to the IPv6 network, using the gateway. It communicates with the gateway through a radio (also IP, but using 64 bit addresses), which has it's own interface.

Using ip routes, i've been able to ping the EXTERNAL from my NODE, using the GATEWAY. Now my questions is: can I expose my node to the world, using NAT? I have a public IP for the NODE, so what I've done is adding this to the gateway: (All IP's are fake, ofc)

eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
    inet 123.222.23.2  netmask 255.255.255.0  broadcast 123.222.255.255
    inet6 2003:6g8:140:200:6a39:5021:83c4:fgbb  prefixlen 128  scopeid 0x0<global>
    inet6 fe80::c229:5c97:8b23:a3e5  prefixlen 64  scopeid 0x20<link>
    inet6 2003:6g8:140:200:1acc:42fd:1946:e2c1  prefixlen 64  scopeid 0x0<global>

And testing, then I can ping the both IP's from EXTERNAL, and the end up at the gatway. Now I'd like to redirect any traffic comming to the ip to my radio interface, and changing the destination IP.

Since I'm fairly new to iptables, I've kinda just tried. Setting up DNAT

sudo ip6tables -t nat -A PREROUTING -i eth0 -d 2003:6g8:140:200:6a39:5021:83c4:fgbb -j DNAT --to-destination fe80::160c:25ee:1de6:a52c

Where the last IP is the local address for the NODE. If I understand this correct, then all packets with the destination of that specific IP, would then get the local IP instead.

Then I allow forwarding

sudo ip6tables -A FORWARD -i  eth1 -j ACCEPT
sudo ip6tables -A FORWARD -o  radio0 -j ACCEPT

Then I create a static routing

sudo ip -6 route add fe80::160c:25ee:1de6:a52c dev radio0

But this does not seem to work. When I try to ping 2003:6g8:140:200:6a39:5021:83c4:fgbb they only make it to the gateway, and is not forwarded to the other interface.

What am I doing wrong?

Best regards

Benjamin Larsen
  • 101

1 Answers1

0

Firstly remember that there needs to be a route on the target device that will bring replies back to the NAT box.

Secondly link-local addresses are special. I don't know if the special rules surrounding link-local addresses will break a setup like this. In general if packets are going to cross a router they should be using regular (global or unique-local) addresses.

Peter Green
  • 4,056
  • 10
  • 29
  • That should be in place - all communications from the target node is actually working. I can even ping a public ipv6 somewhere in the world, and get an answer. The problem is, that I can't choose it's IP type, I'm forced to work with this link-local address. – Benjamin Larsen Nov 19 '17 at 13:10
  • I see that IP tables does it job, it's rewriting the source address, and in tshark I can see it actually tries to forward the ICMP-packet, but it does so on eth0 and not radio0. I even have a static route for that particular IP. I'm confused! – Benjamin Larsen Nov 19 '17 at 16:57