How do I connect to my NAT-ed IPv6 server?

4

1

Until recently I had a server running at home as a DMZ (all external traffic routed through to it) behind a cable router/modem. This worked well. Now, after my ISP went 100% IPv6 I am no longer able to connect to it.

I used to understand IPv4, network segments, etc, but I cannot "read" IPv6 in the same way so when I am now unable to ssh in I do not know why. Possibly because what I believe is the external IP might not be ...

I got the external IP address by going to whatismyip.org, which resulted in 2a01:79c:cebd:5bc:b0cc:d7d2:22d0:3369 showing on the screen. This was not done on the server (which is headless), but on another machine on the same network. As I heard something about IPv6 making it possible to directly connect to a machine behind a NAT without forwarding, this makes me suspicious that the IPv6 address I am seeing is not the IP of the router (which it normally would be in a IPv4 world), but the IPv6 address of the computer on the local network. I am probably way off here, but thought it might be worth mentioning.

Anyway, trying to connect to the web server running on the server was tried like this: curl http://[2a01:79c:cebd:5bc:b0cc:d7d2:22d0:3369]. I was unable to connect.

oligofren

Posted 2017-05-17T12:29:44.727

Reputation: 842

1Ask your provider for support. They should have a specific answer. It is more guesswork here. Besides that they do need to feel the pain they are causing. Cutting off home users from running server applications is often done deliberately to sell more expensive business plans. Not something they should get away with w/o an outcry. – eckes – 2017-05-18T05:15:19.477

Answers

5

As I heard something about IPv6 making it possible to directly connect to a machine behind a NAT without forwarding

Oh, so much unnecessary confusion. I'm sorry.

IPv6 essentially works the same as IPv4. Obviously there are some differences, like IPv6 using more bits per address.

For a while, DHCPv6 was not as developed as DHCP/IPv4. People were encouraged to use the Router Solicitation/Router Advertisements protocol instead. (I've seen this referred to as both RS and RA.) RS/RA never had much popularity on IPv4, perhaps primarily because DHCP/IPv4 was already pretty popular. With IPv6, a process called SLAAC uses RS and RA.

If you use SLAAC, some implementations require that you use /64 subnet sizes. This is a notable change from DHCP/IPv4 where numerous subnet sizes were supported, and different subnet sizes were used rather commonly.

With IPv6, an early standard specified that ISPs should give out at least /48 blocks. (Each /48 block had 2^16 /64 subnets, a.k.a. 16,384 /64 subnets.) This let people subnet. This basically eliminated the need to use NAT to help with minimizing the use of addresses, because people were getting so many addresses. This caused many people to proclaim that NAT wasn't needed.

The way to "get around the requirement to use NAT" was to set up IPv6 subnetting. However, "getting around the NAT requirement" is significantly different than "getting around NAT". It is possible to use NAT with IPv6, and have it technologically work in the exact same way that NAT with IPv4 works, with obvious differences like commonly having larger subnet sizes. The principles, though, will work the same.

this makes me suspicious that the IPv6 address I am seeing is not the IP of the router (which it normally would be in a IPv4 world), but the IPv6 address of the computer on the local network.

Yeah, that's possible. With IPv4, you can assign public IP addresses to your internal machines. This is commonly not done due to a lack of available public IPv4 addresses, but it can be set up. With IPv6, the common scenario is commonly to not have a lack of available public addresses, so this type of setup is more common with IPv6.

Still, your internal machine will have a default gateway, which is likely the router. Log into that router, and you can see routing tables.

You are using public IPv6 addresses. Private-use IPv6 addresses start with "fd" (just as private-use IPv4 addresses start with "192.168." or "172.16." through "172.31." or "10.") Addresses starting with "fe80:" are "link-local" addresses, similar to IPv4's "169.254." addresses but with some differences. (In IPv6, Seeing "fe80:" is a requirement; not seeing it is a problem. In contrast, seeing IPv4 "169.254." is often a problem.)

You might be able to find your server's address with NDP. e.g., in Microsoft Windows:

netsh interface ipv6 show neighbor

Other operating systems may use commands like ndp or ip -6 for showing IPv6 neighbors.

TOOGAM

Posted 2017-05-17T12:29:44.727

Reputation: 12 651

3

Normally, just enabling IPv6 won't affect IPv4. So I'm guessing you mean that your ISP has actually disabled native IPv4 connectivity (and went with CGNAT)?


Well, either way, first let's clarify what makes IPv6 different:

As I heard something about IPv6 making it possible to directly connect to a machine behind a NAT without forwarding, this makes me suspicious that the IPv6 address I am seeing is not the IP of the router (which it normally would be in a IPv4 world), but the IPv6 address of the computer on the local network.

The reason you don't need port forwarding is that you're not behind NAT anymore. Instead, in addition to its own global address, your router also obtains a full range (a /64 prefix) for use on the LAN, and each device has its own global address from that prefix. Your LAN range is 2a01:79c:cebd:5bc::/64, and every address from it is reachable externally.

So if you're trying to connect to the address shown by "whatismyip" on your computer, then you're in fact connecting to the same computer – if you want to find out the address of your server, you'll have to check it from that server. You don't actually need to visit a site – due to the address already being global, you can just get it from ip addr on Linux, or ifconfig on BSD, or ipconfig on Windows.

(In fact that's even better because many hosts self-configure multiple addresses – a persistent one, plus temporary addresses changed daily. Websites will show you the temporary address, but for incoming connections you definitely want the permanent one. The aforementioned commands will show you both.)


However, just because there is no "port forwarding" doesn't necessarily mean you won't need any router configuration anymore.

In IPv4, adding a "port forwarding" rule didn't merely set up NAT translation – it also opened up the firewall for that particular port. While NAT is no longer a concern in IPv6, you still have a firewall – and if your ISP had any sense of security, then that firewall still blocks incoming connections by default.

So if you have the right address but still can't connect, you might still need to access your router's configuration, find the firewall settings, and add a rule allowing incoming traffic to server_ip.


IPv4 and IPv6 really share most of the same concepts – routing is the same, subnets are the same, NAT is a thing, private address still exist, as TOOGAM has mentioned. The latter two are simply much less prevalent in IPv6 than in IPv4 (where they're used due to the shortage of addresses).

user1686

Posted 2017-05-17T12:29:44.727

Reputation: 283 655