2 .\" $KAME: stf.4,v 1.35 2001/05/02 06:24:49 itojun Exp $
4 .\" Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
5 .\" All rights reserved.
7 .\" Redistribution and use in source and binary forms, with or without
8 .\" modification, are permitted provided that the following conditions
10 .\" 1. Redistributions of source code must retain the above copyright
11 .\" notice, this list of conditions and the following disclaimer.
12 .\" 2. Redistributions in binary form must reproduce the above copyright
13 .\" notice, this list of conditions and the following disclaimer in the
14 .\" documentation and/or other materials provided with the distribution.
15 .\" 3. Neither the name of the project nor the names of its contributors
16 .\" may be used to endorse or promote products derived from this software
17 .\" without specific prior written permission.
19 .\" THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
20 .\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
21 .\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
22 .\" ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
23 .\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
24 .\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
25 .\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
26 .\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
27 .\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
28 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
46 IPv6 in IPv4 encapsulation.
47 It can tunnel IPv6 traffic over IPv4, as specified in
50 For ordinary nodes in 6to4 site, you do not need
55 interface is necessary for site border router
58 in the specification).
62 interface is created at runtime using interface cloning.
64 most easily done with the
72 Due to the way 6to4 protocol is specified,
74 interface requires certain configuration to work properly.
77 valid 6to4 address needs to be configured to the interface.
78 .Dq A valid 6to4 address
79 is an address which has the following properties.
80 If any of the following properties are not satisfied,
82 raises runtime error on packet transmission.
83 Read the specification for more details.
87 .Li 2002:xxyy:zzuu::/48
90 is a hexadecimal notation of an IPv4 address for the node.
91 IPv4 address can be taken from any of interfaces your node has.
92 Since the specification forbids the use of IPv4 private address,
93 the address needs to be a global IPv4 address.
95 Subnet identifier portion
97 and interface identifier portion
99 are properly filled to avoid address collisions.
102 If you would like the node to behave as a relay router,
103 the prefix length for the IPv6 interface address needs to be 16 so that
104 the node would consider any 6to4 destination as
106 If you would like to restrict 6to4 peers to be inside certain IPv4 prefix,
107 you may want to configure IPv6 prefix length as
108 .Dq 16 + IPv4 prefix length .
110 interface will check the IPv4 source address on packets,
111 if the IPv6 prefix length is larger than 16.
114 can be configured to be ECN friendly.
115 This can be configured by
121 Please note that 6to4 specification is written as
122 .Dq accept tunnelled packet from everyone
126 device, you are making it much easier for malicious parties to inject
127 fabricated IPv6 packet to your node.
128 Also, malicious party can inject an IPv6 packet with fabricated source address
129 to make your node generate improper tunnelled packet.
130 Administrators must take caution when enabling the interface.
131 To prevent possible attacks,
133 interface filters out the following packets.
134 Note that the checks are no way complete:
137 Packets with IPv4 unspecified address as outer IPv4 source/destination
140 Packets with loopback address as outer IPv4 source/destination
143 Packets with IPv4 multicast address as outer IPv4 source/destination
146 Packets with limited broadcast address as outer IPv4 source/destination
149 Packets with private address as outer IPv4 source/destination
150 .Pq Li 10.0.0.0/8 , 172.16.0.0/12 , 192.168.0.0/16
152 Packets with subnet broadcast address as outer IPv4 source/destination.
153 The check is made against subnet broadcast addresses for
154 all of the directly connected subnets.
156 Packets that does not pass ingress filtering.
157 Outer IPv4 source address must meet the IPv4 topology on the routing table.
158 Ingress filter can be turned off by
162 The same set of rules are applied against the IPv4 address embedded into
163 inner IPv6 address, if the IPv6 address matches 6to4 prefix.
166 It is recommended to filter/audit
167 incoming IPv4 packet with IP protocol number 41, as necessary.
168 It is also recommended to filter/audit encapsulated IPv6 packets as well.
169 You may also want to run normal ingress filter against inner IPv6 address
176 interface, it is possible to disable the input path,
177 making the direct attacks from the outside impossible.
178 Note, however, there are other security risks exist.
179 If you wish to use the configuration,
180 you must not advertise your 6to4 address to others.
187 written in hexadecimals.
189 # ifconfig ne0 inet 133.4.5.6 netmask 0xffffff00
190 # ifconfig stf0 inet6 2002:8504:0506:0000:a00:5aff:fe38:6f86 \\
194 The following configuration accepts packets from IPv4 source
197 It emits 6to4 packet only for IPv6 destination 2002:0901::/32
198 (IPv4 destination will match
201 # ifconfig ne0 inet 9.1.2.3 netmask 0xffff0000
202 # ifconfig stf0 inet6 2002:0901:0203:0000:a00:5aff:fe38:6f86 \\
206 The following configuration uses the
208 interface as an output-only device.
209 You need to have alternative IPv6 connectivity
211 to use this configuration.
212 For outbound traffic, you can reach other 6to4 networks efficiently via
214 For inbound traffic, you will not receive any 6to4-tunneled packets
215 (less security drawbacks).
216 Be careful not to advertise your 6to4 prefix to others
217 .Pq Li 2002:8504:0506::/48 ,
218 and not to use your 6to4 prefix as a source.
220 # ifconfig ne0 inet 133.4.5.6 netmask 0xffffff00
221 # ifconfig stf0 inet6 2002:8504:0506:0000:a00:5aff:fe38:6f86 \\
222 prefixlen 16 alias deprecated link0
223 # route add -inet6 2002:: -prefixlen 16 ::1
224 # route change -inet6 2002:: -prefixlen 16 ::1 -ifp stf0
232 .Pa http://www.6bone.net/6bone_6to4.html
236 .%T "Connection of IPv6 Domains via IPv4 Clouds"
242 .%A Jun-ichiro itojun Hagino
243 .%T "Possible abuse against IPv6 transition technologies"
245 .%N draft-itojun-ipv6-transition-abuse-01.txt
252 device first appeared in WIDE/KAME IPv6 stack.
257 interface is allowed for a node,
258 and no more than one IPv6 interface address is allowed for an
261 It is to avoid source address selection conflicts
262 between IPv6 layer and IPv4 layer,
263 and to cope with ingress filtering rule on the other side.
264 This is a feature to make
266 work right for all occasions.