IPv6 Tunneling

IPv6 tunneling across IPv4 networks

Dual Stack runs IPv4 and IPv6 on the same devices. In this arrangement, the entire path between the source and destination must support both protocols. A host can select the address family from the destination address and its configuration, while routers forward the packet within the selected protocol family.

Operating condition: When IPv6 networks are connected through an IPv4-only backbone, an IPv6 packet cannot be forwarded by an IPv4 router as an ordinary packet. For example, offices in Warsaw and Krakow can run native IPv6 networks while the provider network between them supports only IPv4. The ingress and egress devices need access to both protocol families, while routers between them process only the outer IPv4 header.

Tunneling places the original packet inside a packet that the intermediate network supports. IPv4 routers forward the outer packet, and the tunnel endpoint removes the outer header. In IPv6 over IPv4, the outer header identifies the tunnel endpoints, while the inner header retains the IPv6 source and destination addresses.

Packet example: The ingress router receives an IPv6 packet for the Krakow network, adds an IPv4 header containing the tunnel endpoint addresses, and the egress router removes that header before forwarding the IPv6 packet. Tunneling by itself does not encrypt the payload. Confidentiality requires a separate mechanism, such as IPsec, configured for the relevant layer.

Tunneling as encapsulation

tunneling means encapsulation, placing an entire packet of one type, such as IPv6, inside the payload of another packet type, such as IPv4. Decapsulation restores the original packet for IPv6 forwarding. The tunnel creates a logical link between its endpoints, but it does not change the host addressing carried by the inner packet.

• The original packet (e.g., IPv6) is called the passenger protocol.
• The protocol of the network it's crossing (e.g., IPv4) is the carrier protocol.

The router at the edge of the first IPv6 network is the tunnel entry point (ingress) and encapsulates the packet. The router at the destination edge is the tunnel exit point (egress) and decapsulates it. The path between these points through the IPv4 network forms the tunnel. The endpoints must agree on the tunnel type, outer addresses, and routes for the inner IPv6 prefixes.

The tunneling process

The following example describes a single IPv6 packet from a client in the Warsaw office to a server in the Krakow office through an IPv4-only provider backbone. It separates the inner IPv6 communication from the outer IPv4 transport.

1. Step 1: Original IPv6 packet creation.

   A client computer in Warsaw (2001:db8:a::100) creates a standard IPv6 packet destined for a server in Krakow (2001:db8:b::200). The packet travels across the local Warsaw IPv6 network. These addresses identify the end-to-end communication and remain in the inner packet after the tunnel header is added.

2. Step 2: Encapsulation at the tunnel ingress.

   The packet reaches the edge router of the Warsaw office. This router is the tunnel's entry point. It recognizes that the destination is on another IPv6 network that must be reached through the IPv4 provider network. The router performs encapsulation:

   • It takes the entire IPv6 packet (header and payload) and treats it as a single chunk of data.
   • It creates a new IPv4 header. The source address identifies the tunnel interface of the Warsaw router, and the destination address identifies the tunnel interface of the Krakow router. In 6in4, the IPv4 Protocol field has value 41.
   • It places the IPv6 packet inside the payload of this new IPv4 packet. The additional outer header reduces the MTU available to the inner packet.
3. Step 3: Transit through the IPv4 network.

   The newly formed IPv4 packet is forwarded through the intermediate network. Its routers use the outer IPv4 header and do not process the inner IPv6 header. Their route lookup uses the IPv4 destination of the egress tunnel endpoint.

4. Step 4: Decapsulation at the tunnel egress.

   The IPv4 packet arrives at the edge router of the Krakow office, the tunnel's exit point.

   • The router recognizes that this IPv4 packet is a tunneled packet addressed to it.
   • It performs decapsulation: it strips away the IPv4 header and validates the inner packet.
   • This restores the original IPv6 packet, which is then forwarded using the IPv6 routing table.
5. Step 5: Final delivery.

   The Krakow router now has the original IPv6 packet. It examines the IPv6 destination address (2001:db8:b::200), sees that it is on its local IPv6 network, and forwards it to the correct server. The communication is complete.

IPv6 tunneling mechanisms

Tunneling mechanisms differ in how they configure endpoints and carry packets. A tunnel can be configured manually or created automatically from IPv4 and IPv6 addressing. Both approaches still require compatible routing and filtering at the endpoints.

Manual and static tunnels

An administrator configures a permanent point-to-point tunnel between two routers and enters the IPv4 addresses of both endpoints. The configuration also includes routes to the IPv6 prefixes on each side and parameters for the tunnel interface. This approach fits links between specific sites or a tunnel-broker service. A large set of changing endpoints requires repeated manual updates.
Use case: Stable, permanent links between specified sites or a connection to an IPv6 tunnel broker. A large set of dynamic endpoints requires automation.

Automatic tunnels

Automatic mechanisms derive tunnel endpoints from addresses or network configuration. They reduce the number of manually entered values, but the address plan, routing, and filtering rules must remain consistent along the path.

• 6to4 tunneling: This mechanism places the 32-bit IPv4 endpoint identifier in the IPv6 prefix 2002::/16, creating a site prefix in the form 2002:V4ADDR::/48. IPv6 packets are carried in IPv4 with protocol number 41. The mechanism requires a globally routable IPv4 address, and communication with native IPv6 requires a relay router. A change of the IPv4 address changes the embedded site prefix and therefore the related IPv6 addressing. These dependencies limit its use.

  6to4 Example:

  An edge router has the example IPv4 address 198.51.100.5. This documentation range is used only for the example; a 6to4 deployment requires a globally routable IPv4 address.
  1. Convert the IPv4 address to hexadecimal octets: C6.33.64.05.
  2. Join the octets: C633:6405.
  3. The 6to4 prefix for this site is 2002:C633:6405::/48.

• Teredo tunneling: This mechanism is intended for IPv6 hosts behind an IPv4 NAT device. It encapsulates IPv6 packets in UDP/IPv4 datagrams and uses Teredo servers and relays. The server helps a client obtain configuration and begin communication, while a relay forwards traffic between Teredo and native IPv6. UDP helps traverse some NAT devices, but it does not guarantee traversal through every NAT type.
  Traversal condition: Operation depends on the NAT behavior, filtering rules, and availability of a server or relay.
• ISATAP (Intra-Site Automatic Tunnel Addressing Protocol): Designed for use within an organization. It connects dual-stack nodes through an IPv4 network, treating that network as an IPv6 link and creating tunnels to an ISATAP router. The interface identifier can be derived from the IPv4 address used to identify a neighbor.

Tunneling: benefits and limitations