ipv6 NAT support? about aif

[abelbeck]

If you are talking about NPTv6 (Network Prefix Translation) for IPv6, here is an AIF plugin the AstLinux project created:

https://github.com/astlinux-project/astlinux/tree/master/package/arnofw/net-prefix-translation

[nimbius]

Fascinating! I had considered NPT to have been abandoned some time ago. its a solution I hadnt considered. Thank you so much for this!!

[arnova]

@abelbeck : Can we integrate this into mainline AIF?

[abelbeck]

@arnova : We could include this into mainline AIF, but the problem this plugin solves can get somewhat complicated since the GUA prefix is often defined by some DHCPv6 client. The AstLinux project calls this plugins' status in the DHCPv6 client's action script to adapt to any changes in the DHCPv6-PD assignment:
https://github.com/astlinux-project/astlinux/blob/master/package/wide-dhcpv6/dhcp6c.script#L145

This plugin also uses the netcalc command, but I think that is commonly available, also around a 3.10.x or later kernel is needed for IPv6 NAT support.

But, understanding ULA's and GUA prefixes is not common knowledge until a person is forced to use them. @arnova it would be best if you had a use-case for this plugin so you can also understand the nuances.

Personal example:
My edge router runs AstLinux and I also run a network-failover AstLinux on a cloud Linode instance. My ISP supplies a /56 GUA prefix via DHCPv6-PD. All my internal IPv6 networks use a ULA prefix I generated. The Linode AstLinux connects on network-failover using WireGuard over 4G/LTE. The Linode instance has a static /56 GUA prefix (I had to request it via Linode support). Each AstLinux has the net-prefix-translation AIF plugin configured, the Linode AstLinux is simple since the GUA is static, the local AstLinux must extract the ISP assigned /56 GUA prefix via the net-prefix-translation AIF plugin.

This works great for me, when a network-failover occurs, IPv6 seamlessly works because of the edge NPTv6 to different GUA prefixes and no internal GUA's only ULA prefixes.

Additional note, my 4G/LTE is currently IPv4-only, but using WireGuard over it not only secures the traffic but also adds transport support for dual stack IPv4/IPv6 :-)

[arnova]

@abelbeck : Thanks for the explanation. The problem is that I still don't have a full IPv6 environment I can test things with. So testing something like this is a bit of a problem. Also my knowledge about these (exotic?) IPv6 things is rather limited.