合宿ネットワークにおけるipv6 only...

17
WIDE Technical-Report in 2014 合宿ネットワークにおける IPv6 only 化実験 wide-tr-camp1409-v6-experiment-00.pdf PROJECT WIDE Project : http://www.wide.ad.jp/ If you have any comments on WIDE documents, please contact to [email protected]

Upload: others

Post on 28-May-2020

0 views

Category:

Documents


0 download

TRANSCRIPT

  • WIDE Technical-Report in 2014

    合宿ネットワークにおける IPv6only 化実験

    wide-tr-camp1409-v6-experiment-00.pdf

    PROJECT

    WIDE Project : http://www.wide.ad.jp/

    If you have any comments on WIDE documents, please contact [email protected]

  • Title: 合宿ネットワークにおける IPv6 only 化実験Author(s): 櫨 山 寛 章 ([email protected]), 田 川 真 樹

    ([email protected]), 石 原 知 洋 ([email protected]),垣内正年 ([email protected])

    Date: 2014-09-23

  • IPv6 only

    ([email protected]) ([email protected])

    ([email protected]) ([email protected])

    2014 9 19

    1

    World IPv6 day World IPv6 Launch

    IPv6

    IPv6 6

    2011 5

    IPv6

    IPv6 IPv4

    IPv4/IPv6

    OS

    IPv4/IPv6

    2011 9 WIDE

    DNS64, NAT64, DHCPv6

    IPv6

    IPv6 only

    IPv6 only “

    ” [1] IPv6

    only

    20 OS IPv6 only

    IPv4

    IPv6

    OS VPN

    IPv6

    IPv4

    Android OS

    IPv4 LAN

    DNS IPv4

    OS IPv6

    2011 9 WIDE

    IPv4 over IPv6 murakami-

    4RD [2] IPv4

    IPv4/IPv6

    WIDE

    murakami-4RD IETF softwire WG

    MAP-E MAP-E JANOG

    Interop Tokyo

    2014 9 MAP-E

    RFC Publication

    Requested [3]

    MAP-E

    2011 9 WIDE 2013 3

    WIDE

    464

    DNS64/NAT64

    Georgescu 464

    [4] live-with-ipv6 WG

    DNS64/NAT64 IPv4 Address Literal

    DNS

    [5]

    3

    DNS64/NAT64

    2014 9 WIDE

    2011 9

    WIDE IPv6 only

    IPv6 HappyEyeball

    2011 3 3

    live-with-ipv6 WG NTT Advanced

    Technology NTT-AT

    DNS64/NAT64

    1

  • rtr-seilIIJ

    modem.ipstar IPSTAR

    WIDE CAMP 1409 (L3)2014. 9. 7 rev.10

    IPv4 Prefix IPv6 Prefix

    >100 : mgmt 172.16.10.0/24 hoge:ff10::/64110 : mgmt-aruba 172.16.11.0/24 hoge:ff11::/64>200 : flets - -210 : ipstar-nat44 - ->300 : server 172.16.30.0/24 hoge:ff30::/64> 700 : life-nat64 172.16.70.0/24 hoge:ff70::/64710 : life-nat64-1x 172.16.71.0/24 hoge:ff71::/64 720 : life-nat64-sunset4 - hoge:ff72::/64 790 : life-lastresort 172.16.79.0/24 -

    172.16.0.0/16 hoge:ff00::/56VLAN ID (NAME)

    aruba

    v110 mgmt-aruba ap 01-14

    InternetIIJ

    v790 life-lastresort -172.16.79.0/24

    v720 life-nat64-sunset4 -hoge:ff72::/64

    v710 life-nat64-1x -172.16.71.0/24, hoge:ff71::/64

    v700 life-net64 -172.16.70.0/24, hoge:ff70::/64

    v300 server -172.16.30.0/24, hoge:ff30::/64

    -172.16.11.0/24, hoge:ff11::/64

    *hoge は Flets の DHCP-PD から割り当てられるプレフィックス

    v200 flets-

    v210 ipstar-nat44-

    v100 mgmt-172.16.10.0/24, hoge:ff10::/64

    Kobe Institute of Computing

    JSAT

    IPStar

    IPStar

    1: 3

    HappyEyeball A Record Filter [6]

    NTT-AT

    IPv6

    2011 9 WIDE

    wlanops WG 802.1x

    LAN

    live-with-ipv6 WG DNS64/NAT64

    2

    3

    4

    200

    1 1

    112

    9

    7

    5

    6

    14

    LAN 0

    LAN 1

    juniper6.naraNAIST B108

    intertrackNAIST A308

    rtr-seilIIJ

    nat64-pf

    dns-auth

    dns64

    onu

    bigip

    700,710,720,790

    100,110

    100,11

    0,300,

    700,72

    0,790

    300

    300

    300

    all

    VLAN ID(NAME)

    100 mgmt110 mgmt-aruba

    210 ipstar-nat44

    300 server

    700 life-nat64710 life-nat64-1x720 life-nat64-sunset4730 life-lastresort790 life-lastresort

    890 NAIST-CAMP

    172.16.0.0/12

    172.16.10.0/24 172.16.11.0/24

    172.16.30.0/24

    172.16.70.0/24 172.16.71.0/24

    172.16.73.0/24 172.16.79.0/24

    203.178.156.0/22

    2409:12:6080:110::/64

    2409:12:6080:130::/64

    2409:12:6080:170::/64 2409:12:6080:171::/64 2409:12:6080:172::/64

    WIDE BBDojima IIJ

    onu

    router

    server

    balancer controller

    switch

    ap

    poe

    mirror

    peerapp

    natpoolnat64-pf 203.178.156.64/28

    bigip 203.178.156.80/28

    8

    10

    aruba-ctlAruba

    sorオリオスペック

    adsmac pro

    icocaIntel

    kato-lab

    WIDECAMP1409L2 rev10

    2 1

    NAIST

    MatsusiroRoyal Hotel

    KIC

    13-141

    10

    11-141

    10

    11-14

    11-14

    sw-esidePanasonic

    sw-plenaryAllide telesis

    sw-bofHitachi cable

    100,110,200,210

    100,110,200

    100,

    110,

    200,

    210,

    300,

    700,

    720,

    790

    poe-03

    poe-01 poe-02

    poe-04

    ap-03

    ap-06ap-07

    ap-08ap-01ap-02

    ap-09

    ap-10ap-11

    ap-12

    ap-13

    ap-14ap-15

    ap-17

    sw-noccisco

    IPStar

    011

    peerup

    2: 1, 2

    2.1 3

    1 3

    1 VLAN

    IIJ

    SEIL IPoE IIJ

    DHCP-PD client /56 IPv6

    IPv4 PPPoE NAT44

    IPStar IPv4

    Aruba SSID 5 LAN

    • camp1409-nat64 : DNS64/NAT642 hidden

    • camp1409-nat64-1x : DNS64/NAT64802.1x

    • camp1409-nat64-sunset4 : DNS64/NAT64ProxyARP sunset4

    • camp1409-ipstar : IPStar IPv4only

    • camp1409-lastresort : SEIL IPv4 PPPoENAT44 IPv4 only

    hidden IPv4

    2

  • 2.2 1 2

    2 VLAN

    IPv6

    DNS64 NAT64 DNS64/NAT64

    WIDE Nara NOC

    BIND

    DNS64 DNS A Record Filter 3

    KVM NAT64

    OpenBSD Packet Filter

    NTT-AT BIG-IP LTM/GTM Vir-

    tual Edition on KVM Hypervisor DNS64/NAT64

    BIG-IP

    DNS64/NAT64

    PeerApp UltraBand SEIL

    VLAN

    ONU SEIL VLAN 200

    sw-noc cisco catalyst 3750 SEIL

    SEIL DHCP4, DHCP6, DNS

    Forwarder . icoca NTP

    SYSLOG BIND DNS forwarder

    SNMP

    IIJ

    delegate IPv6

    DNS

    camp1409-lastresort (vlan 730,790) IPv4

    VLAN SEIL DNS forwarder

    DHCP4 IPv4

    SEIL default gateway

    DHCP4

    IPv4 1.1.1.1 192.0.2.1 DHCP4

    VPN

    Cliant

    SEILSEISE

    Fo

    IEI

    FFoooor

    IL

    ooooooorrrrrrrrrrrrrwarder)

    BIGIG-GGGGGGGG-IPBIIGG IIPP

    (DNS64)

    NAIST NAIST

    DNS

    IPv6:53

    IPv4:53

    IPv6 only backbone

    IPv4 (DHCP4)

    IPv6 (RA + DHCP6)

    IPv6:53

    IPv6:53

    IPv6:53

    3: DNS 1

    1: when DNS_RESPONSE {2: set prefix "2001:200:0:ff00:64:1:"3: set rrs [DNS::answer]4: if { [DNS::question type] equals "ANY" } {5: foreach rr $rrs {6: if { [DNS::type $rr] equals "A" } {7: log local0. "A Record is \[ $rr \]"8: set a_addr [getfield $rr "A" 2]9: DNS::answer remove $rr

    10: DNS::answer insert "[DNS::question name]. 111[DNS::question class] AAAA $prefix[format %02x[lindex [split $a_addr .] 0]][format %02x[lindex [split $a_addr .] 1]]:[format %02x[lindex [split $a_addr .] 2]][format %02x[lindex [split $a_addr .] 3]]"

    11: }12: }13: }

    4: BIG-IP iRule A Record Filter (rev.0)

    3 DNS64/NAT64

    BIG-IP DNS64/NAT64 BIG-

    IP A Record Filter

    3.1 1

    bind A Record Filter

    BIG-IP A Record Filter

    3.1.1

    3 1 1

    IPv4 DNS SEIL DNS fowarder

    3

  • ;; QUESTION SECTION:;www.ntt-at.co.jp. IN ANY;; ANSWER SECTION:www.ntt-at.co.jp. 47488 IN A 114.179.21.42

    5: A Record Filter DNS Response

    ;; QUESTION SECTION:;www.ntt-at.co.jp. IN ANY;; ANSWER SECTION:www.ntt-at.co.jp. 111 IN AAAA 2001:200:0:ff00:64:1:72b3:152a

    6: A Record Filter DNS Response

    IPv6 DNS BIG-

    IP DNS64 SEIL Stateless

    DHCP6

    BIG-IP iRule A Record Filter

    4 ANY

    A mapped address

    A Record Filter

    DNS Response 5 A Record Filter

    6 mapped IPv6

    AAAA iRule

    4 question type A DNS

    A question type

    A 7

    iRule A Record Filter

    8

    3.1.2

    7 A Record Filter

    Facebook

    BIG-IP

    [Browser] IPv4:AAAA Query → [BIG-IP] AAAA Re-sponse (Native IPv6 address) → [SEIL] SERVFAIL

    SEIL SERVFAIL

    SEIL

    FormError SERVFAIL

    Akamai

    1: when DNS_RESPONSE {2: set prefix "2001:200:0:ff00:64:1:"3: set rrs [DNS::answer]4: if { [DNS::question type] equals "ANY" } {5: foreach rr $rrs {6: if { [DNS::type $rr] equals "A" } {7: log local0. "A Record is \[ $rr \]"8: set a_addr [getfield $rr "A" 2]9: DNS::answer remove $rr

    10: DNS::answer insert "[DNS::question name]. 111[DNS::question class] AAAA $prefix[format %02x[lindex [split $a_addr .] 0]][format %02x[lindex [split $a_addr .] 1]]:[format %02x[lindex [split $a_addr .] 2]][format %02x[lindex [split $a_addr .] 3]]"

    11: } elseif { [DNS::question type] equals "A" } {12: log local0. "A Record \[ $rrs \] is DELETED.

    DNS::answer clear13: }14: }15: }

    7: BIG-IP iRule A Record Filter (rev.1)

    C:\bind>dig @BIG-IP.naist.camp.wide.ad.jp www.ntt-at.co.jp a; DiG 9.8.7-W1 @BIG-IP.naist.camp.wide.ad.jp www.ntt-at.co.jp a; (1 server found);; global options: +cmd;; Got answer:;; ->>HEADER

  • Cliant BIGIG-GGGGGGGG-IPBIIGGG IIPP

    (DNS64)

    NAIST NAIST

    DNSIPv6:53

    IPv4:53

    IPv6 only backbone

    IPv4 (DHCP4)

    IPv6 (RA + DHCP6)

    BINDBIND

    (Forwarder)IPv6:53

    IPv6:53

    IPv6:53

    IPv6:53

    9: DNS 2

    Cliant BIGIG-GGGGG-IPBIIGGG IIPP

    (DNS64)

    NAIST NAIST

    DNS

    IPv6:53

    IPv4:53

    IPv6 only backbone

    IPv4 (DHCP4)

    IPv6 (RA + DHCP6)

    BINDBIND

    (Forwarder)

    IPv6:53

    IPv6:53

    IPv6:53

    10: DNS 3

    1: [Browser] IPv4:A Query → [BIG-IP] A FilteredResponse → [BIND] SERVFAIL

    2: [Browser] IPv6:A Query → [BIG-IP] A FilteredResponse → [BIND] SERVFAIL

    3:

    1 A

    A Record Filter NOERROR

    AAAA

    2 BIND forwarder

    NOERROR Respose SERVFAIL

    3.3 3

    2 IPv6

    BIND BIG-IP

    3.3.1

    1: when DNS_RESPONSE {2: set prefix "2001:200:0:ff00:64:1:"3: set rrs [DNS::answer]4: if { [DNS::question type] equals "ANY" } {5: foreach rr $rrs {6: if { [DNS::type $rr] equals "A" } {7: log local0. "A Record is \[ $rr \]"8: set a_addr [getfield $rr "A" 2]9: DNS::answer remove $rr

    10: DNS::answer insert "[DNS::question name]. 111[DNS::question class] AAAA $prefix[format %02x[lindex [split $a_addr .] 0]][format %02x[lindex [split $a_addr .] 1]]:[format %02x[lindex [split $a_addr .] 2]][format %02x[lindex [split $a_addr .] 3]]"

    11: } elseif { [DNS::question type] equals "A" } {12: log local0. "A Record \[ $rrs \] is DELETED.13: DNS::answer clear14: DNS::authority clear14: }16: }17: }

    11: BIG-IP iRule A Record Filter (rev.2)

    C:\bind>dig @BIG-IP.naist.camp.wide.ad.jp www.ntt-at.co.jp a; DiG 9.8.7-W1 @BIG-IP.naist.camp.wide.ad.jp www.ntt-at.co.jp a; (1 server found);; global options: +cmd;; Got answer:;; ->>HEADER

  • Cliant BIGIG-GGGGG-IPBIIGGG IIPP(DNS64)

    NAIST NAISTDNS

    IPv6:53

    IPv4:53

    IPv6 only backbone

    IPv4 (DHCP4)

    IPv6 (RA + DHCP6)

    BINDBIND(Forwarder)

    UbuntuUbuuntuUbuGateway for raatteewwaayy forGGaaaa

    rrrreturn ICMP rrrrrrrrreeetttttuurrnn IIProtocol

    PPIICCMMPPll Unreachch)

    TCP4

    IPv6:53

    IPv6:53

    IPv6:53

    13: DNS 4

    3.

    2 IPv4 DNS

    (OS) DNS

    mirror.centos.org A

    AAAA SERV-

    FAIL

    WIDE

    RFC4074 [7]

    DNS

    AAAA

    AAAA SERVFAIL

    BIG-IP DNS64 [8]

    A (DNS64 AAAA)

    3.4 4

    3 iOS

    7 Facebook App Store

    live-with-ipv6 WG

    3.4.1

    10

    4 Facebook

    App Store

    ARP

    ARP IPv6 fallback

    HappyEyeball Facebook App Store

    DHCP4

    IPv4 Ubunutu 14.4LTS) iptables

    ICMP4 type 3 Destination

    Unreachable

    IPv6 fallback

    3.4.2

    ICMP4 type 3 Destination Unreachable

    code

    • code 0 - Network Unreachable :TCPDUMP

    Facebook App Store

    Facebook IPv4 443

    31.13.17.49:443, 31.13.19.101:443 TCP4

    • code 3 - Port unreachable : 443

    1 IPv6

    • code 2 - Protocol unreachable : FacebookApp Store

    TCP, UDP, ICMP

    Protocol code

    Port unreachable

    • code 9 - Communication with DestinationNetwork is Administratively Prohibited :

    code Protocol

    Unreachable

    6

  • 14: BIG-IP CPU

    15: BIG-IP

    3.5 BIG-IP

    BIG-IP

    BIG-IP LTM/GTM Virtual Edition on KVM

    Hypervisor Through-

    put 1Gbps License

    Dell PowerEdge R620, In-

    tel(R) Xeon(R) CPU E5-2660 0 @ 2.20GHz 2

    64

    BIG-IP CPU 2

    4

    14 BIG-IP CPU

    15 BIG-IP

    CPU 10

    1,400

    80 /

    80Mbps

    PeerApp UltraBand

    17Mbps

    DNS

    3.6

    BIG-IP

    A Record Filter

    A Record Filter DNS

    Parse Form Validation

    DNS Forwarder FormError

    SERVFAIL

    A Record Filter

    ICMP4 type 3 Destination Unreachable

    code 3 - Port unreachable

    code 2 Protocol Unreachable code 9 - Com-

    munication with Destination Network is Administra-

    tively Prohibited

    live-with-ipv6

    WG code 9 - Communication with

    Destination Network is Administratively Prohibited

    IPv4 IPv6 only network

    DNS64/NAT64

    A Record Filter

    ICMP4 type 3 code 9

    OS

    7

  • code 9

    A Record Filter DNS

    AAAA A

    IPv4 HappyEyeball

    DNS For-

    warder FormError, SERVFAIL

    A Record Filter

    live-with-ipv6 WG

    DNS64/NAT64 WiFi

    A Record Filter ICMP4 type 3

    destination unreach

    WIDE 2014 12

    VPN Skype Dropbox

    IPv4

    Skype Polycom

    RealPressence

    IPv4

    NAT44 IPv4

    IPv6 IPv4

    au-WiFi

    LAN IPv4

    3DS

    PS Vita IPv4

    Final Fantasy XIV

    IPv4 DNS64/NAT64

    skype,

    polycom, dropbox 3DS

    PSVita

    IPv6

    4 Mac OS X IPv4 Link

    Local Assamption

    Prox-

    yARP

    3 IPv6 only

    DHCP4

    • IPv4 link local assumption (RFC3927 [9])MAY Mac OS X

    IPv4

    default route

    Mac OS X 10.8 IPv4

    DHCP Mac OS X 10.8

    DHCP limited broadcast

    DHCPv4 IPv4 link-local

    address default

    route

    ✓ ✏Internet:Destination Gateway Flags Refs Use Netif Expiredefault link#6 UCS 31 0 en31.2.3.4 link#6 UHLWIi 0 0 en3✒ ✑

    IPv4

    on link assumption

    Mac OS X 10.8

    ARP

    ARP

    DHCP4 IPv4

    default gateway

    IPv4 default route

    • Android OS IPv4LAN

    DHCP4 IPv4

    default gateway

    LAN

    8

  • • Android RAIPv6 DNS

    IPv4

    HappyEyeball

    IPv4, IPv6 DNS

    LAN DNS Fowarder DNS

    Proxy IPv4 DNS

    A

    IPv4

    A Record Filter

    AAAA

    WIDE

    IPv6 only IPv4

    IPv6

    IETF sunset4 WG

    DNS64/NAT64 IPv6 only network

    Mac OS X IPv4 Link Local As-

    samption

    DHCP4 ProxyARP

    IPv4

    sunset4 WG IPv6 only network

    ProxyARP

    4.1

    16 sunset4 3

    DHCP4 SEIL SEIL

    Proxy ARP DNS DHCP6

    BIG-IP IPv6

    BIG-IP A Record Filter

    AAAA Record

    Cliant SEILSEIILSEIProxyARPRP)

    BIGIG-GGGGG-IPBIIGG IIPP(DNS64)

    NAIST NAISTDNS

    IPv6

    ARP

    IPv6 only backboneIPv6 (RA + DHCP6)

    IPv6

    IPv6 IPv6Internet

    16: ProxyARP IPv6 only

    4.2

    • Mac OS X iOS 7 LAN

    IPv4 IPv6

    tcpdump

    MAC IPv4

    IPv6 DNS

    Facebook App Store

    IPv4 HappyEyeball

    Skype dropbox

    IPv4

    • Windows 7 Windows 8 LAN10

    LAN

    1 DHCP4

    LAN

    1 30 LAN

    Mac OS X IPv6 DNS

    IPv4

    HappyEyeball

    Skype dropbox

    IPv4

    • Android 4.4

    9

  • LAN 30

    4.3

    Mac OS X

    DNS64/NAT64 Window 7/8

    LAN 1 30

    QoE Android

    LAN QoE

    IPv6

    ssh

    VPN Skype

    ProxyARP sunset4

    ARP IPv4

    Network is Administratively Prohibited

    ARP IPv6

    IPv4 link-local address

    Proxy ARP

    IPv4 (

    IPv4 link-local address

    169.254.0.0/16

    Proxy ARP

    5 IPv6

    IPv6

    NTT-AT

    17: UltraBand

    5.1

    PeerApp

    UltraBand UltraBand

    UltraBand IPv4 IPv6

    3

    RST

    QoE (Quality of Experience)

    Proof fo Concept IPv6

    1) 2)QoE 3)

    17 UltraBand

    SEIL

    5.2

    10

  • 18: UltraBand

    19: UltraBand

    18 UltraBand

    ,

    Outgoing

    Incoming

    Outgoing 9 10 9

    10 33.27Mbps UltraBand

    9 11 1 1

    19 UltraBand

    Windows Update

    20: UltraBand QoE

    17Mbps 16.54Mbps UltraBand

    20 UltraBand QoE

    UltraBand

    1Mbps 16.56Mbps

    16 QoE

    HTTP Window Update, iOS

    HTTPS

    NTT-AT

    PeerApp

    6

    IPv6

    2014 9 17

    122 46 37.7

    46 LAN

    • camp1409-nat64-1x 39

    • camp1409-nat64-sunset4 18

    • camp1409-ipstar 9

    • camp1409-lastresort 5

    IPv6

    11

  • 6.1

    • facebook happyeyball

    • v6 only

    • OpenVPN udp6 NAT64VPN IPv4

    6.2

    • SSID

    iPhone Android SSID

    • IPv6

    skype polcom mobile presence v6

    skype poly-

    com dropbox

    LAN lastresort IPv4 over IPv6

    IPv4

    • IPv4QoE

    Thunderbird IMAP fetch

    Hap-

    pyEyeball QoE

    7

    DNS64/NAT64

    A Record Filter FormError

    DNS Forwader

    FormError

    A Record Filter ICMP pro-

    tocol unreach ICMP administratively prohibited

    HappyEyeball

    IPv4 IPv4

    ✓ ✏iptables -A FORWARD -i eth0 -d 0.0.0.0/0 -j REJECT \--reject-with icmp-proto-unreachable

    ✒ ✑21: iptables (code 2 : Protocol Unreach-

    able)

    ✓ ✏iptables -A FORWARD -i eth0 -d 0.0.0.0/0 -j REJECT \--reject-with icmp-admin-prohibited

    ✒ ✑22: iptables (code 9 : Administrativly Pro-

    hibited)

    IPv6

    IPv6

    A Record Filter ICMP

    Happy Eyeball IPv4 fallback

    DNS64/NAT64

    LAN

    IETF v6ops WG sunset4

    WG

    8 Appendix

    8.1 Destination Unreach

    8.1.1 Ubuntu 14.4 LTS

    3.4 ICMP Des-

    tination Unreach Ubuntu

    14.14 LTS iptables

    1 DHCP

    Ubuntu

    2 sysctl v4 forwarding=1

    3 Linux iptable FORWARD CHAIN

    destination

    **port** unreach IP

    12

  • ✓ ✏term accept-limited-broadcast {

    from {source-address {

    0.0.0.0/32;}destination-address {

    255.255.255.255/32;}

    }then accept;

    }term accept-to-local {

    from {destination-address {

    172.31.0.0/16;}

    }then accept;

    }term reject-last {

    then {reject administratively-prohibited;

    }}✒ ✑23: JUNOS (code 9 : Administrativly Pro-

    hibited)

    4 destination network

    unreachable FORWARD CHAIN

    IPv4

    192.0.2.1 null

    IPv4 .

    v4 destination

    port unreach 21 Pro-

    toco Unreachable iptables

    22 Administratively Prohibited

    iptables unix OS

    linux distribution BSD OS

    8.1.2 Juniper EX9208

    DNS64/NAT64

    administratively prohibited IPv4

    DNS64/NAT64

    IPv4 DNS fowrder

    A Record Filter

    1. IPv4 DNS forwarder DNS64/NAT64

    NAIST 172.31.0.1/16 DHCP4 /

    IPv4 DNS forwarder OpenMicroServer OMS-

    AL400/128 172.31.0.2/16 IPv6 gateway

    (Juniper EX9208) DNS64 BIND

    9.9 NAT64 ObenBSD Packet Filter

    NAT64 prefix 64:ff9b::

    DHCP6 ISC DHCP 4.2

    2. 172.31.0.2 Juniper EX9208

    1. accept from 0.0.0.0/32 to

    255.255.255.255/32

    2. accept from any to 172.31.0.0/16

    3. administratively-prohibited from any to any

    3. DHCP4 172.31.0.2 IPv4 default gateway

    DNS 172.31.0.1

    172.31.0.0/16 IPv4

    A Record Filter IPv6

    1 8

    administartively-

    prohibited avail-

    ability

    A Record Filter

    8.2 Firefox SOCKS

    1. In firefox type this in your address bar:

    about:config

    2. Click that you promise to be careful.

    3. In the filter textbox, type:proxy

    4. Find the preference name called

    ”network.proxy.socks remote dns”.

    Double click it to set it to true.

    5. ssh -D your-sock-server.your.net

    13

  • 8.3 DNS64/NAT64

    VPN

    8.3.1 VPN

    • Cisco AnyConnect (iOS App Store version)

    VPN

    KMD

    ASA5505 Mapped Ad-

    dress ASA5505 VPN

    Native IPv6

    • OpenVPN / Tunnelblick (Windows 7, Mac OSX)

    VPN NAIST

    FreeBSD

    Mapped Address

    • Fortinet FortiClient SSL VPN (Windows, MacOS X)

    VPN StarBED

    Fortigate

    Mapped Address

    8.3.2 Voice / Video conference

    • Skype

    Skype IPv4

    camp1409-lastresort

    IPv6

    IPv4

    • Polycom Real Presence

    Polycom Real Presence

    IPv4

    Skype

    8.3.3

    8.3.4

    • DropBox

    8.4

    • VMWare Fusion NAT44

    JAIST VMwareFu-

    sion NAT

    (VMware Fusion

    NAT44 ). VMware Fusion

    OS Mac OS X Wi-Fi

    OS

    .

    • POPFile

    8.5 sunset4

    DNS64/NAT64

    live-with-ipv6 WG

    IPv4

    IPv4 HappyEyeball

    IPv6

    14

  • 8.5.1 iOS

    • iTune Store

    NTT-AT

    iTunes Store iTunes

    Store Wi-Fi

    • Facebook

    NTT-AT

    • (Facebook) Messenger

    NTT-AT

    • App Store

    NTT-AT

    [1] Hiroaki Hazeyama, Yukito Ueno, Hirotaka Sato,

    Yudai Yamagishi, Takehiro Yokoishi, and Hisa-

    take Ishibashi. How much can we survive on an

    IPv6 network? - Experience on the IPv6 only

    connectivity with NAT64/DNS64 at WIDE camp

    2011 autumn. In Proceedings of Asia Workshop

    on Future Internet Technologies (AWFIT2011),

    November 2011.

    [2] T. Murakami, O. Troan, and S. Matsushima.

    IPv4 Residual Deployment on IPv6 infrastructure

    - protocol specification. Internet Draft (expired),

    September 2011.

    [3] O. Troan (Ed.), W. Dec, X. Li, C. Bao, S. Mat-

    sushima, T. Murakami, and T. Taylor (Ed.).

    Mapping of Address and Port with Encapsulation

    (MAP). Internet Draft (Publication Requrested),

    June 2014.

    [4] Marius Georgescu, Hiroaki Hazeyama, Youki

    Kadobayashi, and Suguru Yamaguchi. Empiri-

    cal Analysis of IPv6 Transition Technologies Us-

    ing the IPv6 Network Evaluation Testbed. In

    The 9th International Conference on Testbeds

    and Research Infrastructures for the Development

    of Networks and Communities (TRIDENTCOM

    2014), May 2014.

    [5] Osamu Nakamura, Hiroaki Hazeyama, Yukito

    Ueno, and Akira Kato. IPv4 Address Literal in

    URL. Internet Draft (will be revised to 02), Jan-

    uary 2014.

    [6] Hiroaki Hazeyama, Tomohiro Ishihara, and Os-

    amu Nakamura. DNS A Record Filtering for the

    migration from dual stack networks to IPv6 only

    networks. Internet Draft (expired), July 2013.

    [7] Y. Morishita and T. Jinmei. Common Misbe-

    havior Against DNS Queries for IPv6 Addresses.

    RFC 4074 (Informational), May 2005.

    [8] M. Bagnulo, A. Sullivan, P. Matthews, and I. van

    Beijnum. DNS64: DNS Extensions for Network

    Address Translation from IPv6 Clients to IPv4

    Servers. RFC 6147 (Proposed Standard), April

    2011.

    [9] S. Cheshire, B. Aboba, and E. Guttman. Dy-

    namic Configuration of IPv4 Link-Local Ad-

    dresses. RFC 3927 (Proposed Standard), May

    2005.

    15