156668SshinConfiguring FAITH IPv6-to-IPv4 TCP relay 256668Sshin 356668SshinKazu Yamamoto and Jun-ichiro itojun Hagino 4122679Sume$KAME: README,v 1.10 2003/01/06 21:40:33 sumikawa Exp $ 556668Sshin$FreeBSD: releng/10.2/usr.sbin/faithd/README 122679 2003-11-14 17:34:08Z ume $ 656668Sshin 7122679Sume 856668SshinIntroduction 956668Sshin============ 1056668Sshin 11108533SschweikhFAITH is an IPv6-to-IPv4 TCP relay. It performs tcp relay just as some of 1256668Sshinfirewall-oriented gateway does, but between IPv6 and IPv4 with address 1356668Sshintranslation. 1456668SshinTCP connections has to be made from IPv6 node to IPv4 node. FAITH will 1556668Sshinnot relay connections for the opposite direction. 1656668SshinTo perform relays, FAITH daemon needs to be executed on a router between 1756668Sshinyour local IPv6 site and outside IPv4 network. The daemon needs to be 1856668Sshininvoked per each TCP services (TCP port number). 1956668Sshin 2056668Sshin IPv4 node "dest" = 123.4.5.6 2156668Sshin | 2256668Sshin [[[[ outside IPv4 ocean ]]]] 2356668Sshin | 2456668Sshin node that runs FAITH-daemon (usually a router) 2556668Sshin | 2656668Sshin ==+=====+===+==== IPv6, or IPv4/v6 network in your site ^ 2756668Sshin | | | connection 2856668Sshin clients IPv6 node "src" | 2956668Sshin 3056668SshinYou will have to allocate an IPv6 address prefix to map IPv4 addresses into. 3178064SumeThe following description uses 3ffe:0501:ffff:0000:: as example. 3256668SshinPlease use a prefix which belongs to your site. 33108533SschweikhFAITH will make it possible to make an IPv6 TCP connection From IPv6 node 3456668Sshin"src", toward IPv4 node "dest", by specifying FAITH-mapped address 3578064Sume3ffe:0501:ffff:0000::123.4.5.6 3678064Sume(which is, 3ffe:0501:ffff:0000:0000:0000:7b04:0506). 3778064SumeThe address mapping can be performed by hand:-), by special nameserver on 3856668Sshinthe network, or by special resolver on the source node. 3956668Sshin 4056668Sshin 4156668SshinSetup 4256668Sshin===== 4356668Sshin 4456668SshinThe following example assumes: 4578064Sume- You have assigned 3ffe:0501:ffff:0000:: as FAITH adderss prefix. 4656668Sshin- You are willing to provide IPv6-to IPv4 TCP relay for telnet. 4756668Sshin 4856668Sshin<<On the translating router on which faithd runs>> 4956668Sshin 5056668Sshin(1) If you have IPv6 TCP server for the "telnet" service, i.e. telnetd via 5156668Sshin inet6d, disable that daemon. Comment out the line from "inet6d.conf" 5256668Sshin and send the HUP signal to "inet6d". 5356668Sshin 5456668Sshin(2) Execute sysctl as root to enable FAITH support in the kernel. 5556668Sshin 5696397Sdd # sysctl net.inet6.ip6.keepfaith=1 5756668Sshin 5856668Sshin(3) Route packets toward FAITH prefix into "faith0" interface. 5956668Sshin 6056668Sshin # ifconfig faith0 up 6178064Sume # route add -inet6 3ffe:0501:ffff:0000:: -prefixlen 64 ::1 6278064Sume # route change -inet6 3ffe:0501:ffff:0000:: -prefixlen 64 -ifp faith0 6356668Sshin 6456668Sshin(4) Execute "faithd" by root as follows: 6556668Sshin 6678064Sume # faithd telnet /usr/libexec/telnetd telnetd 6756668Sshin 6856668Sshin 1st argument is a service name you are willing to provide TCP relay. 6956668Sshin (it can be specified either by number "23" or by string "telnet") 7056668Sshin 2nd argument is a path name for local IPv6 TCP server. If there is a 7156668Sshin connection toward the router itself, this program will be invoked. 7256668Sshin 3rd and the following arguments are arguments for the local IPv6 TCP 7356668Sshin server. (3rd argument is typically the program name without its path.) 7456668Sshin 7556668Sshin More examples: 7656668Sshin 7778064Sume # faithd ftpd /usr/libexec/ftpd ftpd -l 7862655Skris # faithd sshd 7956668Sshin 8078064SumeIf inetd(8) on your platform have special support for faithd, it is possible 8178064Sumeto setup faithd services via inetd(8). Consult manpage for details. 8256668Sshin 8378064Sume 8456668Sshin<<Routing>> 8556668Sshin 8656668Sshin(4) Make sure that packets whose destinations match the prefix can 8756668Sshinreach from the IPv6 host to the translating router. 8856668Sshin 8956668Sshin<<On the IPv6 host>> 9056668Sshin 9156668SshinThere are two ways to translate IPv4 address to IPv6 address: 9256668Sshin (a) Faked by DNS 9356668Sshin (b) Faked by /etc/hosts. 9456668Sshin 9562655Skris(5.a) Install "newbie" and set up FAITH mode. See kit/ports/newbie. 9656668Sshin 9756668Sshin(5.b) Add an entry into /etc/hosts so that you can resolve hostname into 9862655Skrisfaked IPv6 addrss. For example, add the following line for www.netbsd.org: 9956668Sshin 10078064Sume 3ffe:0501:ffff:0000::140.160.140.252 www.netbsd.org 10156668Sshin 10256668Sshin<<On the translating router on which faithd runs.>> 10356668Sshin 10456668Sshin(6) To see if "faithd" works, watch "/var/log/daemon". Note: please 10556668Sshinsetup "/etc/syslog.conf" so that LOG_DAEMON messages are to be stored 10656668Sshinin "/var/log/daemon". 10756668Sshin 10856668Sshin <e.g.> 10956668Sshin daemon.* /var/log/daemon 11056668Sshin 11156668Sshin 11278064SumeAccess control 11378064Sume============== 11478064Sume 11578064SumeSince faithd implements TCP relaying service, it is critical to implement 11678064Sumeproper access control to cope with malicious use. Bad guy may try to 11778064Sumeuse your relay router to circumvent access controls, or may try to 11878064Sumeabuse your network (like sending SPAMs from IPv4 address that belong to you). 11978064SumeInstall IPv6 packet filter directives that would reject traffic from 12078064Sumeunwanted source. If you are using inetd-based setup, you may be able to 12178064Sumeuse access control mechanisms in inetd. 12278064Sume 12378064Sume 12456668SshinAdvanced configuration 12556668Sshin====================== 12656668Sshin 12756668SshinIf you would like to restrict IPv4 destination for translation, you may 12856668Sshinwant to do the following: 12956668Sshin 13078064Sume # route add -inet6 3ffe:0501:ffff:0000::123.0.0.0 -prefixlen 104 ::1 13178064Sume # route change -inet6 3ffe:0501:ffff:0000::123.0.0.0 -prefixlen 104 \ 13278064Sume -ifp faith0 13356668Sshin 13456668SshinBy this way, you can restrict IPv4 destination to 123.0.0.0/8. 13578064SumeYou may also want to reject packets toward 3ffe:0501:ffff:0000::/64 which 13678064Sumeis not in 3ffe:0501:ffff:0000::123.0.0.0/104. This will be left as excerside 13756668Sshinfor the reader. 13856668Sshin 13956668SshinBy doing this, you will be able to provide your IPv4 web server to outside 14056668SshinIPv6 customers, without risks of unwanted open relays. 14156668Sshin 14262655Skris [[[[ IPv6 network outside ]]]] | 14356668Sshin | | connection 14456668Sshin node that runs FAITH-daemon (usually a router) v 14556668Sshin | 14662655Skris ========+======== IPv4/v6 network in your site 14756668Sshin | (123.0.0.0/8) 14856668Sshin IPv4 web server 149