Archlinux as dual-stack (IPv4/v6) gateway/router

Question

Hello everyone,
i've installed Arch on my PC a few days ago and it works perfectly, the PC is a gaming PC (Asus P8P67 Deluxe, Intel Core i3 2100, 14 GB RAM, 2x Nvidia GTX580) however for specific reasons (i don't have anything else besides IBM PCs with 600Mhz CPUs) i need to use it as a server and a router/gateway for my network (an Archlinux laptop and some Apple products), here's my current network setup :
PPPoE modem is connected to lan0 (ethernet interface) which is configured as 192.168.1.2, gateway 192.168.1.1 (it's the modem's address).
My provider (OVH in France) gives me a /64 IPv6 subnet.
ppp0 interface is created once the lan0 is up (i'm using POST_UP="pon myprovider" in netcfg script, i've already added +ipv6 in /etc/ppp/options to enable IPv6 on the ppp), it gets automatically an IPv4 address and an IPv6 one from my provider, here's the ifconfig ppp0 (i know it's deprecated but i'm so used to it...) :
ppp0: flags=4305<UP,POINTOPOINT,RUNNING,NOARP,MULTICAST> mtu 1452
inet 109.190.20.173 netmask 255.255.255.255 destination 178.32.37.16
inet6 2001:41d0:70:1301:1c1e:882b:1e8b:efd7 prefixlen 64 scopeid 0x0<global>
inet6 fe80::1c1e:882b:1e8b:efd7 prefixlen 10 scopeid 0x20<link>
ppp txqueuelen 3 (Point-to-Point Protocol)
RX packets 6080 bytes 3571799 (3.4 MiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 4173 bytes 870323 (849.9 KiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
here's my IPv4 routing table :
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
default * 0.0.0.0 U 0 0 0 ppp0
172.16.1.0 * 255.255.255.0 U 0 0 0 lan1
rbx-1-rdb.fr.eu * 255.255.255.255 UH 0 0 0 ppp0
192.168.1.0 * 255.255.255.0 U 0 0 0 lan0
lan1 is my local wired interface which connects to a 1000Mb/s switch, on it there is a Debian machine (the 600Mhz one) which acts as an access point (on it the wired interface is bridged with the wireless one, but all the DHCP/DNS stuff is done on my main computer and i don't think there's anything to do on the access point machine) and my other Archlinux laptop. Forwarding is enabled on both IPv4 and v6 in /etc/sysctl.conf and iptables (not ip6tables) is configured correctly, all works as would like on the IPv4 side (DHCP/DNS/internet access works for all computers on the network) here's my ifconfig lan1 :
lan1: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 9152
inet 172.16.1.1 netmask 255.255.255.0 broadcast 172.16.1.255
inet6 fe80::f66d:4ff:fee3:2c96 prefixlen 64 scopeid 0x20<link>
ether f4:6d:04:e3:2c:96 txqueuelen 1000 (Ethernet)
RX packets 5060 bytes 701035 (684.6 KiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 10181 bytes 7102665 (6.7 MiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
device interrupt 20 memory 0xf5100000-f5120000
Here's my IPv6 routing table (i have experience with computers and networks in general but this is a total non-sense to me) :
Kernel IPv6 routing table
Destination Next Hop Flag Met Ref Use If
::1/128 :: U 256 0 0 lo
2001:41d0:70:1301::/64 :: UA 256 0 0 ppp0
fe80::/64 :: !n 256 0 0 lo
fe80::/64 :: U 256 0 0 lan0
fe80::/64 :: U 256 0 0 lan1
fe80::/64 :: U 256 0 0 ppp0
fe80::/10 :: U 1 0 0 ppp0
fe80::/10 :: U 256 0 0 ppp0
::/0 fe80::230:88ff:fe04:63d4 UGDAe 1024 1 0 ppp0
::/0 :: !n -1 1 312 lo
::1/128 :: Un 0 1 2 lo
2001:41d0:70:1301::/128 :: Un 0 1 0 lo
2001:41d0:70:1301:1c1e:882b:1e8b:efd7/128 :: Un 0 2 102 lo
fe80::/128 :: Un 0 1 0 lo
fe80::/128 :: Un 0 1 0 lo
fe80::/128 :: Un 0 1 0 lo
fe80::1c1e:882b:1e8b:efd7/128 :: Un 0 1 0 lo
fe80::f66d:4ff:fee3:2010/128 :: Un 0 1 0 lo
fe80::f66d:4ff:fee3:2c96/128 :: Un 0 1 0 lo
ff00::/8 :: U 256 0 0 lan0
ff00::/8 :: U 256 0 0 lan1
ff00::/8 :: U 256 0 0 ppp0
::/0 :: !n -1 1 312 lo
now with that configuration i can ping6 ipv6.google.com and get a reply :
PING ipv6.google.com(wb-in-x69.1e100.net) 56 data bytes
64 bytes from wb-in-x69.1e100.net: icmp_seq=1 ttl=56 time=49.1 ms
64 bytes from wb-in-x69.1e100.net: icmp_seq=2 ttl=56 time=48.5 ms
64 bytes from wb-in-x69.1e100.net: icmp_seq=3 ttl=56 time=48.3 ms
64 bytes from wb-in-x69.1e100.net: icmp_seq=4 ttl=56 time=50.3 ms
--- ipv6.google.com ping statistics ---
4 packets transmitted, 4 received, 0% packet loss, time 3003ms
rtt min/avg/max/mdev = 48.399/49.116/50.393/0.834 ms
but what next ? I need to redistribute that IPv6 to all my network, currently i have isc-dhcp-server (dhcpd) that gives IPv4 addresses on lan1, i also have bind which acts like a DNS resolver/cacher for my local network. I've heard about radvd which is like a dhcpd but for IPv6, however i think there's other stuff to do on the IPv6 routing table (which i don't understand) before hosts on the network can access Internet through IPv6... so here's a summary : ppp0 gets an IPv6 address, i can ping6 from this computer, and that's it...
Sorry for the long post but we're not on IRC so i don't think the usage of Pastebin is required, thanks for reading and have a nice day.

Answer 1

Awe, way cool radvd "router advertisement daemon"
Ya, that is what you needed for IPv6 to work Ya, see the IPv6 protocol takes care of addressing for you. No need for DHCP nor NAT/PAT becuase your ISP gives you more IP's then you could ever need. In fact, you can fit every IPv4 address posible into the range of addresses your ISP gives you!
One other VARY cool thing with IPv6 is "Anycast, One-to-nearest". Really just endless super cool stuff with IPv6.
If I remember correctly like all OS's prefer to use IPv6 if avalable.
Okay, so for DNS, well I think you do need DHCP to hand that out... (I'm probaly wrong about that), anyway, I'd simply configure you DNS host by host... but I have a faint memory of some cool way that can work itself out too... in anycase:
Google DNS
/etc/resolv.conf
nameserver 2001:4860:4860::8888
nameserver 2001:4860:4860::8844
nameserver 8.8.8.8
nameserver 8.8.4.4
You know though. For security sake, you may want to configure your LAN with a Private IPv6 netwrok and subnet. All you would need to do is give the interfaces on the router an address starting with FD. Then you can use like arno-iptables-firewall to NAT the address range.
Like this is how IPv6 network and subnet addressing works
http://www.simpledns.com/private-ipv6.aspx
| 8 bits |  40 bits   |  16 bits  |          64 bits           |
+--------+-+------------+-----------+----------------------------+
| Prefix | Global ID  | Subnet ID |        Interface ID        |
+--------+-+------------+-----------+----------------------------+
That "Interface ID" is created by the Host automaticaly. It simply takes the MAC address of the interface and puts an "FE" in teh middel to make it 64 bits long.
A Host learns about the network half of the address by picking up the "Router Advertisement messages"
So if the interface on the LAN side of the router has a Private IP address (it starts with "FD"), that is the network the router will put in the Router Advertisement and the Host's will pick up that Network 64bits and add on it's Interface ID 64bit's. Then bam, you got yourself an IPv6 address in a "Unique Local" IPv6 address range.
EDIT:
Awe, Okay, I just re-read my CCNA book. Okay so ya, a Host or Router using stateless autoconfiguration can learn both the IPv6 address prefix and it's default router IP address using NDP RS/RA messages. However, you do need at least a stateless DHCPv6 server to hand out DNS server's IP.
Last edited by hunterthomson (2012-11-06 09:35:54)