Skip to content

Instantly share code, notes, and snippets.

@inntran
Last active September 9, 2022 00:58
Show Gist options
  • Star 8 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save inntran/4816f33d9230b0a31bea062fc21fcbd9 to your computer and use it in GitHub Desktop.
Save inntran/4816f33d9230b0a31bea062fc21fcbd9 to your computer and use it in GitHub Desktop.
To configure IPv6 NPTv6 on Linux to allow more hosts behind Verizon Wireless LTE IPv6 single /64 prefix

Problem

Verizon Wireless assigns you ONE IPv4 address and ONE /64 IPv6 prefix for their cellular service, and VZW would reset your datalink once they received 1 packet with an illegal source address.

We have NAT for IP but for IPv6 we would like to avoid address translation to get some kind of end-to-end communication.

Solution

NPTv6, defined in RFC6296, would help us to do stateless prefix translation for IPv6. NPTv6 is supported in linux kernel since version 3.7. Proof: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/include/linux/netfilter_ipv6?h=v3.6 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/include/uapi/linux/netfilter_ipv6?h=v3.7 Notice the newly added ip6t_NPT.h file.

For every ingress(incoming) packet at "wwan0" interface, if its destination is NOT our own IP address, translate the destination address prefix to OTHER_PREFIX.

ip6tables -t mangle -A PREROUTING ! -d IPv6_WWAN_Interface_ADDRESS/128 -i wwan0 -j DNPT --src-pfx WWAN_Interface_PREFIX::/64 --dst-pfx OTHER_PREFIX::/64

For every egress(outgoing) packet at "wwan0" interface, if its source address matches the "OTHER_PREFIX", do the translation of source address prefix to wwan0 interface prefix.

ip6tables -t mangle -A POSTROUTING -s OTHER_PREFIX::/64 -o wwan0 -j SNPT --src-pfx OTHER_PREFIX::/64 --dst-pfx WWAN_Interface_PREFIX::/64

Make sure you can reach hosts with OTHER_PREFIX, from this device itself.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment