Re: [v6ops] Deprecating 2002::/16

Hi Pekka,

>> When connecting to a dual-stack server with IP addresses 2.2.2.2 and 
2001:db8::1.It will use 6to4 instead of IPv4 through NAT. FAIL.
>>  2) 6to4 is used if v4 has mismatching scope (private->public)

Windows implementation treats RFC 1918 prefixes as public, specifically due to this reason, so on Windows, in this scenario v4->v4 is preferred over 6to4->native v6.

Thank you,
Dmitry
-----Original Message-----
From: v6ops-bounces@ietf.org [mailto:v6ops-bounces@ietf.org] On Behalf Of Pekka Savola
Sent: Thursday, April 07, 2011 12:44 AM
To: Christopher Palmer
Cc: v6ops@ietf.org; Carlos Martinez-Cagnazzo
Subject: Re: [v6ops] Deprecating 2002::/16 - 6to4 Historic Status

On Thu, 7 Apr 2011, Christopher Palmer wrote:
> "A host with a public but natted v4 address will alwas get hosed by this."
>
> A host in that condition will have a broken 6to4 address, but won't experience a degradation in their web experience if they have RFC 3484 implemented.
>
> So really this would be the third proposed 6to4 mitigation:
>
> 1. Ensuring that IPv4->IPv4 is ranked higher than 6to4->IPv6 in the RFC 3484.
> 2. Changing default host behavior. (still being debated)
> 3. Deprecation of the prefix.
>
> Given (1) and (2), the operational value of 3 is still lost on me. Is the expectation that ISPs stop routing 6to4 packets? Is this a signal that we don't just hate 6to4, but we super hate it?

This will require an update in the RFC 3484 implementation.  Maybe 
this is what you meant, or maybe not.

Joel is probably referring to this:

http://tools.ietf.org/html/draft-ietf-6man-rfc3484-revise-02#section-2.4

(This issue has a lot of history -- known for some 7-8yrs, see 
http://tools.ietf.org/html/draft-ietf-v6ops-v6onbydefault-03#section-2.1)

If I understand this correctly:

The NAT44ting/6to4 gateway has public IP 1.1.1.1 (WAN)
It is advertising 2002:0101:0101:0::/64 out on LAN.
It is doing NAT on LAN.

Hence, hosts behind such gateway have IPv6 address 
2002:0101:0101:0::EUI64 and 192.168.1.1.

When connecting to a dual-stack server with IP addresses 2.2.2.2 and 
2001:db8::1.

It will use 6to4 instead of IPv4 through NAT. FAIL.

If the client would have had IP address 1.1.1.2 and 
2002:0101:0101:0::EUI64, with (current) RFC3484 implementation, it 
would have preferred IPv4 instead of 6to4.

So, there are are really two layers of RFC3484 brokenness:

  1) not implemented at all
  2) 6to4 is used if v4 has mismatching scope (private->public)

-- 
Pekka Savola                 "You each name yourselves king, yet the
Netcore Oy                    kingdom bleeds."
Systems. Networks. Security. -- George R.R. Martin: A Clash of Kings
_______________________________________________
v6ops mailing list
v6ops@ietf.org
https://www.ietf.org/mailman/listinfo/v6ops