Allowing remote IPv4 access to local IPv6 server?

Installing and Using OpenWrt Network and Wireless Configuration
1

Is it possible to support IPv4-only clients to a service running "behind" a dual-stack OpenWRT router?

Admittedly this is ± just re-asking the "how do I set up IPv6 port forwarding" question to which the standard answer is like at https://forum.openwrt.org/t/ipv6-and-port-forwarding/27770/3:

Port "forwarding" where packets destined for the router's IP are instead rewritten and forwarded to a private IP on the LAN side is not necessary under ipv6, what is needed is simply to open up the firewall to allow forwarding traffic […]

But in my case it's not just a question of wanting to do "IPv6 NAT" i.e. mapping from one IPv6+port pair to another, but rather wanting to preserve an existing service on the IPv4 interface. I'm upgrading my network so that servers get only IPv6 addresses internally but I want to continue providing IPv4 access to legacy clients externally.

I see why it's unusual to have a 6↔︎6 NAT setup, but it seems more natural to still offer a 4↔︎6 NAT to support remote peers that don't have IPv6 stacks, right? [Or vice versa too, for legacy server to modern client — but that's not what I'm after at least at the moment.] Does OpenWRT support that sort of "port forwarding" in a relatively convenient fashion?

2

The keyword is map-t. Not sure if/how well it works though.

3 Likes
3

It's best to avoid using NAT6 and only allow IPv6 traffic forwarding for specific hosts/ports.

Perhaps you should simply utilize the advantages of dual-stack.

2 Likes
4

simply utilize the advantages of dual-stack

That is a reasonable solution too. In my case the motivation is that some of the hosted machines comes up IPv6-only by default and will be a pain to re-configure [but, not impossible].

That is, as a workaround (and an alternative to "weird stuff" like compiling in a kernel module like https://github.com/ayourtch/nat46/tree/master/nat46/modules (?) or whatever I'd need) the suggestion here is to:

  • set up IPv6 rules via firewall for modern client ↔︎ server connections
  • also configure the (dual stack) server to have an IPv4 address, and use ye olde Port Forwarding NAT stuff (for legacy client ↔︎ server connections)
1 Like