How to send IPV4 local lan request to IPV6 wan to an IPV4 endpoint

Hi,

Is it possible to route an IPV4 local lan request from a device to IPV6 only wan and then to a IPV4 public endpoint and the answer has to be send back vice versa.

For example device with IPV4 address 192.168.1.23 want to do a post request via port 443 to IPV4 address 3.4.2.4, but the gateway has only a IPV6 address on the Wan side.

What do i have to configure to let the situation above work?

I have OpenWRT installed on a Raspberry PI CM4 and use a cellular connection as WAN to my ISP, i only get a IPV6 address from my ISP because of shortage of IPV4 addresses.

It depends on how the ISP supports access to the v4 Internet. In the case of T-Mobile they use NAT464 with DNS64. You can test this with nslookup ipv4only.arpa using the ISPs DNS. If a v6 result is returned they support 464. Installing the 464xlat package should just work. Once 464 sets up, under the hood you have a default v4 route via the 464 interface that was created. The LAN endpoint will be NATd to the 464 interface's IP (192.0.0.1, but it really doesn't matter) and then made into a v6 packet with the low 32 bits of the destination address being the v4 site that will be reached. The ISP will intercept that packet (based on its destination address prefix) and NAT it to the v4 Internet.

If you control both sides you have multiple options.

  • Ip4 in ip6 tunnel
  • Wireguard for instance, and just route the v4 traffic over that tunnel
  • If you need pseudo layer 2, the use vxlan.

But from your question, it sound more like:
If you need ipv4 internet access from an IPv6 only LAN then you need dns64 and nat64 on your dual stack edge/border router. But you need a ipv4 address.

If don't have them then maybe your ISP provides nat64 and dns64 but you need to check this first.

This can be done with Tailscale on OpenWRT and the remote end.

I will test nslookup

i can only control my side not the remote endpoint.
My ISP is KPN, KPN doesn't provide NAT64 and DNS64.

They recommend to use google NAT64


I get this answer

That is the answer that a DNS64 will provide, but if you are using Google DNS64 it doesn't tell you anything about your ISP.

Does ping 64:ff9b::0808:0808 go through? They may be providing NAT64 but not DNS64. I don't think there are any third-party NAT64s. They are all part of an ISP's network and only serve requests from their customer side.

No, ping 64:ff9b::0808:0808 doesn't go through.
What do i have to configure to let this work?

Your ISP must then use some other tunneling method to provide v4 compatibility. I'm only familiar with 464 but there are several others. Find out which one they use.

I changed to another simcard and now 64:ff9b::0808:0808 does go through, i get a answer.
I still have a IPV6 only wan

It looks like i have IPV4 connection with 464xlat, i can ping 8.8.8.8 now.

But if i enter a IPV4 address in browser, then it doesn't navigate to the page behind that server.
I have a application in my local network that do post en get request to IPV4 address with port 443

Can you ping that specific IPv4 address or even SSH into the device?

I tested with our fiber network with IPV4 access, but ping does not work.
SSH does work with IPV4 fiber connection.
When i change to the 4G connection IPV6 only with 464xlat SSH does not work anymore.

Does someone have a solution?

Did you look at Tailscale?

Yes i looked at it, but i can't install it on the remote endpoint, only at my openwrt router

Can you install a Tailscale Exit Node with Subnet Route enabled on the remote LAN?

No that's not possible because i can't install anything on the remote endpoint.

To be clear, when you say endpoint does that includes the LAN on which that endpoint resides?

No the endpoint is a server with public IPV4 address, only port 443 is open on that server for get/post requests.
The application who has to send data to that server only sends the data via IPV4 not IPV6.
But my router is a openwrt router with 4G access and has only a IPV6 public wan address.