Routing – Remotely Connecting an IPv6 Computer to a IPv6 Private Web Server

IPv6 has more options for configuring addresses than IPv4. The process works as follows:

1. A new client joins the network and sends a Router Solicitation (RS)
2. Each router (can be multiple) sends a Router Advertisement (RA)
   • This happens both on request (when receiving an RS) as well as periodically
3. The RA contains a lot of information on how the network is run:
   • If the router sending the RA can be a default gateway, and for how long
   • Telling clients if there is a stateless (not giving out addresses, only providing extra information like DNS settings) DHCPv6 server on the network (the O=other flag)
   • Telling clients if there is a stateful (like in IPv4) DHCPv6 server on the network (the M=managed flag)
   • Telling clients about the prefixes in use on the network
     • For each prefix: tell the clients if they can auto-configure an address by themselves (the A=autoconf flag)
   • And possibly lots of other stuff

If you want to run a fully managed network where the DHCPv6 server manages all the addresses (and please think why you want this before choosing it, if you don't use the information in the DHCPv6 server then letting clients configure their own addresses is much easier) then the router has to turn off the A (autoconf) flag for every prefix it announces and turn on the M (managed) flag so that clients know that they are not allowed to choose their own addresses but that there is a DHCPv6 server available to help them.

This is how to do that on a Cisco router:

; Go to the interface configuration
interface FastEthernet0/0
  ; Tell clients that auto configuration is not allowed
  ; This changes the default parameters.
  ; You have to specify the timers, so I use the standard values
  ipv6 nd prefix default 2592000 604800 no-autoconfig
  ;
  ; Tell the clients that there is a stateful DHCPv6 server available
  ipv6 nd managed-config-flag

; Repeat this for every (sub)interface where you want to force clients to use DHCPv6.

Also note: You need those RA packets. DHCPv6 only provides information, and optionally addresses. It does not provide a default gateway. That is done using RA. The idea here is that routers usually have better information on routing and gateways than DHCP servers, with the added benefit that you can have multiple routers on one subnet acting as default gateways with clients load balancing between them etc.

Answers to your questions:

1. No, just because device supports IPv6 it doesn't mean it support IPv4<>IPv6 transition mechanisms - they're not part of IPv6 protocol specification. So, it may support translating traffic from IPv4 to IPv6 and vice versa but it needs to support mechansism like NAT64.

2. Nodes communicate with the protocol of their choice, depending on the higher layer calls. If your browser points to a name, and the name resolves to IPv4 only, IPv4 will be called in to service it. If it resolves to both IPv6 and IPv4, IPv6 should take precedence, but a lot was done in recent years to make both calls simultaneusly and check which one is faster.

3. You need to have node that is dual-stacked, so supports both IPv4 and IPv6 or have support of translating between protocols somewhere along the way. If your router supports it - fine, if your ISP supports it - it's also fine.

4. You should see IPv6 as it should take precedence. If not, your IPv6 connectivity, at least to this specific site is broken. If you can use only IPv6 (you are not dual stacked) you can only reach around 4-5k prefixes around the internet, which is very small percent (out of 500k for IPv4). Normally, hosts are dual-stacked however, so you should be fine - using IPv6 for IPv6-enabled services, and IPv4 for all the rest.

5. That depends on the type of the service your ISP provides. You may have private IPv4 assigned to your internet interface, and it gets translated somewhere at the ISP edge. You may have public IPv4.

6. For SSL/TLS you're using names, not IPs directly. You should be fine.

7. Yes, while there are still works to provide NAT services for IPv6, general idea about IPv6 was to stop doing NAT, and provide global connectivity. It means that with IPv6 assignment, your entire internal network may be directly reachable from other parts of the internet, if you're using IPv6 addresses from the Global Unicast space. For IPv6 you can use other types, like for example Link Local only, which would provide internal connectivity, but block ability to access from remote locations. Generally, you should filter the traffic at the edge of your network if you don't want the internet to access your resources/nodes.

8. Unfortunately, I don't understand the question. Cloud services are usually OK with IPv6, Amazon at least is.

9. Start from here: http://test-ipv6.com/