Tunnels. Jean Yves Le Boudec 2015

Transcription

1 Tunnels Jean Yves Le Boudec 2015

2 1. Tunnels Definition: a tunnel, also called encapsulation occurs whenever a communication layer carries packets of a layer that is not the one above e.g.: IP packet in UDP IP in TCP PPP(layer 2) packet in UDP IPv4 in IPv6 IPv6 in IPv4 Why used? In theory: never In practice: security / private networks / IPv6 IPv4 interworking 2

3 3 Homer s Network Homer deploys 10.x addresses in two sites and wants to interconnect them as one (closed) private network A Simpscom B 10.1/ /16 How can Homer use Simpscom s network for that?

4 Your solution 1. Run RIP in A and B 2. Rent a leased line from Simpscom 3. Configure a tunnel between A and B 4. Use modems between A and B 5. It is impossible because 10/8 is for private networks only 6. I don t know 0% 0% 0% 0% 0% 0%

5 Homer uses an IP over IP Tunnel X S Homer configures a virtual interface in A (eth ); Associates this interface with an IP in IP tunnel, with endpoint Similar stuff in B Homer has a network with 2 routers and one virtual physical link; Homer configures routing tables at A and B (or runs RIP) Packets from S to X are carried inside IP packets across Simpscom 5

6 S sends a UDP packet to X. What are the IP destination address and protocol at O? O 1. IP dest addr = , protocol = 17 (UDP) 2. IP dest addr = , protocol = 17 (UDP) 3. None of the above 4. I don t know 0% 0% 0% 0%

7 Homer s IP in IP solution is often replaced by IP in UDP Some company firewalls kill IP in IP packets Therefore the tunnel is inside UDP This requires a layer 2 header as well (to identify the protocol type) called L2TP / PPP Outer packet To prot = UDP UDP hdr L2TP/PPP prot = IPv4 To prot = UDP UDP hdr data Inner packet 8

8 Bart does the same as Homer but wants a secure channel. He uses IPSEC. «IPSEC / ESP tunnel mode» encrypts the inner IP packet Outer packet To prot = UDP UDP hdr L2TP/PPP prot = 50 IPSEC ESP hdr xxxxxxxxxxx xxxxxxxxxxx IPSEC Trailer Nxt Hdr = 04 Inner packet, encrypted This form of tunneling is called «L2TP/IPSEC VPN» (Virtual Private Network) Variants (OpenVPN): IP in TLS over TCP ; IP in TLS over UDP 9

9 How does a packet from B to A find its way? A wireless LAN VPN Router (IPSec server) EPFL /24 R /24 B Ethernet IP adapter hdr IP Wireless data Network Connection: Connection-specific DNS Suffix. : IP Address : Subnet Mask : Default Gateway : VPN router does proxy ARP 2. R has a host route to A 3. Nothing special, the IGP takes care of it 4. I don t know Ethernet adapter Local Area Connection 2: Connection-specific DNS Suffix. : epfl.ch IP Address : Subnet Mask : Default Gateway : % 0% 0% 0%

10 to 6 over 4 Reminder: interoperation scenarios v4 v6 IPv4 and IPv6 are incompatible v4 only host cannot handle IPv6 packets v6 only host cannot handle IPv4 packets What needs to be solved: interworking: h6 to h4 like to like access 6 to 6 over 4 4 to 4 over 6 In this module we study like to like access

11 Like to like access scenarios 6 to 6 over 4 (The early adopter problem) e.g. Homer wants to use IPv6; ISP provides only IPv4 access IP4/6 Router IP4/6 Router IPv6 Island A IPv4 B IPv6 internet 4 to 4 over 6 (The legacy problem) e.g. Bart continues to use IPv4; ISP provides only IPv6 access IP4/6 Router IP4/6 Router IPv4 Island A IPv6 B IPv4 internet 13

12 Tunnels for 6 to 6 over 4 All like to like solutions use IP in IP tunnels protocol / next header = 04 means the payload is an IPv4 packet protocol / next header = 41 means the payload is an IPv6 packet IP4/6 Router IP4/6 Router 2001:bebe:1 IPv6 Island A IPv B IPv6 internet IPv4 Header da = protocol = 41 IPv6 Header da = 2001:bebe:1 IPv6 Header da = 2001:bebe:1 IPv6 Header da = 2001:bebe:1 Payload Payload Payload 14

13 What needs to be put in place for a good 6 to 6 over 4 solution We need relay routers (e.g. A and B): these are routers that are dual stack (IPv4 and IPv6) can terminate IPv6 in IPv4 tunnels: encapsulate / decapsulate know how to forward packets on their IPv4 and IPv6 sides We also need to solve the IPv6 address allocation problem Homer does not receive an IPv6 address from his provider since Homer s IPv6 island is connected to an IPv4 only provider We need automatic tunnels e.g. A does not need to keep state information to determine that a packet should be sent to B 15

14 6rd/6to4 is a solution to the 6 to 6 over 4 problem Several solutions are proposed and implemented 6rd /6to4: we will see 6to4 in detail ; this is the solution that works in IEW; 6rd is similar to 6to4 Teredo : a variant when IPv6 host is behind an IPv4 NAT ISATAP : a variant for enterprise networks warning 6 to 4 is a misnomer; 6to4 is a solution for 6 to 6 over 4, not for h6 to h4 interworking 16

15 6to4 Uses Special IPv6 Addresses called 6to4 addresses To any valid IPv4 address n we associate the IPv6 prefix 2002:n / 48 example: the 6to4 address prefix that corresponds to is 2002: 80b2:9c26/ ::/16 is the prefix reserved for 6to4 addresses An IPv6 address that starts with 2002: is called a 6to4 address The bits 17 to 48 of a 6to4 address are the corresponding IPv4 address A 6to4 host or router is one that is dual stack and uses 6to4 as IPv6 address As we do in the IEW In addition, the IPv4 address is reserved for use in the context of 6to4 addresses and means the IPv6 internet seen from the IPv4 internet 17

16 18 6to4 Addresses Solve Homer s IPv6 Address Allocation problem Homer enables 6to4 on his router A. Homer s router A uses a 6to4 address prefix derived from of an IPv4 address given to you by your IPv4 provider and uses this prefix for the IPv6 Local Network. Homer s PC H2 obtains from A (e.g. using SLAAC) an IPv6 address with this prefix. This is the setting we use in the IEW. Bart has an isolated host H2 (e.g. smartphone) and enables 6to4 on his host. Bart s host uses one IPv6 address derived from his IPv4 current address. IPv6 host H1 11 IPv6 Local Network 2002:0102:0304 :00ab:EUI S :0102:0304 :abcd:eui H1 6to4 router A IPv to4 Relay router B 3 4 6to4 host H2 2002:0908:0706 ::EUI H2 IPv6 5 IPv6 host H3 2001:bebe::1

17 6to4 Relay Routers 6to4 Relay Router = a dual stack router that has a 6to4 address, can terminate routers and connects the IPv4 and IPv6 internets All v4 interfaces of all 6to4 relay router have an IPv4 address plus the special address B announces /24 as directly attached prefix in IPv4 routing B announces 2002/16 as directly attached prefix in IPv6 routing IPv6 host H1 11 IPv6 Local Network 2002:0102:0304 :00ab:EUI S :0102:0304 :abcd:eui H1 6to4 router A IPv to4 Relay router B 3 4 6to4 host H2 2002:0908:0706 ::EUI H2 IPv6 5 IPv6 host H3 2001:bebe::1 19

18 20 Homer at H1 sends a packet to Lisa at H3 IPv6 host H1 11 IPv6 Local Network 2002:0102:0304 :00ab:EUI S :0102:0304 :abcd:eui H1 6to4 router A IPv to4 Relay router B 6to4 host H2 IPv6 Destination 2001:bebe::1 is not on link, H1 sends to send to A :0908:0706 ::EUI H2 3 4 Default IPv6 route inside local IPv6 network is the IPv6 local address of A (point 12) A s default IPv6 route is 2002:c058:6301::0, which is a 6to4 address corresponding to IPv6 host H3 2001:bebe::1 A encapsulates the IPv6 packet in an IPv4 packet with destination address The nearest 6to4 relay router receives the packet (assume it is B) B decapsulates packet and sends an IPv6 packet; normal IPv6 forwarding occurs and original IPv6 packet reaches H3 5

19 Which is the IPv6 source address at 3 in the encapsulated packet going from H1 to H3? IPv6 host H1 11 IPv6 Local Network 2002:0102:0304 :00ab:EUI S :0102:0304 :abcd:eui H1 6to4 router A :0102:0304:00ab:EUI S :0102:0304:abcd:EUI H1 4. None of the above 5. I don t know IPv to4 Relay router B 3 4 6to4 host H2 2002:0908:0706 ::EUI H2 IPv6 5 IPv6 host H3 2001:bebe::1 0% 0% 0% 0% 0%

20 IPv6 host H1 11 Lisa at H3 sends a packet to Homer at H1 How is this packet routed in the IPv6 internet? IPv6 Local Network 2002:0102:0304 :00ab:EUI S :0102:0304 :abcd:eui H1 6to4 router A IPv to4 Relay router B 3 4 6to4 host H2 2002:0908:0706 ::EUI H2 1. H3 keeps in its routing table the information that Homer s destination address is reached via B and sends the IPv6 packet to B 2. routers in the IPv6 internet send all packets to 2002/16 to the nearest 6to4 relay router 3. routers in the IPv6 internet know that the IPv4 destination address is and compute the best path to A 4. I don t know? IPv6 5 IPv6 host H3 2001:bebe::1 0% 0% 0% 0%

21 What is Bart s IPv6 s default gateway at H2? IPv6 host H1 11 IPv6 Local Network 2002:0102:0304 :00ab:EUI S :0102:0304 :abcd:eui H1 6to4 router A IPv An address configured by DHCP 2. An address configured by SLAAC 3. A 6to4 address derived from I don t know to4 Relay router B 3 4 6to4 host H2 2002:0908:0706 ::EUI H2 IPv6 5 IPv6 host H3 2001:bebe::1 0% 0% 0% 0%

22 Which way does a packet go from Bart s host to Homer s? IPv6 host H1 11 IPv6 Local Network 2002:0102:0304 :00ab:EUI S :0102:0304 :abcd:eui H1 6to4 router A IPv to4 Relay router B 3 4 6to4 host H2 2002:0908:0706 ::EUI H2 IPv6 5 IPv6 host H3 2001:bebe::1 1. via B and back 2. directly over IPv4 to A then H1 3. H1 cannot be reached from H2 4. I don t know 0% 0% 0% 0%

23 28 My Windows PC at EPFL Ethernet adapter Local Area Connection: Connection-specific DNS Suffix. : epfl.ch IPv4 Address : Subnet Mask : Default Gateway : Tunnel adapter Local Area Connection* 15: Connection-specific DNS Suffix. : epfl.ch IPv6 Address : 2002:80b2:97ca::80b2:97ca Default Gateway : 2002:c058:6301::c058:6301

24 The nearest 6to4 relay from EPFL C:\> tracert Tracing route to over a maximum of 30 hops 1 <1 ms <1 ms <1 ms cv-ic-dit-v151.epfl.ch [ ] 2 <1 ms <1 ms <1 ms c6-gigado-1-v100.epfl.ch [ ] 3 <1 ms <1 ms <1 ms c6-ext-v200.epfl.ch [ ] 4 1 ms <1 ms <1 ms swiel2.epfl.ch [ ] 5 <1 ms <1 ms <1 ms swils2-10ge-1-2.switch.ch [ ] 6 2 ms 2 ms 2 ms swibe1-10ge-1-1.switch.ch [ ] 7 2 ms 2 ms 2 ms swibe2-10ge-1-4.switch.ch [ ] 8 2 ms 2 ms 2 ms

25 The nearest 6to4 relay from my home C:\> tracert Tracing route to over a maximum of 30 hops 1 1 ms 2 ms 2 ms ms 136 ms 136 ms lau01a05.sunrise.ch [ ] ms 135 ms 136 ms * * * Request timed out ms 186 ms 333 ms ms 164 ms 164 ms ms 203 ms 169 ms zr-fra1-te x-win.dfn.de [ ] ms 163 ms 162 ms zr-erl1-te x-win.dfn.de [ ] ms 162 ms 162 ms Trace complete. 30

26 31 IPv6 host H1 11 IPv6 Local Network IEW 2002:0102:0304 :00ab:EUI S :0102:0304 :abcd:eui H1 6to4 router A IPv rd to4 Relay router B 3 4 6to4 host H2 2002:0908:0706 ::EUI H2 IPv6 5 IPv6 host H3 2001:bebe::1 The prefixes /24 and 2002/16 are provider independent : Homer connects to the nearest 6to4 relay router Some ISPs don t like that and want more control: they want their relay routers to be used by their customers only and they want their customers to use only their relay routers. 6rd is a modification and replacement of 6to4 where 6rd addresses are not in 2002/16 but in a block allocated to the ISP Relay router s IPv4 addresses are specified by ISP 6rd is deployed by Free (FR); 6to4 is deployed by Switch (CH)

27 Teredo 6to4 / 6rd require a valid IPv4 address and do not work behind a NAT unless NAT is modified OK for ISPs who control the NAT (e.g. Swisscom) Teredo is a variant of 6to4 invented (by Microsoft) to solve the NAT case without altering the NAT Uses : address block 2001:0/32 Tunnels (IPv6 in UDP in IPv4) (UDP is used to be compatible with existing NAT and firewall filtering rules) relay routers (called «teredo relays») teredo servers > for solving the NAT mapping problem 32

28 33 My Windows PC at home has access to IPv6 over IPv4 by means of Teredo Tunnel adapter Local Area Connection* 11: Connection-specific DNS Suffix. : IPv6 Address : 2001:0:5ef5:79fd:2c63:b421:ab1c:1f40 Link-local IPv6 Address..... : fe80::2c63:b421:ab1c:1f40%12 Default Gateway : :: C:\Users\leboudec>tracert 2001:620:618:19c:1:80b2:9c18:1 Tracing route to lca1srv2.epfl.ch [2001:620:618:19c:1:80b2:9c18:1] over a maximum of 30 hops: 1 * * 135 ms teredo-relay2.lrz.de [2001:4ca0:0:103:0:3544:1:2] ms 136 ms 137 ms vl-6.vss1-2wr.lrz.de [2001:4ca0:0:103::1:1] ms 136 ms 136 ms vl-3066.csr1-2wr.lrz.de [2001:4ca0:0:66::1] ms 139 ms 137 ms xr-gar1-pc x-win.dfn.de [2001:638:c:a003::1] ms 163 ms 164 ms zr-fra1-te x-win.dfn.de [2001:638:c:c070::1] ms 163 ms 163 ms dfn.rt1.fra.de.geant2.net [2001:798:14:10aa::1] ms 162 ms 163 ms so rt1.gen.ch.geant2.net [2001:798:cc:1401:2201::a] ms 203 ms 152 ms switch-lb2-gw.rt1.gen.ch.geant2.net [2001:798:12:10aa::a] ms 163 ms 163 ms swiel2-10ge-1-3.switch.ch [2001:620:0:c06a::2] 10 * * * Request timed out ms 164 ms 165 ms cv-gigado-v200.epfl.ch [2001:620:618:1c8:1:80b2:c803:1] ms 164 ms 163 ms cv-ic-dit-v100-ro.epfl.ch [2001:620:618:164:1:80b2:640c:1] ms 163 ms 164 ms lca1srv2.epfl.ch [2001:620:618:19c:1:80b2:9c18:1] Trace complete.

29 Summary: 6 to 6 over 4 6 to 6 over 4 solves the early adopter problem main solution is 6rd/6to4, with IPv6 in IPv4 tunnels a portion of IPv6 address space used to contain 6rd/6to4 addresses; prefix in such addresses embed a valid IPv4 address tunnels are automatic thanks to the presence of the IPv4 address embedded in the IPv6 prefix relay routers terminate tunnels and announce appropriate address blocks in IPv4 and IPv6; relay routers are stateless Teredo is a variant that supports hosts behind IPv4 NATs without configuration of the NAT 34

30 3. 4 to 4 over 6 The Legacy Problem IP4/6 Router IP4/6 Router IPv4 Island A IPv6 B IPv4 internet Problem is similar to 6 to 6 over 4 but there are two main differences impossible to embed IPv6 addresses in IPv4 addresses IPv4 addresses may not be available Many solutions are proposed or even deployed; XLAT uses NAT64 and no tunnel DS lite is the simplest MAP E is an improvement to DS lite 35

31 36 DS Lite tunnels all IPv4 traffic to a Carrier Grade NAT IPv4 host H :baba:bebe:: :baba:be00::77 Carrier Grade NAT B to IPv4 Local Network DS-lite box A IPv6 3 4 IPv4 5 IPv4 host H at H1, IPv4 destination is not onlink, packet sent to router A at A, destination matches only default route and IPv4 packet is sent into tunnel to B B decapsulates packet, translates IPv4 source address and source port (e.g. 2345) to an IPv4 mapped address (e.g ) and to a possibly different port number (e.g. 5432)

32 Carrier Grade NAT is stateful B needs to remember the (v4 address, port) mapping the IPv6 source address of A. In the NAT table at B we see: IPv6 DS lite box address IPv4 address port IPv4 translated address 2001:baba:bebe:: NAT Table at B translated port B does this for all customers and for every flow served by this provider. The NAT table may be very large. This is called a Carrier Grade NAT. 37

33 H1 sends one packet to H3 and H3 responds. We observe the response at 5. Say what is true. IPv4 host H1 11 IPv4 Local Network :baba:bebe:: DS-lite box A IPv6 2001:baba:be00::77 Carrier Grade NAT B to ? IPv4 5 IPv4 host H The IPv4 destination address in the packet is The IPv4 destination address in the packet is The IPv6 destination address in the packet is 2001:baba:bebe:: and and 3 6. I don t know 0% 0% 0% 0% 0% 0%

34 40 464XLAT is similar to DS lite but replaces IPv4 host H1 11 IPv4 Local Network For H1 s address: encapsulation by translation :baba:bebe/ CLAT CLAT performs stateless header translation IPv4 < > IPv6. E.g is mapped to 2001:baba:bebe::a16:202c PLAT performs stateful header translation IPv4 < > IPv6 and port number translation; Eg 2001:baba:bebe::a16:202c port 3456 is mapped to port 4567 For H3 s address IPv6 2001:baba:be00/643 PLAT to IPv4 IPv4 host H CLAT and PLAT peform stateless translation, e.g is mapped to 2001:baba:be00::c817:

35 41 MAP E (Mapping Address + Port, Encapsulation) IPv4 host H1 11 IPv4 Local Network :baba:be00:abcd: :baba:bebe:0706::0102:0300: MAP box A IPv6 MAP Border Relay B to IPv4 5 IPv4 host H Problem with DS Lite is the Carrier Grade NAT for very large ISPs MAP E solves the problem by putting address translation in the local network (in MAP box A) instead of the CGN translated port number and IPv4 address are mapped to a part of the IPv6 address

36 with MAP E, translated IPv4 address and port are embedded in IPv6 prefix MAP box A owns the IPv6 address prefix 2001:baba:bebe: are called the EA bits of the MAP IPv6 address A MAP rule at A specifies which bits are the EA bits; further, the MAP rule is used as follows 07 determines the available bits in the translated IPv4 address e.g specifies that the value of the bits 5 to 12 of the translated port numbers must be (hexa)06 for example the port ae1f can be mapped to b06a The complete IPv6 address of MAP box A is algorithmically derived from the MAP rule e.g. here 2001:baba:bebe:0706::0102:0300:

37 Homer at H1 sends one packet to Lisa at H3 IPv4 address port (hexa) IPv4 translated addr. translated port ae1f b06a NAT Table at A at H1, IPv4 destination is not onlink, packet sent to router A A performs NAT44 and translates IPv4 addresses and port; translated IPv4 packet is sent into tunnel to B B decapsulates packet and sends over the v4 43

38 H1 sends one packet to H3 and H3 responds. We observe the response at 3. Say what is true.? 1. The IPv6 destination address is determined algorithmically from the destination IPv4 address and port number seen at point 4 2. The IPv4 destination address and port number are the same as at point and 2 4. None 0% 0% 0% 0% 0% 5. I don t know

39 Summary: 4 to 4 over 6 4 to 4 over 6 (the legacy problem) is solved by NAT and IPv4 in IPv6 tunnels DS Lite is simple but requires NAT44 function in the relay router. Works only for small ISPs. 464XLAT is similar. MAP E is a variant which distributes the NAT44 function close to the IPv4 customer, i.e. is more scalable. MAP T is like MAP E but with translation instead of encapsulation. 46

40 47 4. Transition to IPv6 We have seen 4 different families of mechanisms for the interoperation of IPv4 and IPv6 Interworking ALG64 (application layer) NAT64 (protocol translation) Like to like 6rd or 6to4 (6 to 6 over 4) DS lite, 464XLAT, MAP E, MAP T (4 to 4 over 6) The multiplicity of solutions is a symptom that the transition to IPv6 is difficult Let us try to imagine which mechanisms can be used

41 You are network manager at EPFL and want to upgrade to IPv6. Which elements do you deploy? 1. ALG64 2. NAT rd 4. MAP E 5. MAP T 6. I don t know 0% 0% 0% 0% 0%

42 You are network manager at simpscom and want to save money by deploying only IPv6 in your cellular network. Which elements do you deploy? 1. ALG64 2. NAT rd 4. MAP T 5. I don t know 0% 0% 0% 0% 0%

43 You work from home and have only IPv4 access; you need to upload a proposal to NSF. NSF accepts only IPv6. What do you need to enable on your PC? 1. 6to4 2. Teredo 3. ALG64 4. NAT64 5. I don t know 0% 0% 0% 0% 0%

44 Conclusion Tunnels are an ad hoc solution used in many cases secure access over an insecure network, VPN like to like access for IPv6/IPv4 issues Transition to IPv6 creates several types of problems (early adopter, legacy) that can be solved with various methods involving automatic tunnels and header translation promises a lot of fun! 54