Ready for World IPv6 day?

Vincent Bernat

June 8, 2011, will be World IPv6 Day. Ma­jor web com­pa­nies like Google, Ya­hoo! and Face­book will serve their con­tent through IPv6. While some of them al­ready pro­vide IPv6 con­tent, you ei­ther need to use a spe­cial URL or get your con­nec­tion from some se­lected providers, known to pro­vide work­ing IPv6 con­nec­tion (the se­lec­tion is done through DNS).

What’s World IPv6 Day about?#

World IPv6 Day is mostly about ma­jor con­tent providers and net­work op­er­a­tors. End users are not ex­pected to take any spe­cial ac­tions. The con­tent will be pro­vided for one day on IPv6 and IPv4 with­out any spe­cial trick to cir­cum­vent bro­ken IPv6 setup. If you have an IPv4 only con­nec­tiv­ity, all will con­tinue to work (this day is not about switch­ing In­ter­net to IPv6 only). If you have a work­ing IPv6 con­nec­tiv­ity of any kind, you will use it to ac­cess con­tent. How­ever, if you have a bro­ken IPv6 con­nec­tiv­ity, you will find your­self iso­lated dur­ing one day un­til you solve the prob­lem. You can check your con­nec­tiv­ity and de­ter­mine if you will run into trou­ble on World IPv6 Day.

The main point of this day is to check if IPv6 na­tive con­tent can be pro­vided to any­body with­out leav­ing out a large part of the users (the ones with a bro­ken con­nec­tiv­ity) which is the rea­son why we do not al­ready have IPv6 na­tive con­tent ev­ery­where. Google ex­plains it this way:

We con­tin­u­ously con­duct de­tailed mea­sure­ments on the qual­ity of IPv6 con­nec­tiv­ity, and our lat­est re­sults show that mak­ing Google ser­vices gen­er­ally avail­able over IPv6 at this time would lead to con­nec­tion prob­lems and in­creased la­tency for a small num­ber of users. User ex­pe­ri­ence is very im­por­tant to us, and we do not want to im­pact users on net­works that do not yet fully sup­port IPv6. We will con­tinue to re-eval­u­ate the sit­u­a­tion as the IPv6 In­ter­net evolves.

While con­tent providers are in­vited to pro­vide IPv6 con­tent, net­work op­er­a­tors are ex­pected to trou­bleshoot their cus­tomers’ prob­lems (and they can­not with­draw them­selves from this op­er­a­tion since the main change is done by con­tent providers). If they can en­able IPv6 con­nec­tiv­ity, that would be great too but this is not mandatory.

Up­date (2011-06)

It is a shame but Mi­cro­soft’s par­tic­i­pa­tion in World IPv6 day is a “fix” to pre­fer IPv4 over IPv6. More­over, this fix will be re­verted a few days later. Let’s hope that net­work op­er­a­tors do not fol­low the lead by not set­ting up DNS hi­jack­ing to re­move AAAA record.

What can I do?#

Even if you are nei­ther a net­work op­er­a­tor nor a ma­jor player in web con­tent pub­lish­ing, it is ex­pected that World IPv6 Day will also be the play­ground for most IPv6-re­lated things.

As a user#

Check if your ISP pro­vides na­tive IPv6 con­nec­tiv­ity. This can be an opt-in op­tion. For ex­am­ple, in France, Free al­lows its users to en­able na­tive IPv6 con­nec­tiv­ity if they choose the ap­pro­pri­ate op­tion. That is easy to do and you get IPv6 in a mat­ter of minutes.

If your ISP does not pro­vide na­tive IPv6 con­nec­tiv­ity, you can try to bug them about this. This is un­likely to work. You can also get IPv6 through a tun­nel bro­ker like SixXS (cre­ate an ac­count and apt-get install aiccu) or Hur­ri­cane Elec­tric. Wikipedia has a list of IPv6 tun­nel bro­kers. Do not rely on any other tran­si­tion mech­a­nism, they are un­reliable.

As a service provider#

If you host your­self some ser­vices, like your web page or your own mail server, you can en­able IPv6 con­nec­tiv­ity for them as well. Get an IPv6 con­nec­tiv­ity for your ser­vices, ei­ther na­tive or through a tun­nel broker.

Then, en­able IPv6 on each ser­vice you pro­vide. Check that they are lis­ten­ing on IPv6 with ss -6l. All the tips be­low are meant for very sim­ple setup. En­sure that net.​ipv6.​bindv6only is set to 0. Here is what I have done:

  • En­able SSH ac­cess through IPv6. With the de­fault con­fig­u­ra­tion of OpenSSH, this is al­ready done. Check your ListenAddress di­rec­tive if you have one.
  • Serve Web con­tent through IPv6. I am us­ing Ng­inx as a web server and you can mix IPv4 and IPv6 in the same vir­tual host. Set­ting up IPv6 is easy. En­sure that IPv6 sup­port is com­piled in (nginx -V) use listen [::]:80 in­stead of listen 80. Apache is equally easy to con­fig­ure and should even work out of the box since the Listen 80 di­rec­tive will lis­ten to both IPv4 and IPv6 by de­fault. lighttpd also sup­ports IPv6. An easy way to get started is to use server.​use-ipv6 = "enable".
  • En­able IPv6 in Post­fix, Dove­cot, BIND. For all of them, this works out of the box. Nowa­days, most dae­mons will work fine with IPv6 with­out any spe­cial con­fig­u­ra­tion since they will lis­ten to :: by de­fault which means “any IPv4 or IPv6 ad­dress” as long as net.​ipv6.​bindv6only is set to 0. Un­for­tu­nately, there are still some dae­mons that do not sup­port IPv6.
  • Add ap­pro­pri­ate AAAA record to your DNS be­cause pro­vid­ing IPv6 ser­vices is of lit­tle use if your users (in­clud­ing you) can­not ac­cess them with­out typ­ing the ap­pro­pri­ate IP ad­dress. You may also want to pro­vide a NS record reach­able through IPv6.
  • Up­date your mon­i­tor­ing to use IPv6 as well. If you ad­ver­tise IPv6 ser­vice and only IPv4 is work­ing, most IPv6 clients will be un­able to ac­cess them.
  • Adapt your fire­wall. In Linux, Net­fil­ter han­dles IPv4 and IPv6 sep­a­rately. You need to en­sure you set up a cor­rect fire­wall for IPv6 as you have done with IPv4.

Here is a min­i­mal fire­wall that you can adapt:

ip6tables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
ip6tables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
for chain in INPUT OUTPUT; do
  ip6tables -A $chain -m rt --rt-type 0 -j DROP
  ip6tables -A $chain -p icmpv6 --icmpv6-type neighbor-solicitation \
     -m hl --hl-eq 255 -j ACCEPT
  ip6tables -A $chain -p icmpv6 --icmpv6-type neighbor-advertisement \
     -m hl --hl-eq 255 -j ACCEPT
  ip6tables -A $chain -m state --state NEW \
     -p icmpv6 --icmpv6-type echo-request -j ACCEPT
done
ip6tables -A INPUT -i lo -j ACCEPT
ip6tables -A OUTPUT -o lo -j ACCEPT

# Put your rules here!

ip6tables -N REJECT_ALL
ip6tables -A REJECT_ALL -p tcp -j REJECT --reject-with tcp-reset
ip6tables -A REJECT_ALL -p udp -j REJECT --reject-with icmp6-adm-prohibited
ip6tables -A REJECT_ALL -j DROP
for chain in INPUT OUTPUT FORWARD; do
    ip6tables -A $chain -j LOG --log-prefix "$chain-reject: "
    ip6tables -A $chain -j REJECT_ALL
done

Debian status#

There is still a long way for full IPv6 sup­port of all ap­pli­ca­tions in De­bian but it is a re­lease goal since Etch. This is not an easy task since adding IPv6 sup­port on some soft­ware can be re­ally dif­fi­cult. DSA also en­abled IPv6 sup­port on many servers used by the De­bian project in­clud­ing the main web server, the main mir­ror, the se­cu­rity mir­ror and the name servers. You should be able to use De­bian with an IPv6 only access.