6in4 IPv6 Tunnel natively on Technicolor TG582n

[#1]

Hi,
Since the IPv6 Technical trial ended I've been wondering how to provide a usable IPv6 alternative until the full service trial begins. My solution is to configure the Technicolor TG582n to use a 6in4 IPv6 Tunnel (RFC4213 http://tools.ietf.org/html/rfc4213).
We send this router to all new customers as standard and we're currently in the early stages of testing the 10.2.1.8 version of the firmware which includes, amongst other things, full IPv6 support.
One of the mechanisms for supporting IPv6 is via a RFC4213 6in4 tunnel, this allows IPv6 traffic to be encapsulated in IPv4 packets. Any IPv4 host can encapsulate IPv6 traffic like this to gain full IPv6 support, it is trivial to set up one of these tunnels on a computer but more complicated to set up on a router. The biggest problem is that the IPv4 tunnel route, local IP address and prefix delegation need to be set up manually, there is no automated way to configure this.
This post details how to configure a TG582n router to use a 6in4 tunnel to provide both an IPv6 address to the router and to give the LAN a globally addressable IPv6 subnet via Router Advertisements/NDP. Please let me know how you get on.
You'll need:
Technicolor TG582n Router
Firmware version 10.2.2.B (available here: http://products.plus-payh.co.uk/firmware/) [LINK UPDATED 27/02/2013]
Telnet access to the router
Static IPv4 Address
Some technical knowhow
Step 1 - Get an IPv6 Prefix
We'll be using http://www.sixxs.net for our tunnel. Go to their website and sign up for an account. Once your account is approved you'll need to apply for a static tunnel. You could apply for a Heartbeat or AYIYA but these are designed for hosts behind a NAT or with a dynamic IPv4 address, they also need special software to make them work, with these you could have IPv6 on your network but you'd need a server to manage it.
I signed up, activated my account, applied for a tunnel and had it all approved in under 2 hours.
Now that your tunnel has been approved you should have all the details in an email, just like the one below which I'll be using for my example.

Quote

To: Matt Turner <> Subject: [SixXS] Tunnel Approval T100518 (MTA4-SIXXS) From: SixXS <info@sixxs.net>  Tunnel Id          : T100518  PoP Name           : gblon03 (uk.gyron [AS29017])  TIC Server         : tic.sixxs.net (which is the default in AICCU)  Your Location      : Sheffield, gb  SixXS IPv6         : 2a00:14f0:e000:b7::1/64  Your IPv6          : 2a00:14f0:e000:b7::2/64  SixXS IPv4         : 212.113.147.150  Tunnel Type        : Static (Proto-41)  Your IPv4          : 212.159.16.79

Step 2 - Configure the Tunnel
Log into the Telnet interface of your router.
Create a tunnel

:tunnel 6in4 add ifname=6in4tunnel

Configure the tunnel using the SixXS IPv4 address given in the email

:tunnel 6in4 modify ifname=6in4tunnel sourceintf=Internet destination=212.113.147.150

Route all IPv6 traffic over the new tunnel

:ip rtadd dst=::/0 intf=6in4tunnel

Tell the router its new IPv6 address (the IPv6 Address in the email). Change the subnet mask from 64 to 128 otherwise the 64 subnet route is on the Local Network (not correct)

:ip ipadd intf=LocalNetwork addr=2a00:14f0:e000:b7::2/128 addroute=enabled

Step 3 - Test the Tunnel
See if you can talk to the SixXS IPv6 address at the other end of the tunnel (given in the email)

:ping proto=ip addr=2a00:14f0:e000:b7::1

See if you can talk to Google over IPv6

:ping proto=ip addr=2a00:1450:4007:804::1011

Good, IPv6 is working, you can talk out, but incoming connections will be refused by the firewall and NAT systems.
Step 3 - Configure the firewall and NAT
Allow all traffic through the firewall from the IPv4 tunnel originating address (given in the email):

:expr add name=6in4ipv4 type=ip addr=212.113.147.150
:firewall rule add name 6in4 chain sink_fire action accept srcip 6in4ipv4 srcintf wan state enabled

All traffic from the IPv4 Tunnel address needs to go to the router (again, use the IPv4 address given in the email as the foreign_addr value). In this command, the router automatically maps 0.0.0.1 to the first IPv4 address of the Internet interface.

:nat tmpladd intf=Internet type=nat protocol=ipv6 outside_addr=0.0.0.1 inside_addr=0.0.0.1 foreign_addr=212.113.147.150

Step 4 - Set up a server for the outside world to talk to
Enable the IPv6 Ping Responder on the tunnel interface

:service system modify name=PINGv6_RESP state=enabled
:service system ifadd name PINGv6_RESP intf 6in4tunnel 

Test the server using the tool here http://www.mebsd.com/ipv6-ping-and-traceroute and check that your IP address (2a00:14f0:e000:b7::1) is pingable.
Your router is now IPv6 enabled, time to share it on the internal LAN.
Step 5 - Setting up prefix advertisements on the LAN
Run these commands using your IPv6 prefix which you can find by logging into your SixXS account and looking under the subnet section. It is not the same as your tunnel address.

:ip rt6advd ifdetach intf=LocalNetwork
:ip rt6advd pfxadd intf=LocalNetwork prefix=2a00:14f0:e000:80b7::/64 vltime=2592000 pltime=604800 aflag=enabled lflag=enabled
:ip rt6advd ifattach intf=LocalNetwork

Good, now your router is broadcasting this prefix to all the machines on your LAN, if they're ready to accept an IPv6 address then they'll configure themselves automatically.
Goto http://www.thinkbroadband.com/ipv6/ and check that you're IPv6 enabled.

You could also fire up wireshark and check the router advertisements are as expected

Or you could set up a Think Broadband ping monitor

[#2]

You may want to remove your email address from the above post
Regards
Mike

[#3]

Whoops, forgot about that.

[#4]

Can this router be used on FTTC? If not is there a recommended router that'll act as the endpoint for an HE 6in4 tunnel handing out local IPv6 addresses and thus supporting several local devices?
If the TG582n does work would PN be willing to let me have one? I want to learn about this IPv6 lark and it'll make be trial ready

[#5]

Yeah, the 582 can be used for FTTC.  The firmware needs a reflash and it will use one of the ethernet ports as the modem uplink port.

[#6]

Thanks for that, I assume the firmware is the one mentioned in the first post. Is there a manual for that version one can download from somewhere?

[#7]

Yay, following Matt's awesome instructions I have this all setup
Only problem I found was the http://www.thinkbroadband.com/ipv6/ told me I was still using IPv4 but I could access http://ipv6.google.com ok. So I tried http://ipv6.thinkbroadband.com/ipv6/ and lo an behold I get a "Yay you're using IPv6". I guess this is because my Windows 7 is defaulting to using IPv4? As most stuff is still using IPv4 I think I prefer that but for future reference is there a way to get the W7 to use v6 in preference so http://www.thinkbroadband.com/ipv6/ works for me?

[#8]

Maybe IPv4 is the default when using a 6in4 tunnel (that would make some sense), I'm sure that IPv6 should be 'preferred' when using dual stack.  I doubt it is an issue with Windows 7.

[#9]

Quote from: Picnic

Yay, following Matt's awesome instructions I have this all setup

Excellent! Glad to hear that it all worked for you, I think you're the first to try this from my instructions.

Quote from: walker23

Maybe IPv4 is the default when using a 6in4 tunnel (that would make some sense), I'm sure that IPv6 should be 'preferred' when using dual stack.  I doubt it is an issue with Windows 7.

I didn't have any problems with the TBB site, Ubuntu seems to default to IPv6, I've not tried it on Windows 7 yet. From the way I wrote the instructions, IPv6 is exposed to the network just as if it was a dual stack setup over the PPP interface.

[#10]

The choice of IP transport is a function of the app rather than the OS. The selection, which usually prioritises IPv6 over IPv4 (unless cconfigured to do otherwise), is usually made as a result of a belief that IPv6 transport exists (e.g. the host's IPv6 routing table has been populated with a route out) and whether or not AAAA records are available for the domain name being queried.
Several things can interrupt this time-sensitive process such as temporary routing issues (in IPv6 or the IPv4 tunnel wrapper) which may mean the decision is not made as expected or the subsuent IPv6 connection attempt times out and reverts back to IPv4. It could even be that the browser had cached the A result for the URL and hence opted to use that rather than query for AAAA/A now that IPv6 transport was made available.
Many newer browsers attempt to cut down this sequential decision-and-action making using various techniques often colloquially known as 'happy eyeballs'. Such mechanisms usually make an initial connection attempt over both IPv4 and IPv6 simultaneously and make the final choice based on which transport connected quickest. This circumvents the problem where IPv6 appears to be available but isn't and negates the need to sit around waiting for the futile connection to timeout.
Mathew

[#11]

Thanks for the feedback. I'll try a Linux client as see how that gets on

[#12]

What browser (on Win 7) are you using?

[#13]

Chrome
Just tried IE and it worked without using the IP6 address.
Just tried Chrome again and it worked this time.

[#14]

Hmm, this is not going too well now. The router has reset itself 3 times today after running fine for the last few. Don't think it's temperature related as the first was as around 3am.
There is nothing in the router's log as this seems to start afresh on a reboot. Any ideas on how to diagnose this?

[#15]

This is not working for me the router keeps on resetting and it's triggered by me using my web browser 99% of the time. Generally it's when going to a new page.
Now I notice Matt you said

Quote from: Matt

You'll need: Technicolor TG582n Router Firmware version 10.2.1.8 (available here: http://www.mattturner.plus.com/PN TG582n R10.2.0.B DEMO.bin)

The version for the download is reported as
[quote=my router]
Software Release: 10.2.0.B

Which implies your 10.2.1.8 is a new more improved version. I've googled to see if I can download that version elsewhere but this thread is the only relevant hit. If you're using a new version please can you post a link as otherwise I'll have to put this to one side again.
Edit: Seems that trying to backup the configuration of the router causes it to reset Just tried it 3 times.