> I am not sure I understand the problem you are trying
to solve. It seems
> that your host has an ethernet (say) with an RFC1918
address assigned;
> your host plugs into a router that translates the
host's RFC1918 number
> to and from some globally-routable IPv4 address. You
want for your host
> to use that globally-routable IPv4 address for 6to4.
The address in
> the encapsulated IPv6 packet has to embed the global
IPv4 adddress; the
> encapsulation IPv4 header needs to contain the host's
RFC1918 address,
> which the router will translate. The stf(4)
pseudo-interface does not
> provide for that. Is that about right?
Yes
I encountered this problem several times before. I had a
direct
unfiltered natted address for my host, but I could not use
6to4
because of addresses restrictions. I had a global address
seen from
the internet world, but not from stf. Of course, I could not
change
the router configuration or take it's place...
>
> Can you meet your needs using IP Filter or PF? Or, if
a general-purpose
> tool will not do, doesn't it make sense to isolate the
"DMZ adaptation"
> in its own pseudo-interface? That may benefit more
NetBSD applications
> in a DMZ than a stf(4) modification alone.
>
Yes it's possible, but it may not work in all routers
configuration
(because of ingress filtering) and your machine may be
unreachable in
some cases. To make it working, you can add an alias of the
global
address on one of your interface, and one bimap rule in your
ipnat. I
found several peoples which had this problem and I tried to
implement
a cleaner solution (there are also other patches avalaible
for freebsd
on some posts).
What do you mean by a dmz pseudo interface ?
The dmz part is quite small (just two tests to exit) and is
really
about... tolerance of packet source (in input) or missing
global ip
(to emit). I added lots of security checks wich are not done
actually
and ingress filter for v6 packets (these checks represent
most of the
code). I spent lots of time about security checks. I don't
think that
a packet filter could do such tests which are specific to
the 6to4
traffic.
Rodolphe
--
There is currently insufficient research to definitively
conclude that
unix overuse is an addiction.
|