Tayga NAT64 IPv6与IPv4互访解决方案

NAT64与DNS64是一套解决方案，实现是IPv6网络过渡初期的协议转换与互访，使纯IPv6网络下的用户直接访问现有IPv4 Internet资源，而不修改两端的任何配置。以下通过单独部署一台Centos服务器允许Tayga服务，使得IPv6可以访问IPv4网络。
解决方案拓扑图如下：

部署拓扑图的工作原理图：

测试配置：
-----------------------------------------
setup1：基本环境配置:

[root@tayga ~]# systemctl stop firewalld
[root@tayga ~]# setenforce 0
[root@tayga ~]# yum -y install epel-release
[root@tayga ~]# yum makecache

setup2：配置接口地址：

[root@tayga ~]# vim /etc/sysconfig/network-scripts/ifcfg-ens33 TYPE="Ethernet"
PROXY_METHOD="none"
BROWSER_ONLY="no"
BOOTPROTO="none"
DEFROUTE="yes"
IPV4_FAILURE_FATAL="no"
IPV6INIT="yes"
IPV6_AUTOCONF="yes"
IPV6_DEFROUTE="yes"
IPV6_FAILURE_FATAL="no"
IPV6_ADDR_GEN_MODE="stable-privacy"
IPV6ADDR=fd00:2020:2019::1/64           #配置一个IPv6地址用于IPv6流量进入
NAME="ens33"
UUID="6329b148-f848-41bf-a8a7-3581cf62d334"
DEVICE="ens33"
ONBOOT="yes"
IPADDR="192.168.1.106"
PREFIX="24"
GATEWAY="192.168.1.1"
DNS1="114.114.114.114"
IPV6_PRIVACY="no"

NAT64配置（tayga）:

setup3：安装tayga服务和修改配置文件：

[root@tayga ~]# yum install tayga -y
[root@tayga ~]# cat /etc/tayga/default.conf  | grep -v ^# | grep -v ^$   #默认配置，我只修改了前缀。
tun-device nat64
ipv4-addr 192.168.255.1
prefix fd00:2020::/96
dynamic-pool 192.168.255.0/24
data-dir /var/lib/tayga/default

setup4：给接口nat64配置ipv4和ipv6地址：

[root@tayga ~]# systemctl start tayga@default
[root@tayga ~]# ip addr add 2020:2020::1/96 dev nat64      #地址任意
[root@tayga ~]# ip addr add 192.168.255.1/24 dev nat64
[root@tayga ~]# ip link set nat64 up

setup5：设置dynamic-pool中的地址代理上网：

[root@tayga ~]# yum install iptables-services -y
[root@tayga ~]# iptables -t nat -A  POSTROUTING -s 192.168.255.0/24 -d 0.0.0.0/0 -j SNAT  --to 192.168.1.106
[root@tayga ~]# echo "1" > /proc/sys/net/ipv4/ip_forward
[root@tayga ~]# echo "1" > /proc/sys/net/ipv6/conf/all/forwarding
[root@tayga ~]# ping -I 192.168.255.1 114.114.114.114
PING 114.114.114.114 (114.114.114.114) from 192.168.255.1 : 56(84) bytes of data.
64 bytes from 114.114.114.114: icmp_seq=1 ttl=77 time=34.1 ms
64 bytes from 114.114.114.114: icmp_seq=2 ttl=67 time=33.3 ms
64 bytes from 114.114.114.114: icmp_seq=3 ttl=70 time=32.1 ms
64 bytes from 114.114.114.114: icmp_seq=4 ttl=72 time=35.7 ms
^C
--- 114.114.114.114 ping statistics ---
4 packets transmitted, 4 received, 0% packet loss, time 3005ms
rtt min/avg/max/mdev = 32.160/33.850/35.739/1.313 ms

setup6：设置ipv6前缀和动态地址池地址指向nat64网卡：

[root@tayga ~]# route add -net 192.168.255.0/24 dev nat64    #注意：若nat64接口ipv4地址非192.168.255.0/24的地址需要配置
[root@tayga ~]# ip route add fd00:2020::/96 dev nat64

用纯ipv6机器测试，测试成功：

DNS64配置（bind）:

[root@tayga ~]# yum install bind -y      #安装服务并修改配置文件如下
[root@tayga ~]# vim /etc/named.conf

options {listen-on port 53 { 127.0.0.1; };listen-on-v6 port 53 { fd00:2020:2019::1;::1; };      #添加内网IPv6地址directory     "/var/named";dump-file    "/var/named/data/cache_dump.db";statistics-file "/var/named/data/named_stats.txt";memstatistics-file "/var/named/data/named_mem_stats.txt";recursing-file  "/var/named/data/named.recursing";secroots-file   "/var/named/data/named.secroots";allow-query     { any; };                           #允许所有可查询#设置DNS转发器forwarders  { 202.96.134.133;114.114.114.114; };#下面是DNS64配置项、IPv6前缀、和允许的客户端范围dns64 fd00:2020::/96 {clients { fd00:2020:2019::/64;}; // mapped { !10/8;172.16/12; any; };break-dnssec yes;//exclude { 2020:2019:2018::/96; };suffix :: ;};recursion yes;#安全性设置nodnssec-enable no;dnssec-validation no;/* Path to ISC DLV key */bindkeys-file "/etc/named.root.key";managed-keys-directory "/var/named/dynamic";pid-file "/run/named/named.pid";session-keyfile "/run/named/session.key";
};

[root@tayga ~]# systemctl start named

测试NAT64解析正常：

----------------------------------------
搭建完毕后，测试可以正常访问大多数网站和观看视频，只有部分网站有ipv6地址的可能异常，这跟DNS64解析回来的给的IPV6地址有关系。
----------------------------------------

解决部分网站访问异常:

支持IPv6网站域名会解析如下，主要由于ipv6主机无法访问这些ipv6地址，所以会有些问题。

通过新加一台DNS服务器过滤掉域名解析中的对应的IPV6地址（搭建过程略），named.conf配置如下：

[root@localhost ~]# vim /etc/named.conf
options {listen-on port 53 { 192.168.1.107;127.0.0.1; };directory       "/var/named";dump-file       "/var/named/data/cache_dump.db";statistics-file "/var/named/data/named_stats.txt";memstatistics-file "/var/named/data/named_mem_stats.txt";recursing-file  "/var/named/data/named.recursing";secroots-file   "/var/named/data/named.secroots";allow-query     { any; };forwarders  { 114.114.114.114; };recursion yes;dnssec-enable no;dnssec-validation no;filter-aaaa-on-v4 yes;        #过滤ipv4客户端解析中的ipv6地址//filter-aaaa-on-v6 yes;//filter-aaaa-on-v4 break-dnssec;//filter-aaaa-on-v6 break-dnssec;/* Path to ISC DLV key */bindkeys-file "/etc/named.root.key";managed-keys-directory "/var/named/dynamic";pid-file "/run/named/named.pid";session-keyfile "/run/named/session.key";
};

然后将192.168.1.106的DNS解析指向192.168.1.107即可，

   forwarders  { 192.168.1.107; };

再次测试发现只有ipv4地址返回：

-------------------------------------------------
目前暂时可以用这种方式实现过滤。至此，你的纯IPv6客户端可以访问任何IPv4地址及服务。