[7.950][QUESTION][ANSWERED] IPV6 and Nat on an ASG

Hi folks,
IPv6 doesn't require the NAT function to work. How does this fit in with the ASG configuration and packet filtering?

Does the PF now just limit the range through the ASG eg service definition-> limit access -> 1030:65535?

Does the ASG automatically bypass the NAT configuration?

When using IPv6 internally and an external IPV6 tunnel is NAT applied?

Or will ASG treat IPv6 as if it is a larger IPv4 address range?

Ian M

0 Astaro Beta Bot over 14 years ago

Astaro Beta Report
--------------------------------
Version: 7.950
Type: QUESTION
State: ANSWERED
Reporter: RFCat_vk+
Contributor: 
MantisID: 
Target version: 
Fixed in version: 
--------------------------------

0 da_merlin over 14 years ago

Hi Ian,

in the IPv6 world there is no need for NAT anymore.
Every Host has an IPv6 address which is worldwide reachable.

In WebAdmin there is no difference, except that its now possible to create
incoming rules to LAN hosts:

IPv4 allow: 10.0.0.0/8 HTTP to ANY
IPv6 allow: 2001::/64 HTTP to ANY

Cheers
Ulrich
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 RFCat_vk_01 over 14 years ago in reply to da_merlin

Hi Ulrich,
I understood that, but what I am interested in is does the ASG treat IPv6 outgoing differently to IPv4.

Does it take the internal component of a service and use that to talk to the internet or does it still use NAT?

IPv4 limited UDP/TCP 1030:65535 1:65535
IPv6 limited UDP/TCP 1030:65535

Ian M
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 trollvottel over 14 years ago

Hi RFCat_vk,

there is no NAT for IPv6 (yet). Not only doesn't the ASG support NAT for IPv6, nor does any other system from other vendors. ATM there is just no implementation or standard for NAT for IPv6.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 da_merlin over 14 years ago

Hi Ian,

The ASG treats traffic as defined by user rules, nothing more or less.
If you define a rule to allow host A with service HTTP to access the Internet,
then host A access the Internet via HTTP either via IPv4 or IPv6.

Just imagine that your Hosts have all public IPv4 addresses, so there is no Masquerading rule needed in that case.

If you have only private IPv4 addresses, then you need an additional Masquerading rule.
But the Masquerading rule doesn't affect the packetfilter rule.
Packet filter rule still allows Host A to access the Internet via HTTP.

Cheers
Ulrich
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 RFCat_vk_01 over 14 years ago in reply to da_merlin

Hi guys,
thank you for the information.

So an interesting experiment would be to turn off the MASQ and see what works.

A job for a cold winters morning, no snow around here to clear, just frost and cold rain. Forecast for this coming weekend is not good.

Ian M[[[:)]]][[[:)]]][[[:)]]]
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 RFCat_vk_01 over 14 years ago in reply to RFCat_vk_01

I turned off NAT and the only thing I couldn't get to work was MSN.
Surfed on this forum and updated posts without a problem. Audio streaming worked.

Even IE8 understood the conventions, but MSN (Microsoft Live) could not translate them into the correct format.

Had to restore NAT for the IPv4 only PCs.

Ian M
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel