IPv6 transition and security: NAT64, DNS64, RA guard
You build transition methods such as dual stack, NAT64 and DNS64, see IPv6-specific risks such as rogue router advertisements and apply the defences.
Level 301 · 17 lessons · 15 practice labs
Lessons
Transition methods
- Dual-stack design and Happy Eyeballs
- NAT64: translating IPv6 to IPv4 (Jool)
- Synthetic AAAA records with DNS64
- IPv6 tunnels with 6in4 and GRE
- IPv6-only clients and 464XLAT
- Short task: let an IPv6-only network reach an IPv4 site
Security
- Rogue router advertisements and RA guard
- NDP spoofing and how to defend
- Extension headers and filtering
- Discovery in IPv6: address space and leaked addresses
- IPv6 rules with nftables
- Short task: find and close risky settings on an IPv6 LAN
Operations
- Privacy addresses and tracking a device in the logs
- Address management and DHCPv6 reservations
- Monitoring IPv6 traffic on its own
- Short task: find which device an IPv6 address in the logs belongs to
Wrap-up
- Capstone: plan and carry out moving IPv4 services to IPv6
Practice labs
- Which protocol does the client pick?: Show which protocol a dual-stack client uses to reach a site, then switch it to prefer IPv4 with gai.conf and prove the difference.
- An AAAA record with no service behind it: Find the service that is published in DNS but silent over IPv6, measure the client delay and fix it by making the service listen on IPv6 or removing the record.
- Carry IPv6 across an IPv4 backbone: Build a 6in4 tunnel between two IPv6 islands, set the MTU correctly and show a ping and a large file transfer between the ends.
- Recognise a synthetic AAAA: Extract the IPv4 address embedded in the synthetic AAAA record returned by the DNS64 server, and identify the prefix in use.
- NAT64 is set up but nothing passes: Find the missing pool or prefix route in the Jool NAT64 setup, fix it and reach an IPv4 site with curl from an IPv6-only client.
- The app with a hard-coded IP fails: Show why an app that connects to a literal IPv4 address fails on an IPv6-only client, then set up 464XLAT and prove it works.
- A second router advertisement on the network: Find the illegitimate router advertisement in a capture, and write down its source MAC address and the prefix it announces.
- RA guard on a Linux bridge: Write the rule on the lab bridge that allows advertisements only from the router port, and show a rogue advertisement no longer reaches the client.
- Catch and stop NDP spoofing: Prove from a capture the spoofed neighbour advertisements generated in your own lab, show the poisoned neighbour entries and apply a defence with static entries or a filter.
- Base rules for an IPv6 firewall: Write an nftables input chain that allows the required ICMPv6 types and drops other inbound traffic, and show SSH and ping still work.
- Closed on IPv4, left open on IPv6: Find the services left reachable over IPv6 because the firewall was written for IPv4 only, and close them for both protocols with an inet table.
- Slipping past a rule with extension headers: Show in your own lab how packets with extension headers slip past a filter, and fix the nftables rule so it evaluates those packets correctly.
- Turn on privacy addresses and watch them: Enable temporary addresses on the client and show that a new address is generated and outbound connections use it.
- Finding devices on an IPv6 network: In your own lab network, find IPv6 devices through DNS records and multicast queries, and report the ones using guessable addresses.
- How much of the traffic is IPv6?: Set up nftables counters on the router that count IPv4 and IPv6 traffic separately, measure for a while and report which services still use IPv4 only.
About this course
You build transition methods such as dual stack, NAT64 and DNS64, see IPv6-specific risks such as rogue router advertisements and apply the defences.
What you will learn
- Transition methods
- Security
- Operations
- Wrap-up
Prerequisites
You should be comfortable with the level 101 and 201 topics of the same path.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 301; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.