Transcript
13: IPV6 and NAT Last Modified: 4/11/2016 9:09:20 AM Adapted from Gordon Chaffee’s slides http://bmrc.berkeley.edu/people/chaffee/advnet98/ 4: Network Layer
4a-1
IPv6
4: Network Layer
4a-2
History of IPv6 IETF began thinking about the problem of
running out of IP addresses in 1991 Requires changing IP packet format HUGE deal! While we’re at it, lets change X too “NGTrans” (IPv6 Transition) Working Group of IETF - June 1996
4: Network Layer
4a-3
IPv6 Wish List From “The Case for IPv6” Scalable Addressing and Routing Support for Real Time Services Support of Autoconfiguration (get your
own IP address and domain name to minimize administration Security Support Enhanced support for routing to mobile hosts
4: Network Layer
4a-4
IPv4 Datagram 0
4 Version
8 HLen
16 TOS
31 Length
Ident TTL
19
Flags Protocol
Offset Checksum
SourceAddr DestinationAddr Options (variable)
Pad (variable)
Data
4: Network Layer
4a-5
IPv6 Datagram 0
4
Version
12
TrafficClass PayloadLen
16
24
31
FlowLabel NextHeader
HopLimit
SourceAddress
DestinationAddress
Next header/data
4: Network Layer
4a-6
IPv6 Base Header Format VERS = IPv6
TRAFFIC CLASS: specifies the routing priority or
QoS requests FLOW LABEL: to be used by applications requesting performance guarantees PAYLOAD LENGTH: like IPv4’s datagram length, but doesn’t include the header length like IPv4 NEXT HEADER: indicates the type of the next object in the datagram either type of extension header or type of data HOP LIMIT: like IPv4’s TimeToLive field but named correctly NO CHECKSUM (processing efficiency)
4: Network Layer
4a-7
Address Space 32 bits versus 128 bits - implications?
4 billiion vesus 3.4 X1038 1500 addresses per square foot of the earth surface
4: Network Layer
4a-8
Addresses Still divide address into prefix that
designates network and suffix that designates host But no set classes, boundary between suffix and prefix can fall anywhere (CIDR only) Prefix length associated with each address
4: Network Layer
4a-9
Addresses Types Unicast: delivered to a single computer Multicast: delivered to each of a set of
computers (can be anywhere)
Conferencing, subscribing to a broadcast
Anycast: delivered to one of a set of
computers that share a common prefix
Deliver to one of a set of machines providing a common servicer
4: Network Layer 4a-10
Address Notation Dotted sixteen?
105.67.45.56.23.6.133.211.45.8.0.7.56.45.3.189. 56
Colon hexadecimal notation (8 groups) 69DC:8768:9A56:FFFF:0:5634:343
Or even better with zero compression
(replace run of all 0s with double ::) Makes host names look even more attractive huh?
4: Network Layer 4a-11
Special addresses Ipv4 addresses all reserved for
compatibility
96 zeros + IPv4 address = valid IPv6 address
Local Use Addresses Special prefix which means “this needn’t be globally unique” Allow just to be used locally Aids in autoconfiguration
4: Network Layer 4a-12
Datagram Format Base Header + 0 to N Extension Headers +
Data Area
4: Network Layer 4a-13
Extensible Headers Why? Saves Space and Processing Time Only have to allocate space for and spend time processing headers implementing features you need Extensibility When add new feature just add an extension header type - no change to existing headers For experimental features, only sender and receiver need to understand new header 4: Network Layer 4a-14
Flow Label Virtual circuit like behaviour over a datagram network
A sender can request the underlying network to establish a
path with certain requirements • Traffic class specifies the general requirements (ex. Delay < 100 msec.) If the path can be established, the network returns an identifier that the sender places along with the traffic class in the flow label Routers use this identifier to route the datagram along the prearranged path
4: Network Layer 4a-15
ICMPv6 New version of ICMP Additional message types, like “Packet Too
Big” Multicast group management functions
4: Network Layer 4a-16
Summary like IPv4 Connectionless (each datagram contains
destination address and is routed seperately) Best Effort (possibility for virtual circuit behaviour) Maximum hops field so can avoid datagrams circulating indefinitely
4: Network Layer 4a-17
Summary New Features Bigger Address Space (128 bits/address) CIDR only Any cast addresses
New Header Format to help speed processing and
forwarding
Checksum: removed entirely to reduce processing time at each hop No fragmentation
Simple Base Header + Extension Headers Options: allowed, but outside of header, indicated by “Next Header” field
Ability to influence the path a datagram will take
through the network (Quality of service)
4: Network Layer 4a-18
Transition From IPv4 To IPv6 Not all routers can be upgraded
simultaneous
no “flag days” How will the network operate with mixed IPv4 and IPv6 routers?
Two proposed approaches: Dual Stack: some routers with dual stack (v6, v4) can “translate” between formats Tunneling: IPv6 carried as payload n IPv4 datagram among IPv4 routers 4: Network Layer 4a-19
Dual Stack Approach
4: Network Layer 4a-20
Tunneling
IPv6 inside IPv4 where needed
4: Network Layer 4a-21
More Recent History First blocks of IPv6 addresses delegated to
regional registries - July 1999 ~2000 - 10 websites in the .com domain that can be reached via an IPv6 enhanced client via an IPv6 TCP connection 2008 - U.S. government agencies required to be IPv6 compliant to meet an OMB mandate announced in 2005 2009/10 – Major websites like Google and Facebook on IPv6 Info from Akamai’s State of the Internet 4: Network Layer 4a-22 report
IPv5? New version of IP temporarily named “IP -
The Next Generation” or IPng Many competing proposals; name Ipng became ambiguous Once specific protocol designed needed a name to distinguish it from other proposals IPv5 has been assigned to an experimental protocol ST
4: Network Layer 4a-23
Network Address Translation (NAT)
4: Network Layer 4a-24
Background RFC 1918 defines private intranet address
ranges for IPv4
10.0.0.0 - 10.255.255.255 (Class A) 172.16.0.0 - 172.31.255.255 (Class B) 192.168.0.0 - 192.168.255.255 (Class C)
Addresses reused by many organizations Addresses cannot be used for
communication on Internet
4: Network Layer 4a-25
Problem Discussion Hosts on private IP networks need to
access public Internet All traffic travels through a gateway to/from public Internet Traffic needs to use IP address of gateway Conserves IPv4 address space Private
IP addresses mapped into fewer public IP addresses 4: Network Layer 4a-26
Scenario 128.32.32.68 BMRC Server
All Private Network hosts must use the gateway IP address
24.1.70.210 Gateway
Public Internet Public network IP address, globally unique
10.0.0.1
10.0.0.2
10.0.0.3
10.0.0.4
Host A
Private Network
Same private network IP addresses may be used by many organizations
4: Network Layer 4a-27
Network Address Translation Solution Special function on gateway IP source and destination addresses are translated Internal hosts need no changes TCP based protocols work well Non-TCP based protocols more difficult Changes required to applications that embed IP
addresses? FTP? Others? Provides some security
Hosts behind gateway difficult to reach Possibly vulnerable to IP level attacks
4: Network Layer 4a-28
TCP NAT Example PROTO SADDR DADDR SPORT DPORT FLAGS CKSUM
TCP 10.0.0.3 128.32.32.68 1049 80 SYN 0x1636
1. Host tries to connect to web server at 128.32.32.68. It sends out a SYN packet using its internal IP address, 10.0.0.3.
NAT Gateway
PROTO SADDR DADDR SPORT DPORT FLAGS CKSUM
TCP 128.32.32.68 10.0.0.3 80 1049 SYN, ACK 0x7841
TCP 24.1.70.210 128.32.32.68 40960 80 SYN 0x2436
2. NAT gateway sees SYN flag set, adds new entry to its translation table. It then rewrites the packet using gateway’s external IP address, 24.1.70.210. Updates the packet checksum.
2
1
10.0.0.3
PROTO SADDR DADDR SPORT DPORT FLAGS CKSUM
Internet
3
4 10.0.0.1 24.1.70.210 NAT Translation Table Client IPAddr Port 10.0.0.3 1049 . . . ..
4. NAT gateway looks in its translation table, finds a match for the source and destination addresses and ports, and rewrites the packet using the internal IP address.
Server IPAddr Port 128.32.32.68 80 . . . ..
NATPort 40960 . .
PROTO SADDR DADDR SPORT DPORT FLAGS CKSUM
Server 128.32.32.68
TCP 128.32.32.68 24.1.70.210 80 40960 SYN, ACK 0x8041
3. Server responds to SYN packet with a SYN,ACK packet. The packet is sent to the NAT gateway’s IP address.
4: Network Layer 4a-29
NAT traversal problem client wants to connect to
server with address 10.0.0.1
server address 10.0.0.1 local to LAN (client can’t use it as destination addr) only one externally visible NATed address: 138.76.29.7
solution 1: statically
configure NAT to forward incoming connection requests at given port to server
Client
10.0.0.1
? 10.0.0.4
138.76.29.7
NAT router
e.g., (123.76.29.7, port 2500) always forwarded to 10.0.0.1 port 25000 Network Layer
4-30
NAT traversal problem solution 2: Universal Plug and
Play (UPnP) Internet Gateway Device (IGD) Protocol. Allows NATed host to: learn public IP address (138.76.29.7) add/remove port mappings (with lease times)
10.0.0.1
IGD 10.0.0.4 138.76.29.7
NAT router
i.e., automate static NAT port map configuration
Network Layer
4-31
NAT traversal problem solution 3: relaying (used in Skype)
NATed client establishes connection to relay External client connects to relay relay bridges packets between to connections
2. connection to relay initiated by client Client
3. relaying established
1. connection to relay initiated by NATed host 138.76.29.7
10.0.0.1
NAT router
Network Layer
4-32
Load Balancing Servers with NAT Public Internet
Server
Server
Private Intranet
Server
Server
Single IP address for web server Redirects workload to multiple internal
servers
4: Network Layer 4a-33
Load Balancing Networks with NAT Service Provider 1 Private Intranet
NAT Gateway
Network X
Service Provider 2
Connections from Private Intranet split
across Service Providers 1 and 2 Load balances at connection level
Load balancing at IP level can cause low TCP throughput
4: Network Layer 4a-34
NAT Discussion NAT works best with TCP connections NAT breaks End-to-End Principle by
modifying packets Problems
Connectionless UDP (Real Audio) ICMP (Ping) Multicast Applications use IP addresses within data stream (FTP)
Need to watch/modify data packets 4: Network Layer 4a-35
Outtakes
4: Network Layer 4a-36
6Bone The 6Bone: an IPv6 testbed Started as a virtual network using IPv6
over IPv4 tunneling/encapsulation Slowly migrated to native links for IPv6 transport RFC 2471 Abandoned 2006
4: Network Layer 4a-37
NAT Example NAT Gateway
TCP Connection 1
Address Translator
TCP Connection 1 Server 128.32.32.68
4: Network Layer 4a-38
TCP Protocol Diagram SYN flag indicates a new TCP connection
Client
Server
IP Header
SYN SYN, ACK ACK
..... Checksum Source IP Address Destination IP Address .....
Packet 0:50 ACK 0:50
FIN FIN, ACK
TCP Header Source Port Number Dest Port Number Sequence Number .....
4: Network Layer 4a-39
