There are more than one possibility to tunnel IPv6 packets over IPv4-only links.
A point-to-point tunnel is a dedicated tunnel to an endpoint, which knows about your IPv6 network (for backward routing) and the IPv4 address of your tunnel endpoint and defined in RFC 4213 / Basic Transition Mechanisms for IPv6 Hosts and Routers. Requirements:
IPv4 address of your local tunnel endpoint must be static, global unique and reachable from the foreign tunnel endpoint
If no static IPv4 address is available, the tunnel provider must support authentication of the dynamic IPv4 address, like SixXS / AICCU (3740/udp) or gogo6 (3653/udp).
A global IPv6 prefix assigned to you
It is also possible that additional IPv6 networks are routed through this tunnel.
A foreign tunnel endpoint which is capable to route your IPv6 prefix to your local tunnel endpoint (mostly remote manual configuration required)
Tunnel provider for static point-to-point tunneling:
Automatic tunneling occurs, when a node directly connects another node gotten the IPv4 address of the other node before.
6to4 tunneling (RFC 3056 / Connection of IPv6 Domains via IPv4 Clouds) uses a simple mechanism to create automatic tunnels. Each node with a global unique IPv4 address is able to be a 6to4 tunnel endpoint (if no IPv4 firewall prohibits traffic). 6to4 tunneling is mostly not a one-to-one tunnel. This case of tunneling can be divided into upstream and downstream tunneling. Also, a special IPv6 address indicates that this node will use 6to4 tunneling for connecting the world-wide IPv6 network
The 6to4 address is defined like following (schema is taken from RFC 3056 / Connection of IPv6 Domains via IPv4 Clouds):
| 3+13 | 32 | 16 | 64 bits | +---+------+-----------+--------+--------------------------------+ | FP+TLA | V4ADDR | SLA ID | Interface ID | | 0x2002 | | | | +---+------+-----------+--------+--------------------------------+ |
FP and TLA together (16 bits) have the value 0x2002. V4ADDR is the node's global unique IPv4 address (in hexadecimal notation). SLA is the subnet identifier (65536 local subnets possible) and are usable to represent your local network structure.
For gateways, such prefix is generated by normally using SLA ”0000” and suffix ”::1” (not a must, can be an arbitrary one with local-scope) and assigned to the 6to4 tunnel interface. Note that Microsoft Windows uses V4ADDR also for suffix.
The node has to know to which foreign tunnel endpoint its in IPv4 packed IPv6 packets should be send to. In ”early” days of 6to4 tunneling, dedicated upstream accepting routers were defined. See NSayer's 6to4 information for a list of routers.
Nowadays, 6to4 upstream routers can be found auto-magically using the anycast address 192.88.99.1. In the background routing protocols handle this, see RFC 3068 / An Anycast Prefix for 6to4 Relay Routers for details.
The downstream (IPv6 backbone -> your 6to4 enabled node) is not really fix and can vary from foreign host which originated packets were send to. There exist two possibilities:
Foreign host uses 6to4 and sends packet direct back to your node (see below)
Foreign host sends packets back to the world-wide IPv6 network and depending on the dynamic routing a relay router of an ISP which announces 2002::/16 via BGP will create a automatic tunnel back to your node.
from 6to4 to 6to4: is normally directly tunneled between the both 6to4 enabled hosts
from 6to4 to non-6to4: is sent via upstream tunneling
non-6to4 to 6to4: is sent via downstream tunneling
Note, that because of possible asymmetric routing problems with a broken 6to4 relay can be hard to troubleshoot.
UDP encapsulated IPv6 tunneling is usally used if no global IPv4 address is available on the internal endpoint, but using Network Adress Translation (NAT) it can still reach related endpoints using UDP ports described below.
RFC 4380 / Teredo: Tunneling IPv6 over UDP through Network Address Translationsdescribes tunneling of IPv6 packets via IPv4 UDP bubbles, see also Wikipedia / Teredo. It uses usually 3544/udp. Linux client is named miredo and usable out-of-the-box. This tunnel method can only connect a single client to the global IPv6 network..
Tunnel provider SixXS has also IPv6-in-UDP-in-IPv4 (5072/udp) capability, for using it, the AYIYA mode must be enabled.
Tunnel provider gogo6 has also IPv6-in-UDP-in-IPv4 (3653/udp) capability, for using it, the v6udpv4 mode must be enabled.