NAT64

Stands for: Network Address and Protocol Translation from IPv6 Clients to IPv4 Servers

Stateful translation that lets IPv6-only clients reach IPv4 servers by sharing a few public IPv4 addresses.

NAT64 (RFC 6146) is how IPv6-only networks, including several cellular ones, still reach the IPv4 internet. It works with DNS64, which synthesises AAAA records for IPv4-only names, and fails for anything that hands it an IPv4 literal instead of a name.

When a name has no AAAA record, DNS64 embeds its A record's address in a prefix, the well-known 64:ff9b::/96 unless the operator chose its own: illustratively, 192.0.2.33 becomes 64:ff9b::c000:221, also written 64:ff9b::192.0.2.33. The client connects there, and the NAT64 takes the IPv4 destination straight from the last 32 bits, picks a port on its public IPv4 address and creates the mapping, translating address and port. The two boxes share nothing but the prefix.

Hosts learn the prefix by asking for the AAAA records of ipv4only.arpa, whose real A records are 192.0.0.170 and 192.0.0.171, or from the PREF64 option (type 38) in Router Advertisements. The well-known prefix may only carry global IPv4 addresses; translators must drop it combined with private ones.

Without prior state only IPv6 hosts can open sessions. Applications that use IPv4 literals never query DNS and fail unless the host adds the CLAT of 464XLAT; protocols that protect the IP header are incompatible; DNSSEC validators unaware of DNS64 can reject synthesised answers; and a device using a resolver other than the one the network supplied runs into trouble.

Also known as: stateful nat64, nat 64, dns64, 64:ff9b::/96, pref64, rfc 6146

Sources

← All glossary entries