GCP で IPv6 を使う

# IPv6 がサポートされるリージョン

> [Regions that support IPv6](https://cloud.google.com/vpc/docs/vpc#ipv6-regions)
>
> - asia-east1 (Changhua County, Taiwan, APAC)
> - asia-south1 (Mumbai, India APAC)
> - europe-west2 (London, England, Europe)
> - us-west2 (Los Angeles, California, North America)

# IPv6 が有効なサブネットを作成

> [Add a subnet and enable IPv6](https://cloud.google.com/vpc/docs/using-vpc#add-subnet-ipv6)

```shell
export SUBNET='kyouhei-subnet-los'
export NETWORK='kyouhei-vpc'
export PRIMARY_IPv4_RANGE='10.168.0.0/20'
export REGION='us-west2'
```

```shell
gcloud compute networks subnets create $SUBNET \
    --network=$NETWORK \
    --range=$PRIMARY_IPv4_RANGE \
    --stack-type=IPV4_IPV6 \
    --ipv6-access-type=EXTERNAL \
    --region=$REGION
```

```tex:result.txt
Created [https://www.googleapis.com/compute/v1/projects/xxx/regions/us-west2/subnetworks/kyouhei-subnet-los].
NAME                REGION    NETWORK      RANGE          STACK_TYPE  IPV6_ACCESS_TYPE  IPV6_CIDR_RANGE  EXTERNAL_IPV6_CIDR_RANGE
kyouhei-subnet-los  us-west2  kyouhei-vpc  10.168.0.0/20  IPV4_IPV6   EXTERNAL                           2600:x:x:x:0:0:0:0/64
```

# IPv6 が有効な VM を作成

> [Create a VM and enable IPv6](https://cloud.google.com/compute/docs/ip-addresses/configure-ipv6-address)

```shell
export INSTANCE_NAME='kyouhei-los-c'
export ZONE='us-west2-c'
```

```shell
gcloud compute instances create $INSTANCE_NAME \
  --ipv6-network-tier=PREMIUM \
  --subnet=$SUBNET \
  --stack-type=IPV4_IPV6 \
  --zone=$ZONE \
  --machine-type=e2-medium \
  --create-disk=image=projects/centos-cloud/global/images/centos-7-v20210916,size=20 
```

```tex:result.txt
Created [https://www.googleapis.com/compute/v1/projects/xxx/zones/us-west2-c/instances/kyouhei-los-c].
NAME           ZONE        MACHINE_TYPE  PREEMPTIBLE  INTERNAL_IP  EXTERNAL_IP   STATUS
kyouhei-los-c  us-west2-c  e2-medium                  10.168.0.2   34.x.x.x  RUNNING
```

# 作成した VM の IPv6 アドレスを確認

```shell
export VM_IPv6=$(gcloud compute ssh $INSTANCE_NAME --zone=$ZONE --command 'curl -6 -s https://cloudflare.com/cdn-cgi/trace' | grep ip | awk -F'=' '{print $2}')
echo $VM_IPv6
```

```tex:result.txt
2600:x:x:x::
```

# 自回線の IPv6 アドレスを確認

```shell
export MYIPv6=$(curl -6 -s https://cloudflare.com/cdn-cgi/trace | grep ip | awk -F'=' '{print $2}')
echo $MYIPv6
```

```tex:result.txt
240d:x:x:x:x:x:x:x
```

# ファイアウォールルールを追加

IP プロトコル番号 58 を指定し `ICMP for IPv6` を許可します。

```shell
gcloud compute firewall-rules create allow-ingress-ping6 \
--direction=INGRESS --priority=1000 \
--network=$NETWORK --action=ALLOW \
--rules=58 --source-ranges=$MYIPv6/128
```

```tex:result.txt
Creating firewall...⠹Created [https://www.googleapis.com/compute/v1/projects/xxx/global/firewalls/allow-ingress-ping6].               
Creating firewall...done.                                                                                                                         
NAME                 NETWORK      DIRECTION  PRIORITY  ALLOW  DENY  DISABLED
allow-ingress-ping6  kyouhei-vpc  INGRESS    1000      58           False
```

その後、疎通が取れることが確認できます。

```shell
% ping6 $VM_IPv6 -c 4
PING6(56=40+8+8 bytes) 240d:x:x:x:x:x:x:x --> 2600:x:x:x::
16 bytes from 2600:x:x:x::, icmp_seq=0 hlim=58 time=103.676 ms
16 bytes from 2600:x:x:x::, icmp_seq=1 hlim=58 time=107.824 ms
16 bytes from 2600:x:x:x::, icmp_seq=2 hlim=58 time=109.467 ms
16 bytes from 2600:x:x:x::, icmp_seq=3 hlim=58 time=103.033 ms

--- 2600:x:x:x:: ping6 statistics ---
4 packets transmitted, 4 packets received, 0.0% packet loss
round-trip min/avg/max/std-dev = 103.033/106.000/109.467/2.718 ms
```



# 参考：Cloudflare からの IPv6 通信を許可

```shell
export CF_IPv6=$(curl -s "https://api.cloudflare.com/client/v4/ips" | jq -r '.result.ipv6_cidrs | join(",")')
echo $CF_IPv6
```

```tex:result.txt
2400:cb00::/32,2606:4700::/32,2803:f800::/32,2405:b500::/32,2405:8100::/32,2a06:98c0::/29,2c0f:f248::/32
```

```shell
gcloud compute firewall-rules create allow-ingress-cfipv6 \
--direction=INGRESS --priority=1000 \
--network=$NETWORK --action=ALLOW \
--rules=tcp:80,tcp:443 --source-ranges=$CF_IPv6
```

```tex:result.txt
Creating firewall...⠹Created [https://www.googleapis.com/compute/v1/projects/xxx/global/firewalls/allow-ingress-cfipv6].              
Creating firewall...done.                                                                                                                         
NAME                  NETWORK      DIRECTION  PRIORITY  ALLOW           DENY  DISABLED
allow-ingress-cfipv6  kyouhei-vpc  INGRESS    1000      tcp:80,tcp:443        False
```