IPv6
IPv6 Operator
Operator Development
Development ProgramThis material is translated and edited
based on the“iDC/ISP/CATV Servers Hands‐On Seminar”
by Mr.Koichi
Mr Koichi Kunitake,
Kunitake BeaconNC Inc.,Inc
on December 17‐18, 2009,
organized by
Task Force for IPv4 Exhaustion, Japan
http://www.kokatsu.jp/
1© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED.

IPv6
IPv6 Operator
Operator Development
Development Program

H d
Hands‐on
M t i lMaterial
BeaconNC Inc.
Koichi Kunitake2
2© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED.

IPv6
IPv6 Operator
Operator Development
Development Program

Physicalhl topologylffor theh IPv6 hhands‐ondLecturer seatsylsog、SNMP、DNS

Participant
i i
seat

①

②

⑨

⑩

③

④

⑪

⑫

⑤

⑥

⑬

⑭

⑦

⑧

⑮

⑯

© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED.

IPv6
IPv6 Operator
Operator Development
Development Program

Logicall topology
l
for
f the
h IPv6 hhands‐ond
IPv4 192
192.168.242.0/27
168 242 0/27
IPv6 2001:db8:2000::/64

sylsog、SNMP、DNS
.30
::30

© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED.

IPv6
IPv6 Operator
Operator Development
Development Program

Logging into the server• Utilize the TeraTerm shortcut on the desktop, andconnect using serial connection• Account info: (ID/Pw)– admin/admin– root/root/* You can save & copy the configuration files in USB memory if you wish.

5© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED.

IPv6
IPv6 Operator
Operator Development
Development Program

1st day6© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED.

IPv6
IPv6 Operator
Operator Development
Development Program

IPv4/IPv6 address configuration• Following
g addresses are assignedgto thissegment.
– “192
192.168.242.0/27
168 242 0/27”– “2001:db8:2000::/64”• Please use the following addresses (x isthe seat number))– 192.168.242.x– 2001:db8:2000::x
7© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED.

IPv6
IPv6 Operator
Operator Development
Development Program

Behavior of IPv6 address duplication• Check the behavior when y
you assigngduplicated address to your host– 2001:db8:2000::17• Check the DAD message in syslog

8© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED.

IPv6
IPv6 Operator
Operator Development
Development Program

IPv4/IPv6 routing configuration• Default gw is the following– 192.168.242.30/27– 2001:db8:2000::30/64• DNS cacheh server iis th
the ffollowingll i– 2001:db8:2000:ffff::250• Set the configuration to configuration files• After the config
configuration,
ration check the connection# traceroute6 ipv6.google.co.jp# tracepath6 www.nic.ad.jp

9© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED.

IPv6
IPv6 Operator
Operator Development
Development Program

Try: DAD check# ip
p addr add 2001:db8:2000::17/64 dev
eth0# ip addr show dev eth0

# tail /var/log/messages|grepg
g |g
detect10© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED.

IPv6
IPv6 Operator
Operator Development
Development Program

Try: address and routing configuration
Address configuration# ip
i linkli k sett eth0
th0 ddown && iip lilink
k sett eth0
th0 up# ip addr add 192.168.242.x/27 dev eth0
# ip addr add 2001:db8:2000::x/64 dev eth0
Routing configuration# ip route add 0.0.0.0/0 via 192.168.242.30 dev eth0
# ip route add ::/0 via 2001:db8:2000::30 dev eth0

11
© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED.

IPv6
IPv6 Operator
Operator Development
Development Program

Try: resolv.conf configuration/etc/resolv.conf
search example.jp
nameserver 2001:db8:2000:ffff::250
2001 db8 2000 ffff 250

Confirm the behavior$ dig ipv6.google.co.jp AAAA

12
© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED.

IPv6
IPv6 Operator
Operator Development
Development Program

Disabling the address auto-configuration• Disable the address auto-configurationgand reboot the server. Confirm only the
manually assigned address is in effecteffect.

13© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED.

IPv6
IPv6 Operator
Operator Development
Development Program

Disabling the address auto-configuration/etc/sysconfig/networkyg
IPV6_AUTOCONF=no

Activate the configuration# //etc/init.d/network/i i d/k restart
14© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED.

IPv6
IPv6 Operator
Operator Development
Development Program

Bonding configuration• After runningg throughg the configurations,gconfigure the bonding using eth0/eth1• Conduct continuous ping6 to default gw
and unplug the cable.

15© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED.

IPv6
IPv6 Operator
Operator Development
Development Program

Try:Bonding configuration example
ifcfg-bond0
DEVICE=bond0
BOOTPROTO=none
ONBOOT=yes
IPV6INIT=yes
IPV6ADDR=xxx:xxx:xxx::x/64/
IPADDR=xx.xx.xx
NETWORK=xx.xx.xx
NETMASK 255 255 255 0
NETMASK=255.255.255.0

ifcfg-eth0
DEVICE=eth0
BOOTPROTO=none
ONBOOT=yesy
MASTER=bond0
SLAVE=yes
ifcfg-eth1
DEVICE=eth1
BOOTPROTO=none
ONBOOT=yes
MASTER=bond0SLAVE
SLAVE=yes
16© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED.

IPv6
IPv6 Operator
Operator Development
Development Program

Try:Bonding configuration/etc/modprobe.conf
alias bond0 bonding
options bond0 mode=1 miimon=200

Activate the configuration# /etc/init.d/network restart17© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED.

IPv6
IPv6 Operator
Operator Development
Development Program

Apache configuration• IPv6 apache is ready as standard in
RHEL5/CentOS5. Place some contents,
and access from a browser.
– Type in http://[2001:db8:2000::x]/ at theaddress bar• Please check the log when you access the
web site.

18© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED.

IPv6
IPv6 Operator
Operator Development
Development Program

VirtualHost configuration• Configuregan IP address base Virtual Hostand change the contents for IPv4 and IPv6
access.
access19© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED.

IPv6
IPv6 Operator
Operator Development
Development Program

Apache ACL configuration• Let the pperson sitting
g next to yyou to accessthe web site, and check the IP address
he/she was using from the access log
log.
Configure the access denial configuration
using ACL.
ACL

20
© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED.

IPv6
IPv6 Operator
Operator Development
Development Program

Try: Apache configuration
Configure following at the /etc/httpd/conf/httpd.conf<VirtualHost 192.168.242.17:80>
192 168 242 17:80>
DocumentRoot /var/www/html/ipv4</VirtualHost><VirtualHost [2001:db8:2000::17]:80>
DocumentRoot /var/www/html/ipv6</VirtualHost>* Place some contents at /var/www/html/{ipv4|ipv6}
21© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED.

IPv6
IPv6 Operator
Operator Development
Development Program

Try: Apache configuration check$ /usr/sbin/httpdp –S$ ttelnet
l t 192.168.242.17
192 168 242 17 80
GET /index.html$ telnetl2001
2001:db8:2000::17
db8 2000 17 80
GET /index.html
22© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED.

IPv6
IPv6 Operator
Operator Development
Development Program

Mail Server• Configuregthe host name and write it at/etc/hosts• Send an ee-mailmail to the running mail serverusing telnet• Check the mail log after transmission

23© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED.

IPv6
IPv6 Operator
Operator Development
Development Program

Try:postfix configuration/etc/postfix/main.cf
myhostname = dns.17-handson.example.jp
mydomain = 17-handson.example.jp
inet_interfaces = allmydestination = $myhostname, localhost.$mydomain, localhost, $mydomain
home_mailbox = Maildir/

Creating a posting address user
# useradd user1
24© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED.

IPv6
IPv6 Operator
Operator Development
Development Program

Email transmission example$ telnet fe80::aaa:dead:beaf%bond0 ｓｍｔｐ
Trying fe80::aaa:dead:beaf%bond0...
Connected to fe80
fe80::aaa:dead:beaf%bond0.
aaa dead beaf%bond0
Escape character is '^]'.
220 asteroid ESMTP Postfix (Ubuntu)
HELO foo
250 asteroid
MAIL FROM: kunitake@example.jp
250 2.1.0 Ok
RCPT TO: user1@17-handson.example.jp
250 2.1.5 Ok
DATA
354 End data with <CR><LF>.<CR><LF>
From: kunitake@example.jp
Subject: from handson!
Hello IPv6 world.
250 2.0.0 Ok: queued as 22945DD71
QUIT
221 2
2.0.0
0 0 ByeConnection closed by foreign host.

25© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED.

IPv6
IPv6 Operator
Operator Development
Development Program

NTP server• Configuregthe NTP server– 2001:3a0:0:2001::27:123– 2001:db8:2000::x (Address of the nodeperson next to you is using）• Confirm
C fi ththe synchronization
h i ti using
i ntpqt26© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED.

IPv6
IPv6 Operator
Operator Development
Development Program

ACL in NTP server
server 2001:3a0:0:2001::27:123
server 2001:db8:2000::X#restrict default ignore
restrict -4 default nomodify notrap
restrict -6 default nomodify notrap• Confirm
C fi ththe IP
IPv4
4 and
d IP
IPv6
6 ACL
configurations are independent by enabling /disabling the restrict configuration

27© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED.

IPv6
IPv6 Operator
Operator Development
Development Program

DNS server• Develop
p a DNS cache server that supports
pp
IPv6 transport• Utilize the developed DNS cache server withthe person sitting next to you# dig @2001:db8:2000::x ipv6.google.co.jp AAAA

• After confirming you can access to theserver, deny the query from the node of
person next to you using ACL
28© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED.

IPv6
IPv6 Operator
Operator Development
Development Program

Try:DNS cache server# cd /var/named/chroot/etc# wgett ftp://ftp.rs.internic.net/domain/named.root
ft //ft
i t i
t/d
i /
d
t
/var/named/chroot/etc/named.conf
acl handson-net {2001:db8::/32;};
options {directory “/etc”;
version “”;
alllow-query { handson-net; 127.0.0.1; ::1; };listen-on-v6 {any; };};zone “.” {type hint;
file “/etc/named.root”;};
29© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED.

IPv6
IPv6 Operator
Operator Development
Development Program

Try: DNS server
How to confirm
# di
dig @
@::1
1 iipv6.google.co.jp
6lj AAAA30© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED.

IPv6
IPv6 Operator
Operator Development
Development Program

ZONE registration• Add the “x-handson.v4exh-testbed.jp”
jpzone and register your server’s A and
AAAA RR (x is the seat number)

31© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED.

IPv6
IPv6 Operator
Operator Development
Development Program

Try:DNS cache server/var/named/chroot/etc/named.conf// Refer the following
zone “17-handson.example.jp” {type master;
file “master/example.jp”;
allow-transfer
allowtransfer { localhost; handson
handson-net;};net;};
allow-query { any ;};};32© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED.

IPv6
IPv6 Operator
Operator Development
Development Program

Try: DNS authoritative Server/var/named/chroot/etc/master/ipv4exh-testbed.jp;;$TTL 3600
@
IN
(

dns
dns

SOA

17-handson.example.jp.

root.example.jp.

2009082601
7200
1800
60480086400); Serial; Refresh 2hrs
; Retry 30mins; Expire 1 weeks; Minimum 1 days

IN
IN

NS
MX

dns.17-handson.example.jp.
dns.17-handson.example.jp.

IN
IN

A
AAAA

10

192.168.242.17
2001:db8:2000::17

ConfirmationCfiti$ dig @::1 17-handson.ipv4exh-testbed.jp SOA

33© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED.

IPv6
IPv6 Operator
Operator Development
Development Program

2nd day34© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED.

IPv6
IPv6 Operator
Operator Development
Development Program

tcp_wrappers• sshd access is limited. Disable the access
control for the hands-on network only, andask the person next to you to connect tothe server

35© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED.

IPv6
IPv6 Operator
Operator Development
Development Program

Try: tcp_wrappers/etc/hosts.deny
ALL: ALL/etc/hosts.allow
sshd: 192.168.242.
92 68 2 2 [2001:db8:2000:ffff::]/64
200
8 2000/6• MakeM k sure “SSH” iis iin green statust t att
Nagios36© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED.

IPv6
IPv6 Operator
Operator Development
Development Program

Packet filter• Configuregthe filter CERT is showing
g as anexample using ip6tables, and see theeffect (See the separate sheet:
ip6tables_rules.txt)

37© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED.

IPv6
IPv6 Operator
Operator Development
Development Program

Input# Allow some ICMPv6 types in the INPUT chaing ICMPv6 typeyp names to be clear.
# Using
ip6tables -A INPUT -p icmpv6 --icmpv6-type destination-unreachable -j ACCEPT
ip6tables -A INPUT -p icmpv6 --icmpv6-type packet-too-big -j ACCEPT
ip6tables -A INPUT -p icmpv6 --icmpv6-type time-exceeded -j ACCEPT
ip6tables -A INPUT -p icmpv6 --icmpv6-type parameter-problem -j ACCEPT# Allow others ICMPv6 types but only if the hop limit field is 255.
ip6tables -A INPUT -p icmpv6 --icmpv6-type router-advertisement -m hl --hl-eq 255 -j ACCEPT
ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -m hl --hl-eq 255 -j ACCEPT
ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -m hl --hl-eq 255 -j ACCEPT
ip6tables -A INPUT -p icmpv6 --icmpv6-type redirect -m hl --hl-eq 255 -j ACCEPTSpecify the ICMP required for normal behavior such as
Path MTU Discovery. Specify the hoplimit explicitly to
To the packets whose hoplimit have to be 255
38© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED.

IPv6
IPv6 Operator
Operator Development
Development Program

Input（Cont)# Allow some other types in the INPUT chain, but rate limit.
p-A INPUT -p
p icmpv6
p --icmpv6-typep
yp echo-requestq-m limit --limit 900/min -jj ACCEPT
ip6tables
ip6tables -A INPUT -p icmpv6 --icmpv6-type echo-reply -m limit --limit 900/min -j ACCEPT# When there isn't a match, the default policy (DROP) will be applied.
# To be sure, drop all other ICMPv6 types.
# We're dropping enough icmpv6 types to break RFC compliance.
ip6tables -A INPUT -p icmpv6 -j LOG --log-prefix "dropped
dropped ICMPv6"
ICMPv6
ip6tables -A INPUT -p icmpv6 -j DROP

Limit the Echo/reply, and log the packet drop

39
© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED.

IPv6
IPv6 Operator
Operator Development
Development Program

Output# Allow ICMPv6 types that should be sent through the Internet.
p-A OUTPUT -p
p icmpv6
p --icmpv6-typep
yp destination-unreachable -jj ACCEPT
ip6tables
ip6tables -A OUTPUT -p icmpv6 --icmpv6-type packet-too-big -j ACCEPT
ip6tables -A OUTPUT -p icmpv6 --icmpv6-type time-exceeded -j ACCEPT
ip6tables -A OUTPUT -p icmpv6 --icmpv6-type parameter-problem -j ACCEPT# Limit most NDP messages to the local network.
ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbour-solicitation -m hl --hl-eq 255 -j ACCEPT
ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbour-advertisement -m hl --hl-eq 255 -j ACCEPT
ip6tables -A OUTPUT -p icmpv6 --icmpv6-type router-solicitation -m hl --hl-eq 255 -j ACCEPTSpecify the ICMP required for normal behavior such as
Path MTU Discovery. Specify the hoplimit explicitly to
To the packets whose hoplimit have to be 255
40© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED.

IPv6
IPv6 Operator
Operator Development
Development Program

Output（Cont)# If we're acting like a router, this could be a sign of problems.
ip6tables -A OUTPUT -p icmpv6 --icmpv6-type router-advertisement -j LOG --log-prefix "ra ICMPv6
type"
ip6tables -A OUTPUT -p icmpv6 --icmpv6-type redirect -j LOG --log-prefix "redirect ICMPv6 type"ip6tables -A
A OUTPUT -p
p icmpv6 --icmpv6-type
icmpv6 type router-advertisement
router advertisement -jj REJECT
ip6tables -A OUTPUT -p icmpv6 --icmpv6-type redirect -j REJECT# Accept all other ICMPv6 types in the OUTPUT chain.
ip6tables -A OUTPUT -p icmpv6 -j ACCEPT

Effective configuration when used as a router41© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED.

IPv6
IPv6 Operator
Operator Development
Development Program

Configuration of service port, etc# Enough ICMPv6! :-D# Some sample TCP rules. <These are for example purposes only.># The REJECT is for politeness on the local network.
i 6t bl -A
ip6tables
A INPUT -m multiport
lti t -p tcp
t --dport
d t $bl$blocked_tcp_ports
k d t
t -m hl --hl-eq
hl
255 -jj REJECT
ip6tables -A OUTPUT -m multiport -p tcp --dport $blocked_tcp_ports -m hl --hl-eq 255 -j REJECT
ip6tables -A INPUT -m multiport -p tcp --dport $blocked_tcp_ports -m hl --hl-lt 255 -j DROP
ip6tables -A
A OUTPUT -m
m multiport -p
p tcp --dport
dport $blocked_tcp_ports$blocked tcp ports -m
m hl --hl-lt
hl lt 255 -jj DROP
# Stateful matching to allow requested traffic in.
ip6tables -A OUTPUT -p tcp -j ACCEPT
ip6tables -A OUTPUT -p udp -j ACCEPT
ip6tables -A INPUT -p tcp -m state --state ESTABLISHED,RELATED -j ACCEPT
ip6tables -A INPUT -p udp -m state --state ESTABLISHED,RELATED -j ACCEPT# Drop NEW,INVALID probably not needed due to the default drop policy.
ip6tables -A INPUT -m state --state NEW,INVALID -j DROP

42
© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED.

IPv6
IPv6 Operator
Operator Development
Development Program

POP server configuration• Receive emails using
g the developedp POP
server43© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED.

IPv6
IPv6 Operator
Operator Development
Development Program

Dovecot install• Utilize yyum to install dovecot# yum install dovecot• Configure /etc/dovecot.conf

44© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED.

IPv6
IPv6 Operator
Operator Development
Development Program

Try:Dovecot configuration/etc/dovecot.conf
protocols = imap pop3
protocol lda {postmaster_address = root@17-handson.example.jp}
ssl_disable = yesauth default {passdb passwd-file {args = /etc/dovecot.passwd}
userdb passwd-file {args = /etc/dovecot.passwd}}

45© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED.

IPv6
IPv6 Operator
Operator Development
Development Program

Try: Dovecot configuration/etc/dovecot.passwd
user1:{plain}user1:501:501::/home/user1::userdb_mail=maildir:/home/user1/Maildir

46© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED.

IPv6
IPv6 Operator
Operator Development
Development Program

Email reception example$ telnet 2001:db8:2000::17 p
pop3
p
Trying 2001:db8:2000::17...
Connected to 2001:db8:2000::17.
Escape character is '^]'.
+OK Dovecot ready.
USER user1+OK
PASS user1+OK Logged in.
LIST+OK 1 messages:
1 554.
RETR 1+OK 554 octets
Return-Path: <kunitake@example.jp>
X-Original-To: user1@17-handson.example.jp
Delivered-To: user1@17-handson.example.jp
Received: from fo (localhost.localdomain [127.0.0.1])
by dnsdns.17-handson.example.jp
17-handson example jp (Postfix) with SMTP id 092E862C109
for <user1@17-handson.example.jp>; Wed, 16 Dec 2009 15:29:12 +0900 (JST)
From: kunitake@example.jp
Subject: test mailMessage-Id: <20091216062926.092E862C109@dns.17-handson.example.jp>
Date: Wed, 16 Dec 2009 1
15:29:12
29 12 +0900
0900 ((JST)S )To: undisclosed-recipients:;
Hello

47
© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED.