Background

The global pool of free IPv4 addresses, from which providers could request additional addresses if required, has been exhausted since January 2011. The regional pool responsible for our region shrank to a critical value in September 2012; since then, every registered provider can still request a one-off block of approx. 1000 IPv4 addresses, further IPv4 addresses are no longer available. Some providers who still have unused IPv4 addresses are willing to sell them; however, these addresses were often previously used for spam and the distribution of malware and are filtered out in many places.

Most Internet providers are therefore faced with the challenge of offering more services than before, e.g. additional websites, with the existing stock of IPv4 addresses. The approach of punkt.de is to shift services as far as possible to operation with IPv6, where addresses are available in virtually unlimited quantities. The 2nd generation of our proServer is a result of these efforts.

Overview of the system structure

The vpro containers

As before, these are independent virtual machines with the functionality of a complete operating system. However, the virtual machine now only has an external IPv6 address and no longer a legacy IP address (IPv4 address).

The gate64 containers

These are independent virtual machines that establish the connection to the legacy IP network for several vpro containers. These gate64 containers each have an IPv6 and an IPv4 address. Outgoing connections, i.e. those initiated from the vproXXXX, are possible to any destination in the IPv4 range. Incoming connections, i.e. from the (IPv4) Internet to the vproXXXX, are only possible on ports 80 (HTTP) and 443 (HTTPS).

The ssh-jumphost

This is also an independent machine with one IPv4 and one IPv6 address. With this host as an intermediate station, ssh/scp access to the vproXXXX is also possible for those developers who only have IPv4 access to the Internet.

What changes for the admin/developer

DNS entries

A "responsible" gate64 container is assigned to each vproXXXX container. We will inform you of the IPv4 address of this gate64 container when you set up a vpro container. For the websites hosted on the vpro, enter an AAAA record with the IPv6 address of the vproXXXX and an A record with the IPv4 address of the assigned gate64 container in the DNS.

Attention: In contrast to the 1st generation of proServers, the AAAA record in the DNS is now mandatory, as the gate64 container uses this DNS entry to find out on which vproXXXX a website accessed via it is located.

Access from the vpro container to resources on the IPv4 Internet

If the external resource is accessed via a host name in the DNS, there is nothing further for the developer to consider: The name server used on the vpro returns a "synthetic IPv6 address" for resources that only have IPv4 addresses, which is then routed via a so-called NAT64 gateway (on the assigned gate64 host) and translated to IPv4 there. From the proServer's point of view, communication therefore takes place via IPv6; the translation on the gate64 is not visible to the proServer.

If access is made via IPv4 address literals (i.e. directly a numerical IPv4 address), such a literal must be rewritten to the corresponding IPv6 address. This is done by adding the prefix 64:ff9b::/96. For example, the IPv4 address 192.0.2.3 would become the "synthetic" IPv6 address [64:ff9b::192.0.2.3], the result is then used like an IPv6 address literal. To ping the target system, you would therefore use

ping6 64:ff9b::192.0.2.3

would be called.

Restrictions

There are some operational restrictions due to the fact that incoming connections from the IPv4 Internet are only possible via port 80 and 443 (and 22/ssh via Jumphost).

• Websites can only be located on port 80 (HTTP) and 443 (HTTPS). This restriction does not apply to internal addresses on the vpro or private connections between several vpro containers, and of course not to connections via IPv6.
• Mail can be sent from the vpro to IPv4 destinations via the NAT64 gateway. However, receiving mail from the Internet on the vpro is only possible via IPv6 or via an upstream dual-stack mail server.

If these restrictions pose a problem for your application, please contact us. Together we will find a solution.