{"id":480,"date":"2011-03-31T03:02:40","date_gmt":"2011-03-31T03:02:40","guid":{"rendered":"http:\/\/gigihfordanama.wordpress.com\/?p=480"},"modified":"2012-08-08T00:12:36","modified_gmt":"2012-08-08T00:12:36","slug":"tunneling-ipv6-with-ubuntu-linux-behind-nat-why-not","status":"publish","type":"post","link":"https:\/\/dosen.unila.ac.id\/gigih\/2011\/03\/31\/tunneling-ipv6-with-ubuntu-linux-behind-nat-why-not\/","title":{"rendered":"Tunneling IPv6 with Ubuntu Linux Behind NAT ? Why Not.."},"content":{"rendered":"

Source from WIKI:<\/p>\n

An IP tunnel<\/strong> is an Internet Protocol<\/a> (IP) network communications channel between two networks. It is used to transport another network protocol by encapsulation<\/a> of its packets<\/a>. IP tunnels are often used for connecting two disjoint IP networks that don’t have a native routing path to each other, via an underlying routable protocol across an intermediate transport network. In conjunction with the IPsec<\/a> protocol they may be used to create a virtual private network<\/a> between two or more private networks across a public network such as the Internet<\/a>. Another prominent use is to connect islands of IPv6<\/a> installations across the IPv4<\/a> Internet.<\/p>\n

\n
\"\"<\/a> <\/p>\n
IP tunnelling encapsulation In IP tunnelling, every IP packet, including addressing information of its source and destination IP networks, is encapsulated within another packet format native to the transit network. At the borders between the source network and the transit network, as well as the transit network and the destination network, gateways are used that establish the end-points of the IP tunnel across the transit network. Thus, the IP tunnel endpoints become native IP routers that establish a standard IP route between the source and destination networks. Packets traversing these end-points from the transit network are stripped from their transit frame format headers and trailers used in the tunnelling protocol<\/a> and thus converted into native IP format and injected into the IP stack of the tunnel endpoints. In addition, any other protocol encapsulations used during transit, such as IPsec or Transport Layer Security<\/a>, are removed. IP in IP<\/a>, sometimes called ipencap<\/em>, is an example of IP encapsulation within IP and is described in RFC 2003<\/a>. Other variants of the IP-in-IP variety are IPv6-in-IPv4 (6in4<\/a><\/em>) and IPv4-in-IPv6 (4in6<\/a><\/em>). IP tunneling often bypasses simple firewall rules transparently since the specific nature and addressing of the original datagrams are hidden. Content-control software<\/a> is usually required to block IP tunnels.<\/div>\n<\/div>\n<\/div>\n

Tulisan diatas saya cuplik dari penjelasan WIKI tentang IP Tunnel yang menjelaskan gambaran umum seperti apa konsep IP Tunnel. pada tulisan sebelumnya saya menulis tentang bagaimana mengimplementasikan metode 6to4 untuk membuat jaringan IPv6 meskipun tidak memiliki Blok IPv6 sendiri. http:\/\/gigihfordanama.wordpress.com\/2011\/03\/30\/mencoba-sixxs-org-ipv6-gateway\/<\/a> skim pada tulisan tsb server yang digunakan langsung terhubung ke global IPv4 dan menggunakan sistem operasi FreeBSD 8.0. Nah sekarang kita akan coba bereksperimen bagaimana jika server yang akan dijadikan server tunneling berada dibelakang NAT atau menggunakan IP Private. kita lihat contoh kasus yang saya ujicobakan, dengan topologi sebagai berikut<\/p>\n

[(DMZ FIREWALL SERV – WITH IP PUBLIC – OS FREEBSD)\/NOC ROOM]\u00a0 ——–> [FAKULTAS ROUTER] ——> [JURUSAN ROUTER]<\/p>\n

202.43.189.222 \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 ———-\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 192.168.170.254\u00a0\u00a0\u00a0 ——-\u00a0 192.168.170.211<\/p>\n

Yang perlu dilakukan adalah:<\/p>\n

    \n
  1. Set rule di FreeBSD-Firewall dengan konfigurasi bidirectional NAT pada paket filter BSD (karena saya tidak mau pusing),contoh skrip \/etc\/pf.conf binat\u00a0\u00a0 on $eIF from 192.168.170.211 to any -> 202.43.189.222 , <\/strong>kenapa saya pilih binat, karena saya akan mapping dari IPPublic ke IP 192.168.170.211 secara bolak balik dan tanpa filter apa apa, sebetulnya yang dibutuhkan untuk membuka servis tunnel cukup hanya dengan menggunakan protocol 41 di pass ke tujuan. Namun karena saya juga butuh untuk yang lain lain juga, makanya firewallnya di buat PLONG kayak jalan Tol.\u00a0 \ud83d\ude00<\/li>\n
  2. Yak sudah itu saja, tinggal dibuktikan apakah dari NAT sudah bisa keluar\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0\u00a0 .\u00a0 \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 elektro@elektro-desktop:~$ ifconfig <\/em><\/strong>
    \neth0\u00a0\u00a0\u00a0\u00a0\u00a0 Link encap:Ethernet\u00a0 HWaddr d4:85:64:cc:58:23 <\/em>
    \n inet addr:192.168.170.211\u00a0 Bcast:192.168.170.255 <\/em>elektro@elektro-desktop:~$ tracepath www.google.com<\/em><\/strong>
    \n 1:\u00a0 elektro-desktop.local (192.168.170.211)\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 0.207ms pmtu 1500<\/em>
    \n 1:\u00a0 192.168.170.254 (192.168.170.254)\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 1.032ms <\/em>
    \n 1:\u00a0 192.168.170.254 (192.168.170.254)\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 1.028ms <\/em>
    \n 2:\u00a0 192.168.1.245 (192.168.1.245)\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 1.054ms <\/em>
    \n 3:\u00a0 202.43.189.193 (202.43.189.193)\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 10.047ms <\/em>
    \n 4:\u00a0 v450.0-2-0.m7i-cyb-jkt.moratelindo.co.id (202.43.177.38)\u00a0 11.356ms asymm\u00a0 5 <\/em>
    \n 5:\u00a0 no reply<\/em><\/li>\n
  3. buka http:\/\/tunnelbroker.net<\/a> register buat account dan create tunnel anda<\/li>\n<\/ol>\n

    Asumsi bahwa kita sudah mengcreate Standar Tunnel\u00a0 untuk Server LINUX sebagai berikut;<\/p>\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
    IPv6 Tunnel Endpoints<\/strong><\/td>\n<\/tr>\n
    <\/td>\nServer IPv4 address:<\/td>\n66.220.18.42<\/td>\n<\/tr>\n
    <\/td>\nServer IPv6 address:<\/td>\n2001:470:c<\/strong>:fad::1\/64<\/td>\n<\/tr>\n
    <\/td>\nClient IPv4 address:<\/td>\n202.43.189.222<\/a><\/td>\n<\/tr>\n
    <\/td>\nClient IPv6 address:<\/td>\n2001:470:c<\/strong>:fad::2\/64<\/td>\n<\/tr>\n
    Available DNS Resolvers<\/strong><\/td>\n<\/tr>\n
    <\/td>\nAnycasted IPv6 Caching Nameserver:<\/td>\n2001:470:20::2<\/td>\n<\/tr>\n
    <\/td>\nAnycasted IPv4 Caching Nameserver:<\/td>\n74.82.42.42<\/td>\n<\/tr>\n
    Routed IPv6 Prefixes and rDNS Delegations<\/strong><\/td>\n<\/tr>\n
    <\/td>\nRouted \/48:<\/td>\nAllocate \/48<\/span><\/td>\n<\/tr>\n
    <\/td>\nRouted \/64:<\/td>\n2001:470:d<\/strong>:fad::\/64<\/td>\n<\/tr>\n
    <\/td>\nRDNS Delegation NS1:<\/td>\nnone<\/a><\/td>\n<\/tr>\n
    <\/td>\nRDNS Delegation NS2:<\/td>\nnone<\/a><\/td>\n<\/tr>\n
    <\/td>\nRDNS Delegation NS3:<\/td>\nnone<\/a><\/td>\n<\/tr>\n
    <\/td>\nRDNS Delegation NS4:<\/td>\nnone<\/a><\/td>\n<\/tr>\n
    <\/td>\nRDNS Delegation NS5:<\/td>\nnone<\/a><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

    eksekusi perintah berikut pada UBUNTU server dengan perintah sebagai berikut;<\/p>\n

    root@elektro-desktop:~# ifconfig sit0 up<\/strong><\/em>
    \nroot@elektro-desktop:~# ifconfig sit0 inet6 tunnel ::66.220.18.42<\/strong><\/em>
    \nroot@elektro-desktop:~# ifconfig sit1 up<\/strong><\/em>
    \nroot@elektro-desktop:~# ifconfig sit1 inet6 add 2001:470:c:fad::2\/64<\/strong><\/em>
    \nroot@elektro-desktop:~# route -A inet6 add ::\/0 dev sit<\/strong>1<\/em><\/p>\n

    elektro@elektro-desktop:~$ ifconfig | more<\/strong>
    \neth0<\/strong> Link encap:Ethernet\u00a0 HWaddr d4:85:64:cc:58:23
    \ninet addr:192.168.170.211\u00a0 Bcast:192.168.170.255 <\/em>
    \n inet6 addr: fe80::d685:64ff:fecc:5823\/64 Scope:Li<\/em>nk
    \nsit0 <\/strong> Link encap:IPv6-in-IPv4
    \ninet6 addr: ::192.168.170.211\/96 Scope:Compat<\/em>
    \nsit1 <\/strong> Link encap:IPv6-in-IPv4
    \ninet6 addr: fe80::c0a8:aad3\/64 Scope:Link<\/em>
    \n inet6 addr: 2001:470:c:fad::2\/64 Scope:Global<\/em>
    \nUP POINTOPOINT RUNNING NOARP\u00a0 MTU:1480\u00a0 Metric:1<\/p>\n

    Saatnya kita coba apakah sudah terhubung ke global IPv6 .<\/p>\n

    elektro@elektro-desktop:~$ traceroute6 ipv6.google.com<\/strong>
    \ntraceroute to ipv6.l.google.com (2404:6800:8005::63) from 2001:470:c:fad::2, 30 hops max, 16 byte packets<\/em>
    \n 1\u00a0 gigih-3.tunnel.tserv15.lax1.ipv6.he.net (2001:470:c:fad::1)\u00a0 223.223 ms\u00a0 219.829 ms\u00a0 223.712 ms<\/em>
    \n 2\u00a0 gige-g4-6.core1.lax1.he.net (2001:470:0:9d::1)\u00a0 224.223 ms\u00a0 222.781 ms\u00a0 225.222 ms<\/em>
    \n 3\u00a0 PR01.LAX03.google.com (2001:504:0:3:0:1:5169:1)\u00a0 217.1 ms\u00a0 216.284 ms\u00a0 218.688 ms<\/em>
    \n 4\u00a0 2001:4860::1:0:29b3 (2001:4860::1:0:29b3)\u00a0 213.107 ms\u00a0 236.103 ms\u00a0 218.032 ms<\/em>
    \n 5\u00a0 2001:4860::8:0:2996 (2001:4860::8:0:2996)\u00a0 214.927 ms\u00a0 215.271 ms\u00a0 215.478 ms<\/em>
    \n 6\u00a0 2001:4860::1:0:47 (2001:4860::1:0:47)\u00a0 365.876 ms\u00a0 371.901 ms\u00a0 365.403 ms<\/em>
    \n 7\u00a0 2001:4860::1:0:1063 (2001:4860::1:0:1063)\u00a0 368.063 ms\u00a0 370.267 ms\u00a0 436.043 ms<\/em>
    \n 8\u00a0 2001:4860::2:0:119b (2001:4860::2:0:119b)\u00a0 372.152 ms\u00a0 378.474 ms\u00a0 365.889 ms<\/em>
    \n 9\u00a0 2001:4860:0:1::e1 (2001:4860:0:1::e1)\u00a0 369.283 ms\u00a0 374.321 ms\u00a0 378.08 ms<\/em>
    \n10\u00a0 2404:6800:8005::63 (2404:6800:8005::63)\u00a0 368.253 ms\u00a0 369.438 ms\u00a0 368.415 ms<\/em>
    \nelektro@elektro-desktop:~$ traceroute6 www.itb.ac.id<\/strong>
    \ntraceroute to www.itb.ac.id (2403:8000:1:76::146) from 2001:470:c:fad::2, 30 hops max, 16 byte packets<\/em>
    \n 1\u00a0 gigih-3.tunnel.tserv15.lax1.ipv6.he.net (2001:470:c:fad::1)\u00a0 223.472 ms\u00a0 223.143 ms\u00a0 220.389 ms<\/em>
    \n 2\u00a0 * gige-g4-6.core1.lax1.he.net (2001:470:0:9d::1)\u00a0 226.155 ms\u00a0 217.203 ms<\/em>
    \n 3\u00a0 gige-g3-18.core1.hkg1.he.net (2001:470:0:16b::2)\u00a0 375.667 ms\u00a0 375.167 ms\u00a0 372.305 ms<\/em>
    \n 4\u00a0 gige-g0-1.tserv19.hkg1.ipv6.he.net (2001:470:0:b8::2)\u00a0 372.522 ms\u00a0 376.242 ms\u00a0 372.575 ms<\/em>
    \n 5\u00a0 affanzbasalamah-1-pt.tunnel.tserv19.hkg1.ipv6.he.net (2001:470:17:72::2)\u00a0 428.956 ms\u00a0 431.524 ms\u00a0 427.849 ms<\/em>
    \n 6\u00a0 2001:d30:3::2303 (2001:d30:3::2303)\u00a0 430.581 ms\u00a0 431.541 ms\u00a0 429.666 ms<\/em>
    \n7\u00a0 * *^C<\/p>\n

    elektro@elektro-desktop:~$ traceroute6 www.v6.facebook.com<\/strong>
    \ntraceroute to www.v6.facebook.com (2620:0:1cfe:face:b00c::3) from 2001:470:c:fad::2, 30 hops max, 16 byte packets<\/em>
    \n 1\u00a0 gigih-3.tunnel.tserv15.lax1.ipv6.he.net (2001:470:c:fad::1)\u00a0 221.508 ms\u00a0 222.894 ms\u00a0 221.717 ms<\/em>
    \n 2\u00a0 gige-g4-6.core1.lax1.he.net (2001:470:0:9d::1)\u00a0 218.369 ms\u00a0 217.917 ms\u00a0 219.098 ms<\/em>
    \n 3\u00a0 10gigabitethernet2-2.core1.fmt2.he.net (2001:470:0:18d::1)\u00a0 225.671 ms\u00a0 224.228 ms\u00a0 224.639 ms<\/em>
    \n 4\u00a0 10gigabitethernet1-1.core1.sjc2.he.net (2001:470:0:31::2)\u00a0 249.272 ms\u00a0 225.826 ms\u00a0 224.337 ms<\/em>
    \n 5\u00a0 facebook.gige-g5-9.core1.sjc2.he.net (2001:470:0:14a::2)\u00a0 224.035 ms\u00a0 227.453 ms\u00a0 225.069 ms<\/em>
    \n 6\u00a0 *^C<\/em>
    \n <\/em><\/p>\n

    Nah sekarang kita sudah terhubung, tinggal distribusikan saja Alamat IPv6 tadi sesuai dengan kebutuhan.<\/p>\n

    Selamat Mencoba,<\/p>\n

    Quote today: Alloh bersama Orang-orang yang sabar (Apakah kita termasuk orang sabar????)<\/p>\n","protected":false},"excerpt":{"rendered":"

    Source from WIKI: An IP tunnel is an Internet Protocol (IP) network communications channel between two networks. It is used to transport another network protocol by encapsulation of its packets. IP tunnels are often used for connecting two disjoint IP networks that don’t have a native routing path to each other, via an underlying routable … Continue reading “Tunneling IPv6 with Ubuntu Linux Behind NAT ? Why Not..”<\/span><\/a><\/p>\n","protected":false},"author":25,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3,1348],"tags":[40,358,478,945,1008,1204,1209],"class_list":["post-480","post","type-post","status-publish","format-standard","hentry","category-blogosphere","category-kiat-sukses-menjadi-seorang-network-engineer-2","tag-6to4","tag-freebsd","tag-ipv6-behind-nat","tag-pf-conf","tag-router","tag-tunneling","tag-ubuntu"],"_links":{"self":[{"href":"https:\/\/dosen.unila.ac.id\/gigih\/wp-json\/wp\/v2\/posts\/480"}],"collection":[{"href":"https:\/\/dosen.unila.ac.id\/gigih\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/dosen.unila.ac.id\/gigih\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/dosen.unila.ac.id\/gigih\/wp-json\/wp\/v2\/users\/25"}],"replies":[{"embeddable":true,"href":"https:\/\/dosen.unila.ac.id\/gigih\/wp-json\/wp\/v2\/comments?post=480"}],"version-history":[{"count":0,"href":"https:\/\/dosen.unila.ac.id\/gigih\/wp-json\/wp\/v2\/posts\/480\/revisions"}],"wp:attachment":[{"href":"https:\/\/dosen.unila.ac.id\/gigih\/wp-json\/wp\/v2\/media?parent=480"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/dosen.unila.ac.id\/gigih\/wp-json\/wp\/v2\/categories?post=480"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/dosen.unila.ac.id\/gigih\/wp-json\/wp\/v2\/tags?post=480"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}