search

lxc / incus

Powerful system container and virtual machine manager
https://linuxcontainers.org/incus
Apache License 2.0
2.83k stars 225 forks source link

Feature Request: NAT64 support #602

Closed mkg20001 closed 8 months ago

mkg20001 commented 8 months ago

NAT64 is a transition technlogy to allow for IPv4 connectivity without the need to issue IPv4 addresses out of a dhcp pool (for clients that support it).

(Basically when all the options are set the client does CLAT with it's ipv6 sourcce address locally.)

The required network settings are:

Currently there is no simple way to make incus advertise NAT64 to containers/vms..

What I'd want is something like:

ipv6.nat64: "64:ff9b::/96"

And that would set the required dnsmasq options above

(Note that clients that do not know how to use nat64 will simply ignore the option 108 and use their ipv4 IP as usual)

stgraber commented 8 months ago

This feels like a case that's going to be nice enough that it's best served by a couple of lines in the network raw.dnsmasq.

It'd be a different story if Incus itself provided the NAT64 gateway for the instances and maybe even DNS64 though the DNS. But last I checked dnsmasq didn't know how to do DNS64 and I don't really want to have to drive tayga or similar through Incus.

So given this is really about exposing something external to Incus at this point, setting the extra DHCP option through raw.dnsmasq seems like the way to go.

Let us know how it works in the RA case, assuming dnsmasq supports it. If it's not easy to set that dnsmasq config through raw.dnsmasq, we'll work something out.

mkg20001 commented 8 months ago

I didn't find any way to set pref64 via dnsmasq. is dnsmasq responsible for RA or is it elsewhere?

mkg20001 commented 8 months ago

if you want to have it in incus: for running nat64 via lxc jool looks promising as it's quite simple to setup: https://nicmx.github.io/Jool/en/run-nat64.html

(that's what I'm using on my servers)

the only issue is that jool currently has no support for nftables, only iptables and the raw netfilter backend and in the way that the netfilter backend is written only one nat64 is possible at a time