4. Network Address Translation (NAT) using netfilter6
Prev Chapter 18. Firewalling Next

4. Network Address Translation (NAT) using netfilter6

Since at least Linux kernel version 3.9.0 and using ip6tables since 1.4.18 also Network Address Translation (NAT) is usable.

4.1. IPv6 Masquerading

Like in IPv4 clients behind a router can be hided by using IPv6 masquerading (hide/overlap NAT), e.g.

# ip6tables -t nat -A POSTROUTING -o sixxs -s fec0::/64 -j MASQUERADE

4.2. IPv6 Destination NAT

A dedicated public IPv6 address can be forwarded to an internal IPv6 address, e.g.

# ip6tables -t nat -A PREROUTING -d 2001:db8:0:1:5054:ff:fe01:2345 -i sixxs -j DNAT --to-destination fec0::5054:ff:fe01:2345

4.3. IPv6 Port Forwarding

A dedicated specified port can be forwarded to an internal system, e.g.

# ip6tables -t nat -A PREROUTING -i sixxs -p tcp --dport 8080 -j DNAT --to-destination [fec0::1234]:80
Prev Up Next
3. Usage of ip6tables Home 5. Firewalling using nftables