Learn NetBSD - IPv6 & Advanced Networking

#Introduction

In episode 15 we reinforced the system from within with PaX and security settings. Now it's time to look at the future of networking: in this episode we'll conquer IPv6 and advanced networking on NetBSD — autoconfiguration with SLAAC, DHCPv6, 6to4/6in4 tunneling, an IPv6 firewall with npf, and advanced routing concepts like OSPF via bird.

#IPv6 Basics on NetBSD

#Is IPv6 Active?

Most NetBSD kernels have supported IPv6 for a long time. Check with:

ifconfig wm0

wm0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500
        address: 52:54:00:12:34:56
        inet 192.168.1.50 netmask 0xffffff00 broadcast 192.168.1.255
        inet6 fe80::5054:ff:fe12:3456%wm0 prefixlen 64 scopeid 0x1

#Autoconfiguration: SLAAC

SLAAC (Stateless Address Autoconfiguration) is how IPv6 assigns itself an address without a server — based on the prefix announced by a router (via Router Advertisement). Check the received prefix:

ifconfig wm0

wm0: flags=...
        inet6 2001:db8:1::50 prefixlen 64 scopeid 0x1

dhcpcd -6 wm0

dhcpcd=YES

#DHCPv6: Stateful Configuration

SLAAC provides an address, but not all parameters. DHCPv6 fills the gap: DNS servers, domain, and other options. NetBSD provides a DHCPv6 client via a package:

cd /usr/pkgsrc/net/dhcpcd
make install clean

dhcpcd=YES
dhcpcd_flags="-6"

#Tunneling: 6to4 and 6in4

#6to4

6to4 uses the 2002::/16 prefix derived from the public IPv4 address. Enable it as a gif interface:

ifconfig gif0 create
ifconfig gif0 tunnel 192.168.1.50 192.88.99.1
ifconfig gif0 inet6 2002:c0a8:0132::1

#6in4

6in4 is a manual tunnel to an IPv6 broker (e.g. tunnelbroker). You get the IPv6 endpoint, the remote IPv4 address, and a prefix from the broker. Configuration:

ifconfig gif0 create
ifconfig gif0 tunnel 192.168.1.50 216.66.80.30
ifconfig gif0 inet6 2001:470:1f01:abc::2
route -n add -inet6 default 2001:470:1f01:abc::1

ifconfig_gif0="tunnel 192.168.1.50 216.66.80.30"
ifconfig_gif0_ipv6="inet6 2001:470:1f01:abc::2"
defaultroute6="2001:470:1f01:abc::1"

#An IPv6 Firewall with npf

A firewall that doesn't handle IPv6 only protects half the path. npf handles IPv4 and IPv6 in a single ruleset. Going back to the npf.conf from episode 12, add rules for IPv6:

$if = "wm0"
$ext_ip6 = 2001:db8:1::50
 
set default: in block all
set default: out block all
 
group default {
    pass on lo0 all
 
    pass out on $if inet6 proto { tcp, udp, icmp6 } \
        from $ext_ip6 to any
 
    pass in on $if inet6 proto icmp6 all \
        keep state
 
    pass in on $if inet6 proto tcp from any to $ext_ip6 port 22 \
        flags S/SA keep state
}

Notice the ICMPv6 rule (proto icmp6) — this is mandatory for IPv6 because the protocol uses ICMPv6 for essential functions: neighbor discovery, path MTU discovery, and router advertisements. Blocking ICMPv6 breaks IPv6.

npfctl reload

#Advanced Routing: bird and OSPF

For more complex networks, NetBSD can act as a dynamic router with bird — a routing daemon that supports OSPF, BGP, and RIP. Install from pkgsrc:

cd /usr/pkgsrc/net/bird
make install clean

A simple OSPF configuration in /usr/pkg/etc/bird.conf:

router id 192.168.1.50;
 
protocol kernel {
    learn;
    export all;
}
 
protocol device {
    scan time 10;
}
 
protocol ospf {
    export all;
    area 0 {
        interface "wm0" {
            cost 10;
        };
    };
}

Run bird and monitor its neighbors:

service bird start
birdc show ospf neighbor

BIRD 2.14 ready.
BIRD 2.14 connected.
Name    Proto    Address            State
router2 OSPF     10.0.0.2           Full/DR

#NAT64 (Optional)

NAT64 translates between IPv6 and IPv4 networks — letting IPv6-only hosts talk to IPv4 servers. NetBSD provides support through transition mechanisms; this is an advanced topic well suited to environments planning to go IPv6-only.

#Debugging IPv6

ping6 -c 3 netbsd.org

PING netbsd.org (2607:f0d0:...): 56 data bytes
64 bytes from ...: icmp_seq=0 time=3.24 ms

#Closing

In this episode 16, you've conquered modern NetBSD networking: IPv6 autoconfiguration with SLAAC, DHCPv6, 6to4 and 6in4 tunneling, an IPv6 firewall with npf, and advanced routing with bird and OSPF.

Key takeaways:

• IPv6 automatically appears as link-local (fe80::); SLAAC provides a global address without a server.
• DHCPv6 complements SLAAC with options like DNS.
• 6to4 uses the 2002:: prefix, 6in4 uses a manual broker — use 6in4 for production.
• The npf firewall must include ICMPv6 rules — blocking them breaks IPv6.
• bird brings OSPF/BGP; dynamic routes heal networks from link failures.

In the next episode, episode 17, we'll explore the most NetBSD-unique feature: rump kernels and kernel-in-userspace — running the kernel and drivers as ordinary processes with rump_server, booting a filesystem in userspace, and using it for testing without rebooting. See you in episode 17!