Sharing my IPv6-Mostly Home Lab: NAT64, 464XLAT, internal NAT64 & RFC 8781
Hi r/ipv6,
About 8 months ago I shared my IPv6-mostly home lab and the lessons I had learned while moving my network toward IPv6-first operation. Since then, the lab has evolved quite a bit, and I thought I'd share some of the more interesting additions and implementation details.
The goal of this project is still the same: run day-to-day services over IPv6 wherever possible while providing transparent access to IPv4 resources only when necessary. Rather than simply making IPv6 "work", I've been trying to understand how the transition technologies actually behave and how they can be combined into a practical network.
Some of the additions since my last post include:
- Native NAT64/DNS64 for IPv6-only clients
- 464XLAT using dedicated CLAT gateway for IPv4-only applications on an IPv6-only network.
- An internal NAT64 translator that allows IPv6-only devices to reach IPv4-only internal services (currently Plex).
- An IPv6-only transit network between translation components.
- Automatic recovery after reboot using systemd services for Jool and the required iptables steering rules.
One of the more interesting discoveries involved RFC 8781.
I wanted to keep a single PREF64 (/96) while sending only the embedded 10.0.0.0/8 addresses to a separate NAT64 translator. Linux routing made this possible by installing a more-specific /104 route for the embedded 10/8 space, while all remaining traffic continued to the primary Internet NAT64 translator.
Initially this didn't work because I was running Jool in Netfilter mode. Jool intercepted every packet destined for the /96 before Linux had a chance to apply longest-prefix routing, so the /104 route was never used.
Switching Jool to iptables mode solved the problem by allowing selective interception. Internal NAT64 traffic is now routed first by Linux to the second translator, while Internet traffic continues to be translated locally by the NAT64 gateway.
The result is a design where clients only know about a single NAT64 prefix, while the network transparently selects the appropriate translator.
Tha lab now successfully supports all three simultaneously:
- Native Internet NAT64
- 464XLAT for legacy IPv4 applications
- Internal NAT64 for IPv4-only services such as Plex
This has been a really fun learning project over the past few years. Although it's build entirely from repurposed hardware rather than carrier equipment, it is been a great way to explore how IPv6 transition mechanism interact in practice and to better understand the operational behavior behind the RFCs.
I'm happy to answer questions, and I'd also be interested in hearing how others are approaching IPv6-only or IPv6-mostly home networks.