RFC 3053
IPv6 Tunnel Broker
RFC 3053: IPv6 Tunnel Broker 🎀
okay bestie, this one is RFC 3053, "IPv6 Tunnel Broker" 💖 It was written by A. Durand (SUN Microsystems, Inc), P. Fasano, I. Guardini (CSELT S.p.A.), and D. Lento (TIM). It's marked Informational and dated January 2001 ✨ The title block doesn't list anything it obsoletes or updates, so it's not replacing or changing any other RFC 🦋
Status of This Memo 🌸
this memo is here to inform the Internet community, not to set any kind of Internet standard 🧚 and distribution is totally unlimited, so share away!
Copyright Notice 💜
the Internet Society owns the copyright here (2001) and all rights are reserved 🔒
Abstract ✨
the IPv6 global Internet today runs on a LOT of tunnels sitting on top of the existing IPv4 infrastructure 🌈 and those tunnels are a pain to configure and maintain at scale 😭 the 6bone proved that big sites and ISPs can pull it off, but it's way too complicated for an isolated end user who already has an IPv4 connection and just wants in on IPv6 💅
that's where the tunnel broker model comes in 🦋 its whole goal is to help early IPv6 adopters hook up to an existing IPv6 network (like the 6bone) and get stable, permanent IPv6 addresses and DNS names. the concept was first presented at Orlando's IETF in December 1998, and two implementations were demoed during the Grenoble IPng & NGtrans interim meeting in February 1999 🎉
1. Introduction 🍓
okay so IPv6 networks mostly grew by riding on the transport the current Internet already gives us, and that led to a bunch of techniques for running IPv6 over IPv4 tunnels 🚇 right now most of the 6bone is built on manually configured tunnels over the Internet, and the big downside is the huge management load on network admins, who have to hand-configure every single tunnel 😩
people have tried to reduce that overhead, and each option is cute in its own way but solves different problems than the Tunnel Broker, or comes with drawbacks the Tunnel Broker doesn't have 💀
- automatic tunnels with IPv4 compatible addresses [1] are a simple way to get early IPv6 connectivity between isolated dual-stack hosts and/or routers 🌸 the catch is that they don't fix IPv4 address exhaustion. there's also a big fear about pulling the full IPv4 routing table into the IPv6 world, because that would make the routing table size problem even worse, multiplying it by 5 😬
- 6over4 [2] is a site local transition mechanism that uses IPv4 multicast as a virtual link layer 🧚 it doesn't solve connecting an isolated user to the global IPv6 Internet, so it's not the move for that
- 6to4 [3] was designed so isolated IPv6 domains, attached to a wide area network with no native IPv6 support (like the IPv4 Internet), can talk to other IPv6 domains with minimal manual config 💖 the trick is embedding IPv4 tunnel addresses into the IPv6 prefixes, so any domain border router can automatically find tunnel endpoints for outbound IPv6 traffic ✨
the Tunnel Broker is a different approach 💅 it uses dedicated servers, called Tunnel Brokers, to automatically manage tunnel requests from users. it's expected to help the growth of IPv6 interconnected hosts and let early IPv6 network providers offer easy access to their networks 🌈
the main difference between the Tunnel Broker and 6to4 is that they serve different parts of the IPv6 community 👑
- the Tunnel Broker is a great fit for small isolated IPv6 sites, and especially isolated IPv6 hosts on the IPv4 Internet, that want to easily connect to an existing IPv6 network 🦋
- 6to4 is built so isolated IPv6 sites can easily connect to each other without waiting for their IPv4 ISPs to deliver native IPv6 services 💜 it's very well suited for extranets and virtual private networks. with 6to4 relays, 6to4 sites can also reach sites on the IPv6 Internet 🔥
on top of that, the Tunnel Broker approach lets IPv6 ISPs do access control on their users, enforcing their own policies on how network resources get used 🔒
this document lays out a framework with guidelines for providing a Tunnel Broker service on the Internet. it doesn't specify any protocol. instead it details the general architecture of the proposed approach, and it outlines a set of viable alternatives for implementing it 🧚 here's the roadmap: Section 2 gives an overall description of the Tunnel Broker model, Section 3 covers known limitations, Section 4 quickly outlines other possible applications, and Section 5 addresses security issues 👀
2. Tunnel Broker Model 🌈
okay so tunnel brokers are basically virtual IPv6 ISPs 💖 they give IPv6 connectivity to users who are already connected to the IPv4 Internet. in the emerging IPv6 Internet, many tunnel brokers are expected to be around, so the user can just pick one 🎀 the list of tunnel brokers should be posted on a "well known" web page (for example, http://www.ipv6.org) so users can choose the "closest" one, the "cheapest" one, or whichever one they vibe with ✨
the tunnel broker model is built from the set of functional elements shown in figure 1 🦋
+------+
/|tunnel|
/ |server|
/ | |
/ +------+
+----------+ +------+/ +------+
|dual-stack| |tunnel| |tunnel|
| node |<--->|broker|<--->|server|
| (user) | | | | |
+----------+ +------+\ +------+
| \ +------+
tunnel end-point v \ |tunnel|
/\ +---+ \ |server|
|| |DNS| \| |
|| +---+ +------+
||
|| tunnel end-point
|| /\
|| ||
|+---------------------------+|
+-----------------------------+
IPv6 over IPv4 tunnel
Figure 1: the Tunnel Broker model2.1 Tunnel Broker (TB) 💅
the TB is where the user connects to register and activate tunnels 🌸 it handles tunnel creation, modification, and deletion on the user's behalf.
for scalability, the tunnel broker can share the load of network-side tunnel endpoints across several tunnel servers 🧚 whenever a tunnel has to be created, modified, or deleted, it sends configuration orders to the relevant tunnel server. the TB may also register the user's IPv6 address and name in the DNS 💖
a TB must be IPv4 addressable 🔒 it may also be IPv6 addressable, but that isn't mandatory. the broker and the servers can talk over either IPv4 or IPv6 ✨
2.2 Tunnel server (TS) 🌈
a TS is a dual-stack (IPv4 & IPv6) router connected to the global Internet 👑 when it gets a configuration order from the TB, it creates, modifies, or deletes the server side of each tunnel. it may also keep usage statistics for every active tunnel 📊
2.3 Using the Tunnel Broker 🦋
the client of the Tunnel Broker service is a dual-stack IPv6 node (host or router) connected to the IPv4 Internet 💜 when approaching the TB, the client should first be asked for its identity and credentials, so proper user authentication, authorization, and (optionally) accounting can happen (for example, relying on existing AAA facilities such as RADIUS) 🔒 this means the client and the TB have to share a pre-configured or automatically established security association, which prevents unauthorized use of the service 🚨 in this sense, the TB acts like an access-control server for IPv4 interconnected IPv6 users 🎀
once the client is authorized to use the service, it should provide at least the following info:
- the IPv4 address of the client side of the tunnel 🌸
- a name to be used for registering in the DNS the global IPv6 address assigned to the client side of the tunnel 🧚
- the client function (standalone host or router) 💖
also, if the client machine is an IPv6 router that wants to give connectivity to several IPv6 hosts, the client should also be asked for info about how many IPv6 addresses it needs ✨ that lets the TB give the client an IPv6 prefix that fits its needs, instead of just a single IPv6 address 🌈
the TB handles client requests like this 💅
- first, it designates a Tunnel Server to be the actual tunnel endpoint on the network side (for example, based on some load sharing criteria set by the TB administrator) 👑
- it chooses the IPv6 prefix to allocate to the client. the prefix length can be anything from 0 to 128, with the most common values being 48 (site prefix), 64 (subnet prefix), or 128 (host prefix) 🦋
- it sets a lifetime for the tunnel 🕰️
- it automatically registers the global IPv6 addresses assigned to the tunnel endpoints in the DNS 💜
- it configures the server side of the tunnel 🔥
- it sends the relevant configuration info to the client, including tunnel parameters and DNS names 🎉
after those configuration steps are done (including configuring the client), the IPv6 over IPv4 tunnel between the client host/router and the chosen TS is up and running 🥳 so the tunnel broker user gets access to the 6bone or any other IPv6 network the TS is connected to. iconic ✨
2.4 IPv6 address assignment 🌸
the IPv6 addresses assigned to both sides of each tunnel must be global IPv6 addresses from the IPv6 addressing space managed by the TB 🔒
the lifetime of these addresses should be relatively long, and potentially longer than the lifetime of the user's IPv4 connection 🧚 this is so the client can get semipermanent IPv6 addresses and associated DNS names, even though it's connected to the Internet over a dial-up link and gets dynamically assigned IPv4 addresses through DHCP 💖 main character energy, no cap 💅
next up: the limitations, the other applications, and the security stuff 👀
2.5. Tunnel management ✨
okay bestie, tunnels are literally eating up precious resources on the tunnel servers (memory and processing time 😭), so the vibe is to keep the number of unused tunnels as small as possible by deploying a well designed tunnel management mechanism 💅
Each IPv6 over IPv4 tunnel created by the TB should at least be assigned a lifetime and removed after its expiration unless an explicit lifetime extension request is submitted by the client 🎀
ngl this isn't an optimal solution, especially for users on short-lived and dynamically addressed IPv4 connections (like dial-up links) 🙈 A newly established tunnel is likely to be used just for a short time and then never again, because every time the user reconnects they get a new IPv4 address and are therefore obliged either to set up a new tunnel or to update the configuration of the previous one. so a more effective tunnel management may be achieved by having the TS periodically deliver to the TB IPv6 traffic and reachability statistics for every active tunnel 📊 That way the TB can enforce a tunnel deletion after a period of inactivity without waiting for the expiration of the related lifetime, which can be relatively longer (e.g., several days) ⏳
another idea is to implement some kind of tunnel management protocol or keep-alive mechanism between the client and the TS (or between the client and the TB), so each tunnel can be immediately released after the user disconnects (e.g., removing their tunnel end-point or tearing down their IPv4 connection to the Internet) 🦋 the catch? this policy mechanism also requires a software upgrade on the client machine to add support for the ad-hoc keep-alive mechanism described above 🥲
Moreover, keeping track of the tunnel configuration even after the user has disconnected from the IPv4 Internet may be worth the extra cost 🧚 when the user reconnects, possibly with a different IPv4 address, they could just restart the tunnel by getting in touch with the TB again. The TB could then order a TS to re-create the tunnel using the new IPv4 address of the client but reusing the previously allocated IPv6 addresses. that way the client could preserve a nearly permanent (static) IPv6 address even though its IPv4 address is dynamic 👑 It could also preserve the associated DNS name 💖
2.6. Interactions between client, TB, TS and DNS 🌸
as already said, defining a specific set of protocols and procedures for communication among the various entities in the Tunnel Broker architecture is outside the scope of this framework document 🙃 Still, the rest of this section briefly describes some viable technical alternatives for client-TB, TB-TS and TB-DNS interactions, to help future implementation efforts or standardization initiatives 🫶
The interaction between the TB and the user could be based on http 🌈 For example, the user could provide the relevant configuration information (i.e., the IPv4 address of the client side of the tunnel, etc.) by just filling out some forms on a Web server running on the TB. As a result, the server could respond with an html page stating that the server end-point of the tunnel is configured and displaying all the relevant tunnel information ✨
After that, the most trivial approach would be to leave the user to configure the client end-point of the tunnel on their own. however, it should be highly valuable to support a mechanism that automates this procedure as much as possible 🔥
There are several options to help the Tunnel Broker user configure their dual-stack equipment 💅 The simplest option is that the TB could just prepare personalized activation and de-activation scripts to be run off-line on the client machine to set up the client side tunnel end-point easily. This solution is clearly the easiest to implement and operate, because it does not require any software extension on the client machine 🍓 However, it raises several security concerns, because it may be difficult for the user to verify that previously downloaded scripts do not perform illegal or dangerous operations once executed 💀
The above security issues could be elegantly overcome by defining a new MIME (Multipurpose Internet Mail Extension) content-type (e.g., application/tunnel) [4,5] to be used by the TB to deliver the tunnel parameters to the client 💜 In this case, there must be a dedicated agent running on the client to process this information and actually set up the tunnel end-point on behalf of the user. This is a very attractive approach that is worth considering 😍 In particular, defining the new content-type might be the subject of a future ad-hoc document 📝
Several options are also available to achieve proper interaction between the broker and the Tunnel Servers 🛠️ For example, a set of simple RSH commands over IPsec could be used for this purpose. Another alternative could be to use SNMP or to adopt any other network management solution 🧚
Finally, the Dynamic DNS Update protocol [6] should be used for automatic DNS updates (i.e., to add or delete AAAA, A6 and PTR records from the DNS zone reserved for Tunnel Broker users) controlled by the TB 🎀 A simple alternative would be for the TB to use a small set of RSH commands to dynamically update the direct and inverse databases on the authoritative DNS server for the Tunnel Broker users zone (e.g. broker.isp-name.com) 🦋
2.7. Open issues 🙈
real usage of the TB service may require the introduction of accounting/billing functions 💸
3. Known limitations ⚠️
This mechanism may not work if the user is using private IPv4 addresses behind a NAT box 🥺
4. Use of the tunnel broker concept in other areas 🌍
The Tunnel Broker approach might be efficiently exploited to automatically set up and manage any other kind of tunnel, such as a multicast tunnel (e.g., used to interconnect multicast islands within the unicast Internet) or an IPsec tunnel 🔥
Moreover, the idea of deploying a dedicated access-control server, like the TB, to securely authorize and assist users who want to gain access to an IPv6 network might prove useful for enhancing other transition mechanisms too 👑 For example, it would be possible to exploit a similar approach within the 6to4 model to achieve easy relay discovery. This would make life easier for early 6to4 adopters, but it would also allow ISPs to better control the usage of their 6to4 relay facilities (e.g., by setting up appropriate usage policies) 💅
5. Security Considerations 🚨
All the interactions between the functional elements of the proposed architecture need to be secured:
- the interaction between the client and TB;
- the interaction between the TB and the Tunnel Server;
- the interaction between the TB and the DNS.
The security techniques adopted for each of the required interactions depend on the implementation choices 😬
For the client-TB interaction, using http allows the exploitation of widely adopted security features, such as SSL (Secure Socket Layer) [7], to encrypt data sent to and downloaded from the web server 🔐 This also makes it possible to rely on a simple "username" and "password" authentication procedure and on existing AAA facilities (e.g., RADIUS) to enforce access control 🫶
For the TB-TS interaction, secure SNMP could be adopted [8,9,10] 🛡️ If the dynamic DNS update procedure is used for the TB-DNS interaction, the security issues are the same as discussed in [11] 🧐 Otherwise, if a simpler approach based on RSH commands is used, standard IPsec mechanisms can be applied [12] 🔒
Furthermore, if the configuration of the client is achieved by running scripts provided by the TB, these scripts must be executed with enough privileges to manage network interfaces, such as an administrator/root role. This can be dangerous and should be considered only for early implementations of the Tunnel Broker approach 😱 Transferring tunnel configuration parameters in a MIME type over https is a more secure approach 💖
In addition, a loss of confidentiality may occur whenever a dial-up user disconnects from the Internet without tearing down the tunnel previously established through the TB 🚫 In fact, the TS keeps tunneling the IPv6 traffic addressed to that user to their old IPv4 address, regardless of the fact that in the meantime that IPv4 address could have been dynamically assigned to another subscriber of the same dial-up ISP 😭 This problem could be solved by implementing, on every tunnel, the keep-alive mechanism outlined in section 2.5, thus allowing the TB to immediately stop IPv6 traffic forwarding towards disconnected users 🛑
Finally, TBs must implement protections against denial of service attacks, which may occur whenever a malicious user exhausts all the resources available on the tunnel server by asking for a lot of tunnels to be established all at once 💀 A possible protection against this attack could be achieved by administratively limiting the number of tunnels that a single user is allowed to set up at the same time 🧱
6. Acknowledgments 💜
Some of the ideas refining the tunnel broker model came from discussion with Perry Metzger and Marc Blanchet 🫶
7. References 📚
[1] Gilligan, R. and E. Nordmark, "Transition Mechanisms for IPv6 Hosts and Routers", RFC 1933, April 1996.
[2] Carpenter, B. and C. Jung, "Transmission of IPv6 over IPv4 Domains without Explicit Tunnels", RFC 2529, March 1999.
[3] Carpenter, B. and K. Moore, "Connection of IPv6 Domains via IPv4 Clouds without Explicit Tunnels", Work in Progress.
[4] Freed, N. and N. Borenstein, "Multipurpose Internet Mail Extensions (MIME) Part One: Format of Internet Message Bodies, RFC 2045, November 1996.
[5] Freed, N. and N. Borenstein, "Multipurpose Internet Mail Extensions (MIME) Part Two: Media Types", RFC 2046, November 1996.
[6] Vixie, P., Editor, Thomson, T., Rekhter, Y. and J. Bound, "Dynamic Updates in the Domain Name System (DNS UPDATE)", RFC 2136, April 1997.
[7] Guttman, E., Leong, L. and G. Malkin, "Users' Security Handbook", FYI 34, RFC 2504, February 1999.
[8] Wijnen, B., Harrington, D. and R. Presuhn, "An Architecture for Describing SNMP Management Frameworks", RFC 2571, April 1999.
[9] Blumenthal, U. and B. Wijnen, "User-based Security Model (USM) for version 3 of the Simple Network Management Protocol (SNMPv3)", RFC 2574, April 1999.
[10] Wijnen, B., Presuhn, R. and K. McCloghrie, "View-based Access Control Model (VACM) for the Simple Network Management Protocol (SNMP)", RFC 2575, April 1999.
[11] Eastlake, D., "Secure Domain Name System Dynamic Update", RFC 2137, April 1997.
[12] Kent, S. and R. Atkinson, "Security Architecture for the Internet Protocol", RFC 2401, November 1998.
8. Authors' Addresses ✨
okay so the squad behind this RFC is literally four people, and this is where we get their contact details 🫶 I'm keeping every single phone number and email exactly as written because you do NOT want to mess up a contact list, bestie 📱💖
Alain Durand 💅 SUN Microsystems, Inc 901 San Antonio Road MPK17-202 Palo Alto, CA 94303-4900 USA
Phone: +1 650 786 7503 EMail: Alain.Durand@sun.com
Paolo Fasano 🦋 S.p.A. CSELT S.p.A. Switching and Network Services - Networking via G. Reiss Romoli, 274 10148 TORINO Italy
Phone: +39 011 2285071 EMail: paolo.fasano@cselt.it
Ivano Guardini 🌸 CSELT S.p.A. Switching and Network Services - Networking via G. Reiss Romoli, 274 10148 TORINO Italy
Phone: +39 011 2285424 EMail: ivano.guardini@cselt.it
Domenico Lento 🍓 TIM Business Unit Project Management via Orsini, 9 90100 Palermo Italy
Phone: +39 091 7583243 EMail: dlento@mail.tim.it
9. Full Copyright Statement 🌈
Okay this part is the legal bit, so I'm keeping it word for word, no cap 🙈 The gist is that the Internet Society owns the copyright (2001), and you're free to share this doc, but the document itself can't be modified, except for the specific cases the text spells out 💜
Copyright (C) The Internet Society (2001). All Rights Reserved.
This document and translations of it may be copied and furnished to others, and derivative works that comment on or otherwise explain it or assist in its implementation may be prepared, copied, published and distributed, in whole or in part, without restriction of any kind, provided that the above copyright notice and this paragraph are included on all such copies and derivative works. However, this document itself may not be modified in any way, such as by removing the copyright notice or references to the Internet Society or other Internet organizations, except as needed for the purpose of developing Internet standards in which case the procedures for copyrights defined in the Internet Standards process must be followed, or as required to translate it into languages other than English.
The limited permissions granted above are perpetual and will not be revoked by the Internet Society or its successors or assigns.
This document and the information contained herein is provided on an "AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
Acknowledgement 💖
Funding for the RFC Editor function is currently provided by the Internet Society. 👑
📦 where this page comes from
- ietf: rfc3053 2001-01
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms