RFC 3142

An IPv6-to-IPv4 Transport Relay Translator

📅 published June 2001, from ietf

RFC 3142: An IPv6-to-IPv4 Transport Relay Translator ✨

okay bestie, this one is from June 2001 and it's an Informational RFC 🎀 written by J. Hagino and K. Yamamoto from the IIJ Research Laboratory. It's part of the Network Working Group series, and its header doesn't list any obsoletes or updates. The whole point is a translator called a TRT that lets IPv6-only hosts talk to IPv4-only hosts using TCP and UDP 🦋

Status of this Memo

this memo gives info to the Internet community 💖 it does not specify an Internet standard of any kind, and distribution is unlimited 🌸

Copyright Notice

Abstract

this doc describes an IPv6-to-IPv4 transport relay translator (TRT) 🧚 it lets IPv6-only hosts swap {TCP,UDP} traffic with IPv4-only hosts. the TRT sits in the middle and translates {TCP,UDP}/IPv6 to {TCP,UDP}/IPv4, or the other way around 🔥

the memo is about how to build a TRT system with existing tech. it doesn't define any new protocols, so no new rules to memorize ✨

1. Problem domain ✨

okay so when you run an IPv6-only network, you still want to reach IPv4-only stuff outside, like IPv4-only web servers 🌈 a bunch of IPv6-to-IPv4 translation techs were proposed to fix this, mostly in the IETF ngtrans working group. this memo's translator uses the transport relay technique instead 💜

we call this translator "TRT" (transport relay translator). it sits between IPv6-only hosts and IPv4 hosts and translates {TCP,UDP}/IPv6 to {TCP,UDP}/IPv4, and vice versa 🎀

the advantages of TRT are:

TRT is designed so the IPv6-only initiating hosts don't need any extra changes, and neither do the IPv4-only destination hosts. some other translation mechanisms need changes on the IPv6-only initiating hosts, which makes them harder to deploy 🦋
IPv6-to-IPv4 header converters have to deal with path MTU and fragmentation issues. TRT is free from this problem 👑

the disadvantages are:

TRT supports bidirectional traffic only. header converters might be able to handle other cases, like unidirectional multicast datagrams 🙈
TRT needs a stateful TRT system between the communicating peers, just like NAT systems. you can put multiple TRT systems in a site (see Appendix A), but a transport layer connection goes through one particular TRT system. so the TRT system can be a single point of failure, again like NAT systems 💀 other mechanisms, like SIIT [Nordmark, 2000], use stateless translator systems that avoid a single point of failure 😭
special code is needed to relay NAT-unfriendly protocols. some of them, including IPsec, can't be used across a TRT system 🥲

this memo assumes traffic is started by an IPv6-only host headed to an IPv4-only host. the memo can be extended to handle the opposite direction, if an appropriate address mapping mechanism is introduced ✨

2. IPv4-to-IPv4 transport relay ✨

so before the next section makes sense, we need the general idea of transport relay 🧠 the technique itself isn't new, since lots of firewall-related products already use it 💅

2.1. TCP relay

TCP relay systems have been used in firewall-related products 🔥 these products are designed to hit two goals: (1) block forwarding of IP packets across a system, and (2) let {TCP,UDP} traffic get through the system indirectly 💖 check out this network setup. the "TCP relay system" in the diagram doesn't forward IP packets from the inner network to the outer network, or the other way around. it only relays TCP traffic on a specific port, from inner to outer and outer to inner 🦋 (fyi the diagram only has two subnets, one inner and one outer. in real life both sides can be way more complex, with as many subnets and routers as you want 🌸)

   destination host
     |X
   ==+=======+== outer network
             |Y
           TCP relay system
             |B
   ==+=======+== inner network
     |A
   initiating host

so when the initiating host (IP address A) tries to make a TCP connection to the destination host (X), the TCP packets get routed toward the TCP relay system based on the routing decision 🧚 the TCP relay system receives and accepts the packets, even though it doesn't own the destination IP address (X). it pretends to be X, and sets up a TCP connection with the initiating host as X 🎀 then the TCP relay system makes another TCP connection from Y to X, and relays traffic from A to X and back again 💜

so there are two TCP connections in the picture: one from A to B (as X), and one from Y to X, like this:

   TCP/IPv4: the initiating host (A) --> the TCP relay system (as X)
       address on IPv4 header: A -> X
   TCP/IPv4: the TCP relay system (Y) --> the destination host (X)
       address on IPv4 header: Y -> X

the TCP relay system needs to capture some TCP packets that aren't destined to its address. how it does that is up to the implementation and is outside the scope of this memo 🙈

2.2. UDP relay

if you can recognize UDP inbound and outbound traffic as a pair somehow, UDP relay can be done in a similar way to TCP relay ✨ an implementation can recognize UDP traffic pairs the way NAT systems do, by recording address/port pairs in a table and managing the table entries with timeouts 🦋

3. IPv6-to-IPv4 transport relay translator 👑

we propose a transport relay translator for IPv6-to-IPv4 protocol translation, which is the TRT 💅 in what follows, we describe TRT for TCP. TRT for UDP can be implemented in a similar manner 🌈

for address mapping, we reserve an IPv6 prefix called C6::/64 💖 C6::/64 should be part of the IPv6 unicast address space assigned to the site. routing info must be configured so that packets to C6::/64 get routed toward the TRT system 🧚 the diagram below shows the network setup. the subnet marked "dummy prefix" doesn't actually exist. also, for now we assume the initiating host is IPv6-only and the destination host is IPv4-only 🎀

   destination host
     |X4
   ==+=======+== outer network
             |Y4
           TRT system --- dummy prefix (C6::/64)
             |B6
   ==+=======+== inner network
     |A6
   initiating host

when the initiating host (IPv6 address A6) wants to connect to the destination host (IPv4 address X4), it needs to make a TCP/IPv6 connection toward C6::X4 💜 for example, if C6::/64 equals fec0:0:0:1::/64 and X4 equals 10.1.1.1, the destination address to use is fec0:0:0:1::10.1.1.1 🦋 the packet gets routed toward the TRT system and captured by it ✨ the TRT system accepts the TCP/IPv6 connection between A6 and C6::X4, and talks to the initiating host using TCP/IPv6 🔥 then the TRT system looks at the lowermost 32 bits of the destination address (IPv6 address C6::X4) to get the real IPv4 destination (IPv4 address X4) 🧠 it makes a TCP/IPv4 connection from Y4 to X4 and forwards traffic across the two TCP connections 🌸

so there are two TCP connections. one is TCP/IPv6 and one is TCP/IPv4. in the picture, that's A6 to B6 (as C6::X4), and Y4 to X4, like this:

   TCP/IPv6: the initiating host (A6) --> the TRT system (as C6::X4)
       address on IPv6 header: A6 -> C6::X4
   TCP/IPv4: the TRT system (Y4) --> the destination host (X4)
       address on IPv4 header: Y4 -> X4

4. Address mapping 🗺️

like we saw in the last section, an initiating host has to use a special form of IPv6 address to connect to an IPv4 destination host 💅 that special form can be resolved from a hostname using a static address mapping table on the initiating host (like /etc/hosts on UNIX), a special DNS server implementation, or a modified DNS resolver implementation on the initiating host 🎀

5. Notes to implementers 📝

TRT for UDP must take care of path MTU issues on the UDP/IPv6 side 😭 the good news is that, since we don't relay IP layer packets between IPv4 and IPv6, we can decide the IPv6 path MTU independently of the IPv4 traffic 🫶 a simple solution is to always fragment packets from the TRT system to the UDP/IPv6 side to the IPv6 minimum MTU (1280 octets), which gets rid of the need for IPv6 path MTU discovery ✨

even though the TRT system only relays {TCP,UDP} traffic, it also needs to check ICMPv6 packets destined to C6::X4, so it can recognize path MTU discovery messages and other notifications between A6 and C6::X4 🧚

when forwarding TCP traffic, a TRT system needs to handle urgent data [Postel, 1981] carefully 💀

to relay NAT-unfriendly protocols [Hain, 2000], a TRT system may need to modify data content, just like any translator that modifies IP addresses 🙈

scalability issues must be carefully considered when you deploy TRT systems to a large IPv6 site 🔥 the scalability parameters are (1) the number of connections the operating system kernel can accept, (2) the number of connections a userland process can forward (which equals the number of filehandles per process), and (3) the number of transport relaying processes on a TRT system 👑 you have to make a design decision about using the right number of userland processes to support the right number of connections 💅

to make TRT for TCP more scalable in a large site, you can have multiple TRT systems in the site 🌈 you do that by taking these steps: (1) configure multiple TRT systems, (2) configure a different dummy prefix on each of them, and (3) let the initiating host pick a dummy prefix randomly for load-balancing 💖 step (3) can be done like this: if you install a special DNS server in the site, you may (3a) configure the DNS servers differently so they return different dummy prefixes, and tell initiating hosts about different DNS servers 🧚 or you can (3b) let the DNS server pick a dummy prefix randomly for load-balancing 🎀 the load-balancing works because you won't be changing the destination address (and therefore the TRT system) once a TCP connection is established 🦋

for address mapping, the authors recommend a special DNS server for large-scale installations, and static mapping for small-scale installations 💜 it's not always possible to have a special resolver on the initiating host, and assuming it would cause deployment problems 🫶

6. Applicability statement 🎀

Okay so, combined with a special DNS server (one that translates IPv4 addresses into IPv6) ✨, TRT systems are literally SO good at IPv6-to-IPv4 translation 💖 They need no changes to existing IPv6 clients or IPv4 servers, so a TRT system can be installed super easily on existing IPv6-capable networks 🧚

IPv4-to-IPv6 translation is way harder to pull off with any of the translator techniques [Yamamoto, 1998] 😭 You can use a TRT system for it, but it needs nontrivial mapping between DNS names and temporary IPv4 addresses, as presented in the NAT-PT RFC [Tsirtsis, 2000] 🙈

As we saw in the earlier sections, TRT systems use the transport layer (TCP/UDP) relay technique to translate IPv6 traffic into IPv4 traffic 🦋 This gives two major perks: (1) the TRT system can be implemented really simply, and (2) path MTU discovery gets easier to deal with, because the IPv6 path MTU can be decided independently from the IPv4 path MTU 👑 Even with all that simplicity, a TRT system can cover most daily apps (HTTP, SMTP, SSH, and many other protocols) 💅 For NAT-unfriendly protocols, a TRT system may need to modify data content, just like any translators/NATs 🌸 And since the TRT system lives in the transport layer, it can't translate protocols it doesn't know about 💀

Normally users don't want to translate DNS query/reply traffic through the TRT system 🙅 Instead, it makes more sense to run a standard DNS server, or a special DNS server that helps the TRT system, somewhere in the site's IPv6 network. There are two reasons for this:

Transport issue 🚌 It's a lot easier to provide a recursive DNS server that's accessible via IPv6 than to translate DNS queries/replies across the TRT system. If someone tries to make TRT translate DNS packets, they'd have to put C6::X (where C6 is the TRT reserved prefix and X is an IPv4 address of a DNS server) into /etc/resolv.conf. That configuration is more complicated than we normally want 😩
Payload issue 📦 In some installations it makes more sense to transmit queries/replies unmodified across the TRT system. In other installations it makes more sense to translate IPv4 DNS queries (like queries for AAAA records) into queries for A records, and vice versa, to invite traffic into the TRT system. It depends on the installation and configuration at the user's site 🍓

7. Security Considerations 💀

Okay, this section is serious, bestie 🚨 A malicious party may try to use TRT systems like an SMTP open relay [Lindberg, 1999] for traffic to IPv4 destinations. That's similar to circumventing ingress filtering [Ferguson, 1998] , or it could be used to achieve some other improper use. TRT systems should implement some sort of access control to prevent this kind of improper usage 🔒

A careless TRT implementation may be subject to a buffer overflow attack 😱 but this kind of issue is implementation dependent and outside the scope of this memo.

Because of the nature of the TCP/UDP relaying service, it is not recommended to use TRT for protocols that use authentication based on source IP address (i.e., rsh/rlogin) 🙅‍♀️

A transport relay system intercepts a TCP connection between two nodes. This may not be a legitimate behavior for an IP node. The document does not try to claim that it is legitimate 🤷

IPsec cannot be used across a relay 🚫

Using DNS proxies that modify the RRs will make it impossible for the resolver to verify DNSsec signatures 💔

References 📚

[Nordmark, 2000.] Nordmark, E., "Stateless IP/ICMP Translator
                  (SIIT)", RFC 2765, February 2000.

[Postel, 1981.]   Postel, J., "Transmission Control Protocol", STD 7,
                  RFC 793 September 1981.

[Hain, 2000.]     Hain, T., "Architectural Implications of NAT", RFC
                  2993, November 2000.

[Yamamoto, 1998]  K. Yamamoto, A. Kato, M Sumikawa, and J. Murai,
                  "Deployment and Experiences of WIDE 6bone", in
                  Proceedings of INET98, 1998.

[Tsirtsis, 2000.] Tsirtsis, G. and P. Srisuresh, "Network Address
                  Translation - Protocol Translation (NAT-PT)", RFC
                  2766, February 2000.

[Lindberg, 1999.] Lindberg, G., "Anti-Spam Recommendations for SMTP
                  MTAs", RFC 2505, February 1999.

[Ferguson, 1998.] Ferguson, P. and D. Senie, "Network Ingress
                  Filtering: Defeating Denial of Service Attacks
                  which employ IP Source Address Spoofing", RFC 2267,
                  January 1998.

Appendix A. Operational experiences 🧪

The WIDE KAME IPv6 stack implements TRT for TCP, and it's called "FAITH" 💖 The implementation came from the WIDE Hydrangea IPv6 stack, which is one of the ancestors of the KAME IPv6 stack 🌳

FAITH has been available and operational for more than 5 years 🎉 It was used at a WIDE research group offsite meeting and at the IETF ipngwg 1999 Tokyo interim meeting. At that last one, the team set up an IPv6-only terminal network cluster, just like they do at IETF meetings, and used a TRT system to support more than 100 IPv6 hosts on the meeting network so they could connect to outside IPv4 hosts 🤯 From the statistics they gathered, SSH, FTP, HTTP, and POP3 were the most popular protocols relayed 📊 The implementation was also used in the terminal cluster IPv6 network at IETF48, IETF49, and IETF50 🌈

The source code is available as free software, bundled in the KAME IPv6 stack kit 🫶

Special DNS server implementations are available as the "newbie" DNS server implementation by Yusuke DOI, and the "totd" DNS proxy server from University of Tromso (Norway) 🧚

Acknowledgements 🫶

The authors would like to thank the people who were involved in implementing the KAME FAITH translator code, including Kei-ichi SHIMA and Munechika SUMIKAWA. Thank you, queens 👑

Authors' Addresses 🏢

Jun-ichiro itojun HAGINO
Research Laboratory, Internet Initiative Japan Inc.
Takebashi Yasuda Bldg.,
3-13 Kanda Nishiki-cho,
Chiyoda-ku, Tokyo 101-0054, JAPAN

Phone: +81-3-5259-6350
Fax:   +81-3-5259-6351
EMail: itojun@iijlab.net


Kazu YAMAMOTO
Research Laboratory, Internet Initiative Japan Inc.
Takebashi Yasuda Bldg.,
3-13 Kanda Nishiki-cho,
Chiyoda-ku, Tokyo 101-0054, JAPAN

Phone: +81-3-5259-6350
Fax:   +81-3-5259-6351
EMail: kazu@iijlab.net

Full Copyright Statement ⚖️

Here's the legal stuff, and I'm keeping it word-for-word so nothing gets lost 🙏

This document and translations of it may be copied and furnished to others, and derivative works that comment on or otherwise explain it or assist in its implementation may be prepared, copied, published and distributed, in whole or in part, without restriction of any kind, provided that the above copyright notice and this paragraph are included on all such copies and derivative works. However, this document itself may not be modified in any way, such as by removing the copyright notice or references to the Internet Society or other Internet organizations, except as needed for the purpose of developing Internet standards in which case the procedures for copyrights defined in the Internet Standards process must be followed, or as required to translate it into languages other than English.

The limited permissions granted above are perpetual and will not be revoked by the Internet Society or its successors or assigns.

This document and the information contained herein is provided on an "AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.

Acknowledgement 💜

Funding for the RFC Editor function is currently provided by the Internet Society. Thank you for keeping the lights on 🌟

📦 where this page comes from

ietf: rfc3142 2001-06
💖 girlified by claude-haiku-5-5 on 2026-10-16: a language model's rewrite of the original, under its terms