Acting As A 6In4 Tunnel Server - D-Link NetDefendOS User Manual

the IPv6 hosts and this can provide the preferred MTU value. This method provides the
fastest response by the hosts since they do not have to resend after receiving ICMP error
messages because of an unsuitable MTU size.
These options can be used together so that the router advertisement provides the initial MTU
and if that is not acceptable, preferred MTU values are sent to the hosts via ICMP error messages.
NetDefendOS Acting as Tunnel Server
It has been assumed so far that NetDefendOS is acting as the client for an external tunnel server.
However, the NetDefend Firewall itself can be a tunnel server. A typical usage of this is where
clients at the branch offices of a company require IPv6 access. This is illustrated in the diagram
below:
The 6in4 tunnel encapsulator in the above diagram can be any piece of network equipment
capable of 6in4 tunneling for the remote network traffic. This could be a router, a server with
appropriate software, or a NetDefend Firewall set up as described previously.
To set up NetDefendOS to provide this tunnel server function, the following configuration
components are required:
• A 6in4 Tunnel object for each tunnel that will connect carrying the IPv6 traffic of remote hosts.
• An all-net6 route for an interface that is connected to an ISP gateway that supports IPv6.
Incoming IPv6 traffic from a tunnel can then be routed out onto the public Internet via the
interface in the route. This interface will usually be the Ethernet interface connected to an ISP
but may be another type of interface.
• At least one IP rule or IP policy that allows traffic coming from the tunnel to exit using the
all-net6 route. This must use a Service object that has its Pass returned ICMP errors
messages from destination property enabled so that MTU sizes can be adjusted when
required.
IP rules or IP policies controlling IPv6 traffic can use the NetDefendOS Application Control
feature to allow or deny specific types of IPv6 traffic. This is discussed further in Section 3.7,
"Application Control".
Figure 3.7. Acting as a 6in4 Tunnel Server
212
Chapter 3: Fundamentals