Linux Networking: How to forward incoming IPv6 connections from the internet via a second IPv4 interface to other computers in a local network?

Question

I have some kind of Debian server-gateway-zombie that has two network interfaces: eth0 and wlan0 (yeah, wlan0... I know.).

eth0 is connected to a internet cable modem that assigns an IPv6 address to it. Let's assume that this is a IPv6-only assignment. (Actually it uses DS Lite, but let's ignore this for now.)

wlan0 is connected to an IPv4-based local network with a main gateway that is yet another internet cable modem. This second cable modem only gets an IPv4 address from the provider and uses NAT to forward ports to local computers.

The important part of the server-zombie's /etc/network/interfaces looks like this:

allow-hotplug eth0 iface eth0 inet static
    # Ignore the following IPv4 stuff...
    # I just added this to connect to the cable modem more conveniently
    address 192.168.0.22 
    netmask 255.255.255.0
    gateway 192.168.0.1

auto wlan0 iface wlan0 inet static
    wpa-ssid [ssid] # only required for my wlan connection
    wpa-psk [key] # only required for my wlan connection
    address 192.168.1.22
    netmask 255.255.255.0

    # The following makes sure that the main IPv4 network
    # can be reached from this computer:
    #gateway 192.168.1.1 # can't use this because only one IPv4 gateway is allowed at a time
    post-up ip route add 192.168.1.0/24 dev wlan0 src 192.168.1.22 table rt2
    post-up ip route add default via 192.168.1.1 dev wlan0 table rt2
    post-up ip rule add from 192.168.1.22/24 table rt2
    post-up ip rule add to 192.168.1.22/32 table rt2

I now want to use my server-gateway-zombie to accomplish the following: Connections coming from the IPv6 eth0 adapter on specific ports should be forwarded as IPv4 connections to computers in the wlan0 network. How can I accomplish this?

---

Here are some additional information to give you some insight into why I want to do that:

Since I have two cable modems, an IPv4-only one and an IPv6-only one (at least concerning incoming connections), I'd like to perform some kind of IP-version-dependent load balancing.

That means that whenever a client can use IPv6 to connect to my network it will reach my IPv6 cable modem which then redirects the traffic to the server-gateway-zombie which then again redirects it to the server in the IPv4 network. On the other hand whenever a client can only use IPv4 to connect to my network, the IPv4-only cable modem's NAT will kick in and redirect the traffic accordingly.

This can be accomplished by adding creating two DNS entries for my hostname: one for the IPv4 address and one for the IPv6 address.

Answer 1

In another answer I found a pretty simple solution for the other direction (IPv4 -> IPv6) that uses socat.

Based on that solution I just set up a daemon on the server-gateway-zombie for socat with the following socat arguments:

TCP6-LISTEN:80,su=nobody,fork,reuseaddr TCP4:192.168.1.23:80

This way any incoming packets on port 80 will be re-packaged and then sent to the IPv4-only HTTP server. Problem solved!

Answer 2

It is not possible to forward IPv6 connections (eg. connections coming from IPv6 addresses) to IPv4 hosts. So "Connections coming from the IPv6 eth0 adapter on specific ports should be forwarded as IPv4 connections to computers in the wlan0 network" does not make sanse. IPv6 addresses can talk only with other IPv6 hosts, and IPv4 addresses with other IPv4 hosts.

But the explanation below makes it more reasonable, if I understood you correctly: connections coming from IPv6 addresses should reach your server (over one link), and connections coming from IPv4 addresses should reach your server (over the other link).

For that to work, there are two possibilities:

1) make your server dual-stacked (having both local IPv4 and global IPv6 addresses).

For that case, just make your router have IPv4 DNAT to the servers local IPv4 address (as you did have before IPv6), and setup regular IPv6 routing from your router to your server. Hosts from internet going to server IPv6 address will come to your router on eth0 interface, and be routed to your server global IPv6 address. Hosts from internet going to your IPv4 public address will be DNATed to your server local LAN address.

2) let your server remain IPv4 only, and install protocol reverse proxies on router for each protocol you need.

For this case, hosts from internet going to your IPv4 public address will be DNATed to your server local LAN address, same as above (and same as before you had IPv6). However, hosts coming from IPv6 addresses will terminate on dual-stacked deamon running on your router (for example, on your squid in reverse proxy setup for HTTP protocol), and than the deamon will create new IPv4 connection to your server (and pass whatever it gets back to original IPv6 hosts).

Advantage to (2) is that you do not need to reconfigure your server, but disadvantage is that you need to implement reverse proxy for each and every protocol you want to reach on your server, greatly increasing complexity (and power) needed for your router.