Hi all, IPSec tunnel is transparent to IP payload in general, so it is perfectly ok to run IPv4 over IPv6 tunnel. The key issue is how get the traffic into the tunnel as you cannot set IPv6 next-hop to IPv4 route. I’m not familiar how to do this in Linux OS but in general if you can set the next-hop to virtual tunnel-interface then you are one step further. Jome ----------------- Jorma Mellin Trustee SIY ry / ISOC Finland Chapter ENISA PSG member jorma@jmellin.net
On 06 Nov 2018, at 16:49, Gert Doering <gert@space.net> wrote:
Hi,
On Mon, Nov 05, 2018 at 08:18:31PM +0100, Gert Doering wrote:
On Mon, Nov 05, 2018 at 11:39:54AM +0100, Michael Hock wrote:
I'm trying to set up an ipsec server on a linux machine. The connection between clients and server should be IPv6 only but also needs to transport IPv4 packets. However, the linux kernel doesn't seem to support a feature which is required to transport IPv4 packets within an IPv6 ipsec connection, as shown here: https://wiki.strongswan.org/issues/939
Does maybe one of you know how to transport IPv4 packets in an IPv6 ipsec connection, or do we need to wait for the linux kernel to support this feature? Because this stops me from switching to IPv6 ipsec connections and I would like to reduce the usage of IPv4 as much as possible ...
Without wanting to understand whether Linux can actually *do* this, what you generally do is "put an intermediate tunnel header here".
It has been pointed out to me that I read your post upside-down - not "IPv6 over IPv4 IPSEC" was the goal, but "IPv4 (+IPv6) over IPv6 IPSEC".
But the net recommendation is the same - build an outer IPSEC connection over IPv6, set up a tunnel interface to use that, route IPv4 through this second tunnel.
(And, of course, OpenVPN could do IPv4-over-IPv6 over 10+ years ago ;-))
Gert Doering -- NetMaster -- have you enabled IPv6 on something today...?
SpaceNet AG Vorstand: Sebastian v. Bomhard, Michael Emmer Joseph-Dollinger-Bogen 14 Aufsichtsratsvors.: A. Grundner-Culemann D-80807 Muenchen HRB: 136055 (AG Muenchen) Tel: +49 (0)89/32356-444 USt-IdNr.: DE813185279