Configuring IPv6 NAT and OpenForwarding Mode in libvirt

Configuring IPv6 NAT with libvirt and Open vSwitch

In this article, we will discuss how to configure IPv6 NAT using libvirt and Open vSwitch. This setup is useful when you want to provide IPv6 connectivity to virtual machines (VMs) running on a host with a public IPv6 address.

Prerequisites

• A host system with a public IPv6 address
• libvirt and Open vSwitch installed on the host
• Basic knowledge of IPv6 and libvirt

Configuring libvirt

To configure IPv6 NAT with libvirt, you need to create a new network with the ipv6=yes attribute. This will enable IPv6 support for the network.

<network>
  <name>ipv6-nat</name>
  <forward mode="nat"/>
  <bridge name="ovsbr0"/>
  <ip family="ipv6" address="2001:db8:1::1/64"/>
  <ip family="ipv6" addr="2001:db8:1::2" prefix="64"/>
</network>

In the above example, we have created a new network called ipv6-nat with a bridge named ovsbr0. We have also specified the IPv6 address and prefix for the network and a VM. The forward mode="nat" attribute enables NAT for IPv6.

Configuring Open vSwitch

After creating the network in libvirt, you need to configure Open vSwitch to enable IPv6 forwarding and NAT. This can be done by adding the following rules to the Open vSwitch configuration file:

# Enable IPv6 forwarding
sysctl -w net.ipv6.conf.all.forwarding=1

# Add IPv6 address to the bridge
ip addr add 2001:db8:1::1/64 dev ovsbr0

# Enable IPv6 forwarding on the bridge
ovs-ofctl add-flow ovsbr0 "table=0, priority=1, ip, nw_src=2001:db8:1::2/64, actions=forward(portal 1)"
ovs-ofctl add-flow ovsbr0 "table=0, priority=1, ip6, nw_src=2001:db8:1::2/64, actions=forward(portal 1)"

# Enable NAT for IPv6
ip6tables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
ip6tables -A FORWARD -i eth0 -o ovsbr0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
ip6tables -A FORWARD -i ovsbr0 -o eth0 -j ACCEPT

In the above example, we have enabled IPv6 forwarding and added the IPv6 address to the bridge. We have also added flows to the Open vSwitch bridge to enable forwarding and NAT for IPv6 packets. Finally, we have added IP6tables rules to enable NAT for IPv6 packets.

Testing the Configuration

To test the configuration, you can start a VM with the following command:

virsh start --network ipv6-nat myvm

Once the VM is running, you can check the IPv6 address of the VM using the following command:

virsh domifaddr myvm | grep inet6

You should see an IPv6 address assigned to the VM. You can also test the connectivity by pinging the VM from the host or another system on the IPv6 network.

References

• libvirt network format
• Open vSwitch ofctl
• libvirt IPv6 support

In this article, we have discussed how to configure IPv6 NAT with libvirt and Open vSwitch. We have covered the steps to create a new network in libvirt with IPv6 support, configure Open vSwitch to enable IPv6 forwarding and NAT, and test the configuration. This setup is useful when you want to provide IPv6 connectivity to virtual machines running on a host with a public IPv6 address.