Chapter 14

Teredo

At the end of this chapter, you should be able to do the following:

■Define the address format, encapsulation, and intended use of the Teredo IPv6 transition technology.

■Describe how the IPv6 protocol in Windows Server 2008 and Windows Vista supports Teredo as a Teredo client and a Teredo host-specific relay.

■List and describe the routes on Teredo clients, Teredo servers, Teredo relays, and IPv6 routers on the IPv6 Internet that make Teredo-based communication possible.

■Describe how Teredo clients perform automatic address configuration.

■Describe how Teredo clients on the same link, Teredo clients in different sites, Teredo host-specific relays, and IPv6 hosts on the IPv6 Internet initiate communication with each other.

Introduction to Teredo

Teredo is an address assignment and automatic tunneling technology defined in RFC 4380 that provides unicast IPv6 connectivity across the IPv4 Internet. 6to4 is an automatic tunneling technology described in Chapter 13, “6to4,” that also provides unicast IPv6 connectivity across the IPv4 Internet. However, 6to4 works well when a 6to4 router exists at the edge of the site. The 6to4 router uses a public IPv4 address to construct the 6to4 prefix and acts as an IPv6 advertising and forwarding router. The 6to4 router encapsulates and decapsulates IPv6 traffic sent to and from site hosts.

6to4 relies on the configuration of a public IPv4 address and the implementation of 6to4 routing functionality in the edge device. Many small office/home office (SOHO) configurations use an IPv4 Network Address Translator (NAT) for Internet connectivity. For more information about how a NAT works, see Chapter 1, “Introduction to IPv6.” In most NAT configurations, the device providing NAT functionality is not capable of acting as a 6to4 router. Even if 6to4 was universally supported in Internet edge devices, there are some Internet connectivity configurations that contain multiple levels of NATs. A 6to4-capable edge device cannot use 6to4 if it is not assigned a public IPv4 address.

Teredo addresses the issues related to the lack of 6to4 functionality in modern-day Internet edge devices and multilayered NAT configurations by tunneling IPv6 packets between hosts. In contrast, 6to4 tunnels IPv6 packets between the edge devices. Tunneling from the hosts presents another issue for NATs: IPv6 packets that are encapsulated with IPv4 have the Protocol field in the IPv4 header set to 41. Most NATs translate only Transmission Control

317

■Windows Server 2003 with Service Pack 1

■Windows XP with Service Pack 1 (SP1) with the Advanced Networking Pack for Windows XP

All implementations of Teredo in Windows are based on RFC 4380.

In Windows Server 2008 and Windows Vista, the Teredo component might be enabled or disabled depending on the computer’s configuration. When enabled, the Teredo component can be in the dormant or qualified states. For more information, see “The Teredo Client and Host-Specific Relay in Windows” later in this chapter.

In Windows Server 2008 or Windows Vista, any IPv6-capable application can use Teredo for incoming traffic by adding an inbound rule to the Windows Firewall for the application’s traffic with edge traversal enabled. You can manually enable edge traversal with the Windows Firewall with Advanced Security snap-in, on the Advanced tab for the properties of an inbound rule. In Windows Server 2008 or Windows Vista, any IPv6-capable application can use Teredo for outgoing traffic if the outgoing traffic uses the Teredo tunneling interface as its next-hop interface.

Teredo and Protection from Unsolicited Incoming IPv6 Traffic

IPv6 traffic that is tunneled with Teredo is not subject to the IPv4 packet-filtering function of typical NATs. Although this might sound like Teredo is bypassing the NAT and allowing potentially malicious IPv6 traffic on private networks, consider the following:

■Teredo does not change the behavior of NATs. Teredo clients create dynamic NAT translation table entries for their own Teredo traffic. The NAT forwards incoming Teredo traffic to the host that created the matching NAT translation table entry. The NAT will not forward Teredo traffic to computers on the private network that are not Teredo clients.

■Teredo clients that use a host-based, stateful firewall that supports IPv6 traffic, such as Windows Firewall, are protected from unsolicited, unwanted, incoming IPv6 traffic. Windows Firewall is enabled by default for Windows XP with SP2, Windows Vista, and Windows Server 2008.

The combination of IPv6, Teredo, and a host-based, stateful, IPv6 firewall does not affect the packet-filtering function of the NAT for IPv4-based traffic and does not make your Windowsbased computer more susceptible to attacks by malicious users and programs that use IPv6 traffic rather than IPv4 traffic.

Network Address Translators (NATs)

As described in Chapter 1, a NAT is an IPv4 router defined in RFC 1631 that can translate the IPv4 addresses and TCP/UDP port numbers of packets as they are forwarded. A NAT can map private addresses to a single or to multiple public IPv4 addresses.