IPv6: How 6to4 works, a visual guide

I used my gimpy drawing skills to make a diagram describing how 6to4 works. This is what that 2002:[something] address you may have noticed on your Windows Vista/7 machine. Those of you at WWU probably all have this because we're on publicly routeable IP addresses. 6to4 uses AnyCast to accomplish what it does. It can be tricky to wrap your head around since it is also a stateless protocol. Anyway, here is a picture worth a couple hundred words:


For those that don't load images, here is the traffic path between a client at 140.160.123.45 talking over 6to4 to ipv6.google.com:

1. Client starts a TCP session with the 6to4 AnyCast address 192.88.99.1, with an encapsulated IPv6 packet destined for 2001:4860:8005::6a.
2. The nearest 6to4 AnyCast router strips off the IPv4 wrapper and forwards the formerly encapsulated packet to 2001:4860:8005::6a
3. The server at 2001:4860:8005::6a sees an incoming connection from 2002:8ca0:7b2d::8ca0:7b2d, replies with ACK packet.
4. As the ACK packet has 2002 prefix, it is forwarded to the 6to4 router nearest to the source which encapsulates the packet within an IPv4 packet, with a Source address of 192.88.99.1 and sends it on to 140.160.123.45
5. Client receives ACK packet from 192.88.99.1, sends SYN ACK to 192.88.99.1

As you can see, a firewall between the source and the first 6to4 AnyCast router only sees a regular IPv4 session. At the same time, a firewall sitting in front of ipv6.google.com only sees a pure IPv6 session. Unfortunately for the IPv4 firewall, unless it is smart enough to decode the 6to4 session it has no idea where that packet is ultimately going and therefore can't apply firewall rules to it. The IPv6 firewall has no such limitation.