Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    How to Setup NAT64 using pfsense with Jool

    Scheduled Pinned Locked Moved IPv6
    1 Posts 1 Posters 2.2k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • IsaacFLI
      IsaacFL
      last edited by

      Maybe we will get NAT64 with 2.5 but if you want to try NAT64/DNS64 out, this is what worked for me. I have a little step by step, so I don't get messed up.

      The process involves setting up a NAT64 gateway on a separate Linux box. I always use Debian, only because I am most familiar with it. I also use a VM (I use Hyper-V, since I understand its ipv6), but it should work on dedicated hardware too. It does not have to be a dedicated subnet or anything as long as the linux device is in a dual stack subnet.

      First, install a debian (currently, 10.6) machine with SSH and standard only. You need to give it a static ip in pfsense DHCP. I used 10.23.20.64 for my case and called it nat64.mydomain.com with a user isaacfl.

      Everything is now via SSH into the nat64.mydomain.com

      After it boots, you have to add sudo, because it isn't there by default:

      su
      cd ~
      
      apt install sudo
      /sbin/adduser isaacfl sudo
      systemctl reboot
      sudo echo 'Hello, world!'
      
      

      Now you install Jool (https://www.jool.mx/en/index.html)

      I find that sometimes the "latest" version is kind of still "in work"

      On the downloads page I just copy the links. I have had best results so far using the Standalone 4.0.x package.

      sudo apt install linux-headers-$(uname -r)
      sudo wget https://github.com/NICMx/Jool/releases/download/v4.0.9/jool-dkms_4.0.9-1_all.deb
      sudo wget https://github.com/NICMx/Jool/releases/download/v4.0.9/jool-tools_4.0.9-1_amd64.deb
      sudo apt install ./jool-dkms_4.0.9-1_all.deb ./jool-tools_4.0.9-1_amd64.deb
      
      

      Jool is installed at this point, so now you need to create a configuration file. Note, my debian machine is at 10.23.20.64, so if you use a different one based on your network.

      Create the file:

      sudo mkdir /etc/jool
      sudo nano /etc/jool/jool.conf
      

      You should be in nano with an empty file. Copy and Paste the following:

      
      {
              "comment": "Configuration for the systemd NAT64 Jool service.",
      
              "instance": "init",
              "framework": "netfilter",
      
              "global": {
                      "comment": "Pool6 prefix",
                      "pool6": "64:ff9b::/96"
              },
      
              "comment": "Pool4 table",
              "pool4": [
                      {
                              "protocol": "TCP",
                              "prefix": "10.23.20.64",
                              "port range": "61001-65535"
                      }, {
                              "protocol": "UDP",
                              "prefix": "10.23.20.64",
                              "port range": "61001-65535"
                      }, {
                              "protocol": "ICMP",
                              "prefix": "10.23.20.64",
                              "port range": "61001-65535"
                      }
               ]
      }
      
      

      ^X Save File

      sudo systemctl enable jool	### Not sure if it is still needed anymore
      

      Get the Link Local of the debian (ip a)
      fe80::215:5dff:fe7e:5807 # in my case

      Now we move over to pfsense

      System/Routing/Gateways/ New
      Interface: where Debian/NAT 64 lives
      Name: NAT64_GW
      Gateway: fe80::215:5dff:fe7e:5807
      Monitor IP: 64:ff9b::75.85.208.1 * Use your ipv4 Gateway monitor + 64:ff9b::
      Description: NAT 64 Gateway
      Save/Apply Changes

      Static Route
      Destination network: 64:ff9b:: /96
      Gateway: NAT64_GW
      Description: NAT 64 Gateway

      Save/Apply Changes

      At this point you should be able to ping from a desktop
      ping 64:ff9b::8.8.8.8

      add following to dns resolver custom options:

      server:
      module-config: "dns64 validator iterator"
      dns64-prefix: 64:ff9b::/96
      

      That should be it. There is probably stuff I have left out, since I have done it so often.

      Jool Commands for reference (in the Debian machine).

      (verify version)
      sudo apt show jool-dkms
      sudo apt show jool-tools
      
      sudo systemctl stop jool
      sudo systemctl start jool
      
      
      
      sudo jool instance display
      sudo jool -i "init" global display
      sudo jool -i "init" stats display
      sudo jool -i "init" pool4 display -t
      sudo jool -i "init" pool4 display -u
      sudo jool -i "init" pool4 display -i
      
      
      1 Reply Last reply Reply Quote 0
      • First post
        Last post
      Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.