Whats changed with the NAT64 feature

[motters]

Hi,

I've setup a few board routers in the past which have been working fine. However I'm trying to setup some new BRs with 'main' branch.

It seems like the way the IPv6->IPv4 NAT feature is implemented has changed.

Differences

Interface

When i setup the new border router on a RPI, i no longer get the NAT64 interface, like i use to

Required Commands

I've also noticed a new command ot-ctl nat64. As such I've modified our startup script to include ot-ctl nat64 enable

This command then adds a route onto the network, as can be seen by netdata show.

Can this IP address be fixed to a known address, as it changes on every boot cycle?

Global Prefix

In the past we registered a global prefix sudo ot-ctl prefix add 2001:dead:beef:cafe::/64 paros in our startup script.

Hence to access an external IPv4 address we'd simple use 64:ff9b::808:808 for 8.8.8.8 for example. However this no longer works.

Summary

What do we need to do in order to have a functional NAT again? Is there a summary of what has changed?

Thanks in advance!

[wgtdkp]

You may find this codelab helpful https://openthread.io/codelabs/openthread-border-router-nat64

[motters]

Hi,

I followed the codelab to setup the new BRs. I should say that the NAT64 is working when using ot ping command on Zephyr.

The problem is that our firmware can no longer use a generic IPV6 prefix to access external addresses as it changes on boot.

Can this prefix be fixed?

Cheers.

[wgtdkp]

The nat64 prefix is derived from the ULA prefix which is saved in persistent storage, so it should survive reboots (changes only when the BR is factory reset).

[motters]

Interesting I'll have to test it again, so would it change if you ran sudo ot-ctl factoryreset?

[wgtdkp]

Yes, if sudo ot-ctl factoryreset is executed on the BR.

[motters]

Apologies late i've been away.

That sounds like the reason the address is changing then, as we run this at the start of our script.

I suppose my final question is:
What OT commands do we run on end devices to find the current NAT64 prefix of the BR?

Cheers.

[jwhui]

Thread encodes NAT64 prefixes in the Thread Network Data as External Routes with the NAT64 flag set.

You can find an example here:

openthread/src/cli/cli_network_data.cpp

Line 123 in e609eef

if (aConfig.mNat64)

[motters]

Thanks @wgtdkp & @jwhui .

I've wrote a small function to find the first nat64 prefix on the network, or else fall back to the default 64:ff9b:: . As older versions of BR don't add this nat64 route + flag (from memory, i could be wrong?).

I think a few people may be in my position in the future, so I've posted the function below. Disclaimer, it's completely untested at the moment and wrote for Zephyr 3.

        /**
	 * Find the first NAT64 prefix on the network and save it to settings
	 *
	 * Example results:
	 * 		- fdea:5eab:2b32:2:0:0:
	 * 		- fdea:5eab:0b11::
	 */
	void openthread_controller::find_nat64_prefix()
	{
		otNetworkDataIterator iterator = OT_NETWORK_DATA_ITERATOR_INIT;
		otExternalRouteConfig config;

		// Lock openthread api
		openthread_api_mutex_lock(openthread_get_default_context());

		// Get the default instant as we only use one
		otInstance* ot_instance = openthread_get_default_context()->instance;

		// Loop through all routes to find a nat64 prefix
		bool found_nat = false;
		while (otNetDataGetNextRoute(ot_instance, &iterator, &config) == OT_ERROR_NONE)
		{
			// If the current route is a nat64 prefix
			if(config.mNat64)
			{
				// Mark that a nat prefix was found
				found_nat = true;

				// Get the prefix into a string form
				char string[OT_IP6_PREFIX_STRING_SIZE];
				otIp6PrefixToString(&config.mPrefix, string, sizeof(string));
				auto prefix = std::string(string);

				// Remove the prefix length (/32, /64, /96 etc) if present
				if(prefix.find('/') != std::string::npos)
                                {
					prefix.erase(prefix.size() - 3);
				}

				// Remove the last `0:0` if `::` is not found as we are creating a prefix
				if(prefix.find("::") == std::string::npos)
                                {
					prefix.erase(prefix.size() - 3);
				}

				// Save the prefix in settings and break (@todo save multiple nat64 prefixes)
				settings::device::set_nat64_prefix(prefix);
				break;
			}
		}

		// If a nat was not found we'll assume the default prefix of 64:ff9b::
		if(!found_nat)
                {
			settings::device::set_nat64_prefix("64:ff9b::");
		}

		// Unlock thread api
		openthread_api_mutex_unlock(openthread_get_default_context());
	}

[erjiaqing]

If you want to synthesize an IPv6 mapped IPv4 address, you can just call otNat64SynthesizeIp6Address.

The following code is a example from otcli:

openthread/src/cli/cli.cpp

Lines 472 to 477 in 48c0582

	// It might be an IPv4 address, let's have a try.
	otIp4Address ip4Address;
	// Do not touch the error value if we failed to parse it as an IPv4 address.
	SuccessOrExit(aArg.ParseAsIp4Address(ip4Address));
	SuccessOrExit(error = otNat64SynthesizeIp6Address(aInstance, &ip4Address, &aAddress));

It will synthesize an IPv6 address from the given IPv4 address and the preferred prefix for NAT64 from the network data, or return error when there are no NAT64 services available in the thread network.

You may notice that this function is added a few monthes before, so you may need a more recent checkout of OpenThread if you don't find this API.

[motters]

Oh very nice, thank you. This was the function i was looking for.