Connecting Legacy IPv4 Services to Pure IPv6 Clients with NAT64 & DNS64

“DNS64 synthesizes synthetic IPv6 AAA A records out of thin air to bridge legacy IPv4 backends with pure IPv6 mobile clients.”

The Setup

In January 2014 at Net4 India, we expanded IPv6 connectivity for enterprise clients hosting mobile backend API services. Mobile carriers were aggressively deploying IPv6-only cellular networks to combat IPv4 address scarcity.

However, many enterprise clients ran legacy IPv4-only database and payment processing backends that could not be modified.

The Mess

Mobile clients connecting over pure IPv6 subnets failed to connect to IPv4-only backend API servers:

[CLIENT API ERROR LOG] 2014-01-14 10:12:00 - iOS Mobile Client
Target Host: api.clientbank.com (IPv4-Only: 202.54.12.80)
DNS Query: TYPE AAAA for api.clientbank.com -> Response: NODATA (0 AAA Records)
Socket Error: Address family not supported by protocol (AF_INET6 -> No IPv6 Route)
Connection Status: Aborted (100% Failure Rate for IPv6-Only Mobile Subscribers)

Because the domain returned zero IPv6 AAAA records, IPv6-only mobile devices aborted socket establishment without falling back to IPv4.

The Solution

I deployed an enterprise NAT64 / DNS64 gateway architecture using BIND9 DNS64 synthesis and Linux Tayga stateful NAT64 translation:

1. DNS64 Prefix Synthesis: Configured DNS64 on our recursive DNS servers to intercept IPv4 A records and synthesize IPv6 AAA A records using the well-known prefix 64:ff9b::/96.
2. Stateful NAT64 Gateway: Deployed Tayga NAT64 instances mapping the synthesized 64:ff9b::/96 IPv6 traffic to an outbound IPv4 NAT pool.

# BIND9 /etc/bind/named.conf.options - DNS64 Configuration
options {
    directory "/var/cache/bind";
    dns64 64:ff9b::/96 {
        clients { any; };
        mapped { any; };
        exclude { 127.0.0.0/8; 10.0.0.0/8; };
    };
};

# /etc/tayga.conf - Stateful NAT64 Gateway Configuration
tun-device nat64
ipv4-addr 192.168.255.1
ipv6-addr 2001:db8:1::1
prefix 64:ff9b::/96
dynamic-pool 192.168.255.0/24

# Verify Tayga Translation Status
tayga --debug
# Output: TAYGA 0.9.2: Subnet 64:ff9b::202.54.12.80 mapped to 192.168.255.12 (ACTIVE)

The Results

The stateful NAT64/DNS64 gateway seamlessly bridged legacy IPv4 backends with modern IPv6 clients:

• IPv6 Mobile Reachability: 100% of IPv6-only mobile clients connected without backend modifications.
• DNS Synthesis Latency: Sub-millisecond (0.4ms) DNS64 record generation.
• Backend Application Changes: ZERO lines of application code modified.

Key Takeaway

Deploying NAT64 paired with DNS64 allows pure IPv6 clients to seamlessly query and connect to legacy IPv4-only backends without modifying application source code.

Architecture and decisions: mine. Debugging sessions at odd hours: mine. AI assistance: structure, syntax, first draft. — Sachin