Hi, I've got an IPv6 network that I'd like to connect to an IPv4 network with a NAT64 router. The router has two interfaces with the following configurations:
- em0: internal, IPv6 network - IPv4 address: 10.0.66.1/24 - IPv6 address: fc00::1/64 - em1: external, IPv4 network - IPv4 address: DHCP - IPv6 address: none I've enabled IP forwarding: # sysctl net.inet.ip.forwarding net.inet.ip.forwarding=1 # sysctl net.inet6.ip6.forwarding net.inet6.ip6.forwarding=1 Here's my /etc/pf.conf _before_ adding any NAT64 rules. Note that it is set up to perform NAT44 and I've verified that part works. set block-policy return set loginterface egress set skip on lo match out on egress inet from em0:network to any nat-to (egress:0) block in log pass out quick pass in inet proto icmp all icmp-type echoreq pass in on em0 I'd like to translate any requests going to fc00::ffff:0:0/96 into IPv4 requests. An example address is 173.194.33.80 (www.google.com). This gets mapped to fc00::ffff:adc2:2150. I expected the following rule to work: pass in on em0 inet6 from any to fc00::ffff:0:0/96 af-to inet from (em0) When I try to ping Google (with the address above) address from another host on the internal network I get these errors: $ ping6 fc00::ffff:adc2:2150 PING fc00::ffff:adc2:2150(fc00::ffff:adc2:2150) 56 data bytes From fc00::33 icmp_seq=1 Destination unreachable: Address unreachable I can see the packets coming in on the router itself. # tcpdump -nvvi em0 -c 10 tcpdump: listening on em0, link-type EN10MB tcpdump: WARNING: compensating for unaligned libpcap packets 21:44:21.280527 fc00::33 > ff02::1:ffc2:2150: icmp6: neighbor sol: who has fc00::ffff:adc2:2150(src lladdr: 08:00:27:71:55:eb) [icmp6 cksum ok] (len 32, hlim 255) 21:44:22.282785 fc00::33 > ff02::1:ffc2:2150: icmp6: neighbor sol: who has fc00::ffff:adc2:2150(src lladdr: 08:00:27:71:55:eb) [icmp6 cksum ok] (len 32, hlim 255) I know the router itself works with NAT44 because I can assign the host an internal IPv4 address and ping external sites. I'm trying to understand what is missing for IPv6 packets to be translated and routed by the router. Thanks. Kamil