NAT64

NAT64 is a network translation mechanism that enables IPv6-only hosts to reach IPv4 resources by translating IPv6 packets to IPv4 packets and back at a translation gateway located at the border between IPv6 and IPv4 networks. It is commonly deployed together with DNS64, a DNS server that helps IPv6 clients discover IPv4 hosts by synthesizing IPv6 addresses from IPv4 addresses in response to AAAA queries.

In operation, when an IPv6 client requests a resource on an IPv4-only server, the DNS64 server provides a synthetic IPv6 address that encodes the IPv4 address in the lower 32 bits, using a well-known IPv6 prefix such as 64:ff9b::/96. The NAT64 gateway then translates the IPv6 header and creates a dynamic mapping between the IPv6 address and the IPv4 address. The gateway forwards the traffic to the IPv4 network and performs the reverse translation for responses, maintaining port mappings to support multiple concurrent connections.

NAT64 deployments require a translator and a DNS64 service and are used to enable IPv6-only networks to access legacy IPv4 content without dual-stack hosts. They do not provide end-to-end IPv6 connectivity to IPv4 hosts; rather, they act as a bridge between the two protocols, often alongside other transition mechanisms.

Limitations include potential issues with protocols that embed IP addresses in payloads or rely on end-to-end IP semantics, difficulties with some UDP-based services, and dependencies on the availability of DNS64 and the NAT64 translator. Security considerations involve controlling access at the gateway, logging mappings for accountability, and ensuring translation does not bypass existing protections.