It took me about five minutes to create a Hurricane Electric (http://tunnelbroker.net) account and configure the Extreme as an IPv6-over-IPv4 tunnel gateway, with the Extreme configured in transparent mode, using a private DHCP address acquired from the local LAN. I just plugged in the remote tunnel IPv4 address, local tunnel IPv6 endpoint address, the IPv6 default route, and the LAN’s IPv6 subnet address. (Note: Apple swapped the order of remote and local ipv6 in the upgrade from 7.4 to 7.5 firmware.) The tunnel popped into existence instantly. I had set up Google’s open IPv6-enabled DNS server (IPv4 address 8.8.8.8) for the LAN DNS server address.

The Extreme seems to have IPv6 Router Advertisements enabled by defaul, so IPv6 stateless autoconfig cheerfully gave everyone on the LAN a Global IPv6 address from the HE.net /64 assignment, and all the LAN systems were suddenly IPv6 enabled! This is too easy!

The Extreme’s IPv6 firewall option appears when you click “Block incoming IPv6 connections” (without which the Extreme allows all inbound connections), at which point a new “IPv6 Firewall” tab appears. (Apparently this has always been there but I never clicked the “Block incoming” box and so never saw it before. )You can permit Teredo tunnels if you like, as well as inbound IPsec connections, with a couple clicks. The “firewall” interface is primitive but gets the job done, letting you allow specific TCP and UDP protocols to specific inside IPv6 addresses. The Extreme IPv6 firewall is v6-only, however, so you still need a good IPv4 firewall.

So far I’ve only tried running an Extreme as an IPv6 gateway using its LAN-transparent mode, in which the device gets a LAN IP from your local DHCP server. I did this to avoid double-NAT. However, you should be able to set up IPv6 tunneling in routed mode — where the Extreme’s WAN port faces the Internet with a provider-assigned public IPv4 address. In this arrangement, the LAN ports create an IPv6 “sandbox” — as long as your border firewall supports passing GRE protocol (IP protocol 47) outbound. But at least you don’t have to open any pinholes to the Extreme or otherwise weaken your enterprise security stance.

The one missing bit: the Extreme has no built-in DHCPv6 server, so it can’t distribute name server settings to clients after stateless autoconfig. However, as long as your LAN IPv6 clients use an IPv6-enabled DNS server at an IPv4 address (Google’s 8.8.8.8 qualifies), then you can get to the IPv6 Internet via names without problem.

At $179, this is the cheapest easy-to-configure IPv6 gateway appliance on the market!

[UPDATE on 2010/06/06: A reader tells me that the IPv6 firewall has been in the Extreme for more than a year, but few people find it because it's hidden behind that "Block all incoming IPv6 connections" checkbox. I've edited this post to reflect that. -mel]

sudo dscacheutil -flushcache

man ip6fw

for the easy-to-follow instruction guide.

1. Launch AirPort Utility.
2. Select your device from the sidebar and choose Manual Setup.
3. Select the [Internet] pane of the configuration window.
4. Select the TCP/IP tab.
5. At the “Configure IPv4″ pop-up, choose the “Manually” option.
6. Enter the statically assigned IPv4 WAN configuration parameters for your device:
+ IP Address
+ Subnet Mask
+ Router Address
+ DNS Servers
+ Domain Name [optional]
7. Select the [Advanced] pane of the configuration window.
8. Select the IPv6 tab.
9. At the “IPv6 Mode” pop-up, choose the “Tunnel” option.
10. At the “Configure IPv6″ pop-up, choose the “Manually” option.
11. Enter the statically assigned IPv6-in-IPv4 configuration parameters for your tunnel:
+ Remote IPv4 Address
+ Local IPv6 Address
+ Remote IPv6 Address
…also…
+ Enter the IPv6 address for a /64 LAN with a prefix that was assigned with your tunnel.
12. Click [Update] and wait for the AirPort/Time-Capsule to restart.

sysctl -a | grep kame_version
net.inet6.ip6.kame_version: 20010528/apple-darwin

ssh root@2001:1234::1 (example address)

but you can’t do this:

scp root@2001:1234::1:/tmp/file .

because scp parses this as hostname 2001 and file path 1234::1:/etc/motd, yielding an error such as this one:

ssh: connect to host 2001 port 22: Connection refused

The scp manpage addresses this problem for -L and -R arguments (you can use the -6 option on scp to force all addresses to be interpreted as IPv6), but it is silent about using IPv6 when copying files.

The trick is to use square brackets to delimit the IPv6 address, which on the Mac also requires escaping the brackets, thusly:

scp root@\[2001:1234::1\]:/tmp/file .

IPv6 Intelligence

http://ipv6int.net/systems/mac_os_x-ipv6.html

Derek Morr’s Living with IPv6 blog

http://www.personal.psu.edu/dvm105/blogs/ipv6/

SIXXS

http://www.sixxs.net/wiki/SixXS_Wiki

ARIN IPv6 Wiki

http://whois.arin.net/index.php/Main_Page

Fortunately IPv6 has a slick feature, called Privacy Addressing, that fixes this. Your computer generates random host address parts, changing them periodically. Old random addresses hand around as long as you have a session open using them, but new sessions use the latest randomly-generated IPv6 address. The feature takes care to check for collisions, automatically forcing a retry should one occur (two in a row is statistically very unlikely).

You turn the feature on using the sysctl command:

$ sudo sysctl -w net.inet6.ip6.use_tempaddr=1

I haven’t quite figured out what the timer is on this. It seems to be an hour or so between IP address changes. I’ll play around with it, or go read the Darwin code to see what’s going on under the covers. For machines that don’t have to be servers, however, this looks like a very handy feature!