KDB Systems

IPv6 is com­ing. We’ll all have to learn how to deal with it. With this in mind I’ve set out to edu­cate myself about IPv6. I learn bet­ter by doing than by read­ing. I like to read enough that I have a very basic under­stand­ing of the sub­ject then play. After play­ing with it I gen­er­ally find I need to do some more read­ing or pos­si­bly even take some courses. With IPv6 I’m at the play­ing stage. I decided to setup a Server 2008 R2 vir­tual machine as a test bed for IPv6. I needed a sec­ond domain con­troller on my SBS 2003 net­work so I made it a DC and a DNS server. It’s prob­a­bly not the best idea to use a DC for an IPv6 exper­i­ment but I fig­ured I may as well go whole hog and learn by mak­ing mistakes.

The rea­son for the DNS server is so once I fig­ure out IPv6 it can answer IPv6 queries from the work­sta­tions. Plus it’s a DC which implies a DNS server. This is the first place I ran into a prob­lem. There is a bug in the 2008 R2 DNS server imple­men­ta­tion. It wasn’t resolv­ing some queries. NSlookup microsoft.com worked but nslookup www.microsoft.com didn’t. It was very per­plex­ing and took a lot of Bing-foo and Google-foo to fix. The fix is here in Scott Forsyth’s Blog. It appears it’s a com­bi­na­tion of some DNS servers not return­ing EDNS results prop­erly and the way Server 2008 R2 DNS deals with that.

The server was now setup as a DC and a DNS server. To play with IPv6 I needed to set up a tun­nel. My ISP doesn’t sup­port IPv6 and nei­ther does my router. I decided to acti­vate a free IPv6 tun­nel at tunnelbroker.net. This was rel­a­tively straight for­ward. I was hap­pily test­ing IPv6 over the tun­nel think­ing that was too easy. I was right, it was too easy. I decided to run a port scan of the IPv6 tun­nel. Imag­ine my sur­prise to find out that as far as the Win­dows fire­wall was con­cerned the tun­nel was part of the local net­work. I had just put a DC on the Inter­net with no fire­wall. Not good to say the least. I quickly dis­abled the tun­nel. I spent the next sev­eral hours Googling and Bing­ing to no avail. So far I haven’t found any way to block incom­ing ports on the IP6Tunnel inter­face while leav­ing ports open for the local net­work. I’m stuck for now. I need to use the Win­dows fire­wall because the tun­nel by def­i­n­i­tion bypasses the fire­wall in my router. I’m sure there’s a way but until I find it no IPv6 for me. Once I get past this set­back I’ll con­tinue this blog series.

Update

It looks like the only way to do this is to add a sec­ond NIC for the IPv6 tun­nel. I should be able to set the fire­wall pro­file for the sec­ond NIC to Pub­lic which would solve the prob­lem. I don’t want the headaches caused by a multi-homed domain con­troller. I’d prob­a­bly need to setup a VLAN as well, which my router doesn’t sup­port. The project is tem­porar­ily on hold while I rethink things.