Skip to content
By using AWS re:Post, you agree to the AWS re:Post Terms of Use
AWS re:Postre:Post
About re:Post

Connecting IPv4-only Windows clients to IPv6 EC2 Windows and Linux servers

0

We are in the early stages of converting our EC2 servers from using public IPv4 to IPv6, but we have run into a problem. We currently use RDP/SSH paired with a VPN to ensure a secure server connection. But this VPN is IPv4 only, and we would prefer not to change services. Our goal is to move our servers away from IPv4 to IPv6, and the RDP issue is the only big hurdle left.

  • Dual-stack will work, but it defeats the whole purpose of the project(getting rid of IPv4).
  • I also looked into SSM, but some brief research suggests this service may have the same problem.
  • Nat64/DNS64 sounds like a solid option to overcome this issue, but it can introduce complexity, latency and security issues, so it's not a very attractive option.
  • We are open to using agents we install on our servers to establish that connection, provided it is cost-effective.

Any suggestions/recommendations would be very helpful.

Topics
ComputeNetworking & Content Delivery
Tags
Amazon VPCLinuxAmazon EC2WindowsIPv6
Language
English

asked a year ago250 views

2 Answers
2
Accepted Answer
converting our EC2 servers from using public IPv4

You are removing public IPv4 addresses from EC2 instances. Unless this is a IPv6-only subnet, EC2 instances still have private IPv4 address. You should be able to access the Windows EC2 instances using their private IPv4 address through Client VPN. Do ensure that EC2 security group and subnet route table permit access from VPN endpoint.

Since these are Windows servers, you can also connect from within AWS console using Fleet Manager Remote Desktop.

Below is a screenshot of EC2 instance with no public IPv4 address. RDP AWS

The above uses NAT64. You can also use EC2 without NAT64, i.e. private IPv4 address and NAT gateway for outbound internet IPv4 access.

You can refer to blog post Console-based access to Windows instances using AWS Systems Manager Fleet Manager for more information.

AWS
EXPERT

answered a year ago

  • BlueScreenLover
    a year ago

    You Legend!! Our goal is to lower cost by getting rid of public IP, so there isnt any real reason to get rid of private IP. i did try briefly with no success but did not check security group rules which was probably my downfall.

    The Fleet manager solution works differently then what i though too, it should be a good second solution to our problem.

    Thank you

0

To connect your IPv4-only Windows clients to IPv6-only EC2 Windows and Linux servers, you have several options:

  1. NAT64 with DNS64: This is AWS's native solution for enabling IPv6-only resources to communicate with IPv4 services. The NAT gateway supports network address translation from IPv6 to IPv4 (NAT64), which works in conjunction with DNS64. When using DNS64, Amazon Route 53 Resolver synthesizes IPv6 addresses for IPv4-only destinations by prepending the well-known /96 prefix to the IPv4 address. While you mentioned concerns about complexity, latency, and security, this is actually a well-integrated AWS solution designed specifically for your use case.

  2. Middle-box or router solution: If you need communication initiated from IPv4-only clients to IPv6-only servers (which is your case with RDP/SSH from IPv4 clients), you would need to implement a NAT46 solution. This could be done using a simple Linux instance or a third-party router from AWS Marketplace (like Cisco CSR1000v) that can translate between the two protocols.

  3. VPC Lattice: You could associate your IPv4 and IPv6 applications with VPC Lattice to enable bi-directional communication between these two address stacks. This approach supports communication in both directions between IPv4 and IPv6.

  4. Hybrid approach: Consider keeping a minimal IPv4 footprint just for management access (RDP/SSH) while moving all other services and communications to IPv6. This would be a compromise but might be the most practical solution given your constraints.

Since you're specifically looking to connect IPv4-only VPN clients to IPv6-only servers for management purposes, the middle-box NAT46 solution might be the most appropriate for your use case, as it specifically addresses the scenario where IPv4 clients need to initiate connections to IPv6 servers.
Sources
How to provide communication between ipv6-only host to ipv4-only and vice versa in a VPC | AWS re:Post
DNS64 and NAT64 - Amazon Virtual Private Cloud
Designing DNS for IPv6 - IPv6 on AWS

answered a year ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Relevant content