Sysadmin

How do I login ssh to an IPv6 server from an IPv4 internet connection?

Christopher Simpson

Mar 14, 2023 • 3 min read

Goals

Not everybody has an IPv6 address (see IPv6 adoption per country):

Given a valid account (ssh), allow a user on an IPv4 connection ssh to an IPv6 server running on an IPv6 host. Let's get tunnelling!
Critical goals: To the user, they should still be able to simply ssh <username>@<hostname> because we don't want to re-invent, confuse, or add cognitive load in avoidable anyway

Code example

As part of this research the following repo was created.

With this you can:

ssh to an ipv6 server from an ipv4 address from within a web browser
Need: You need to spin up a intermediary server (e.g. VPS) which speaks both ipv4 and ipv6 (aka dual stack) for this to work, see the repo below:

Example `ssh_config` IPv4 to IPv6 server using `ProxyCommand`

Host ipv6host
  User root
  ProxyCommand ssh <ip-forwarder-hostname> 'nc -6 2a01:4f9:c010:beda::1 22' 

Host ipv6hosttwo
  User root
  ProxyCommand ssh <ip-forwarder-hostname> 'nc -6 2a01:4f9:c012:70c2::1 22'

Where <ip-forwarder-hostname> is the host or ip address of a server which speaks both IPv4 and IPv6 (aka 'is Dual-stacked) and has a route to the destination Host. Credit to https://backreference.org/2010/02/26/jump-in-with-ssh-and-netcat/index.html for help working this out as a cross-platform solution

Questions

Does a IPv4 DNS request receive AAAA responses?

Assumptions

IPv4 client resolvers will only request IPv4 A resource records (RR) whereas IPv6 clients may request both A and AAAA records. See Common Misbehavior Against DNS Queries for IPv6 Addresses