Getting Netflix to work with IPv6

Haven't update the blog for a while as I was busy at work, study and personal live.  During Christmas I want to watch a movie, and I've subscribed Netflix as a result.  I assume what I need to do is simply go to the Netflix website and choose the movie that I want, and watch it.  However, life is not as simple as you think.  I am keep on getting error saying that I have some kind of network connection / proxy issue to prevent me from watching the movie.

After some digging, seems Netflix doesn't like IPv6, especially the setup in my home, where I have my v6 connectivity tunnel through Hurricane Electric.  To verify what IPv6 address Netflix is using:

$ dig -t AAAA cbp-us.nccp.netflix.com

; <<>> DiG 9.8.3-P1 <<>> -t AAAA cbp-us.nccp.netflix.com

;; global options: +cmd

;; Got answer:

;; ->>HEADER<<- 64879="" id:="" noerror="" opcode:="" query="" span="" status:="">

;; flags: qr rd ra; QUERY: 1, ANSWER: 10, AUTHORITY: 4, ADDITIONAL: 2

;; QUESTION SECTION:

;cbp-us.nccp.netflix.com. IN AAAA

;; ANSWER SECTION:

cbp-us.nccp.netflix.com. 0 IN CNAME cbp-us.nccp.geo.netflix.com.

cbp-us.nccp.geo.netflix.com. 0 IN CNAME cbp-us.nccp.us-west-2.prodaa.netflix.com.

cbp-us.nccp.us-west-2.prodaa.netflix.com. 60 IN AAAA 2620:108:700f::36ba:c314

cbp-us.nccp.us-west-2.prodaa.netflix.com. 60 IN AAAA 2620:108:700f::3270:4b38

cbp-us.nccp.us-west-2.prodaa.netflix.com. 60 IN AAAA 2620:108:700f::340a:2bb5

cbp-us.nccp.us-west-2.prodaa.netflix.com. 60 IN AAAA 2620:108:700f::3695:797a

cbp-us.nccp.us-west-2.prodaa.netflix.com. 60 IN AAAA 2620:108:700f::3645:db3d

cbp-us.nccp.us-west-2.prodaa.netflix.com. 60 IN AAAA 2620:108:700f::3420:816

cbp-us.nccp.us-west-2.prodaa.netflix.com. 60 IN AAAA 2620:108:700f::3459:e8e6

cbp-us.nccp.us-west-2.prodaa.netflix.com. 60 IN AAAA 2620:108:700f::36bb:40b9

;; AUTHORITY SECTION:

prodaa.netflix.com. 68907 IN NS ns-1606.awsdns-08.co.uk.

prodaa.netflix.com. 68907 IN NS ns-1489.awsdns-58.org.

prodaa.netflix.com. 68907 IN NS ns-375.awsdns-46.com.

prodaa.netflix.com. 68907 IN NS ns-749.awsdns-29.net.

;; ADDITIONAL SECTION:

ns-375.awsdns-46.com. 68861 IN A 205.251.193.119

ns-749.awsdns-29.net. 68861 IN A 205.251.194.237

;; Query time: 63 msec

;; SERVER: 218.252.0.24#53(218.252.0.24)

;; WHEN: Sun Dec 25 22:13:54 2016

;; MSG SIZE  rcvd: 507

This is the ACL I've implemented in my 1941 router to filter out the IPv6 address block of Netflix.  With this workaround I am now able to watch some movies during the festive season!

sh access-list block-netflix

IPv6 access list block-netflix

    deny ipv6 any 2620:108:700F::/48 (412 matches) sequence 20

    permit ipv6 any any (1804317 matches) sequence 30

interface GigabitEthernet0/1

 ! My LAN side interface

 ipv6 traffic-filter block-netflix in

end

IPv6 PTR Record configuration in BIND

My environment: RedHat Fedora Core 12 x86_64

BIND version: bind-9.6.1-11.P1.fc12.x86_64

Let’s see an example how to configure IPv6 reverse lookup record in BIND.

Forward Lookup:

www   AAAA   2001:123:45:678:20c:29ff:fe6a:7f93

It just like normal IPv4 host record, except it is a “AAAA” record instead of an “A” record.

Reverse Lookup zone configuration in named.conf:

zone "8.7.6.0.5.4.0.0.3.2.1.0.1.0.0.2.ip6.arpa" {
        type master;
        file "2001.123.45.678-db";
};

The name of the zone is the reverse of the /64 prefix 2001:123:45:678::/64

In the reverse lookup zone file, the PTR record is:

3.9.f.7.a.6.e.f.f.f.9.2.c.0.2.0   IN   PTR   www

The PTR record is the reverse of the host portion of the IPv6 address.

Try a dig -x 2001:123:45:678:20c:29ff:fe6a:7f93 and see if the BIND server replies with the reverse lookup record correctly.

IPv6 Tunnel Broker Setup on IOS router

My environment: Cisco 2801 router

IOS version: 12.4(24)T1 Advanced Enterprise

I have registered an account on Hurricane Electric, it is free and you will get an tunnel IPv6 address and a routed /64 block IPv6 address. Follow the below steps to get your tunnel working:

1. Enable IPv6 unicast routing

 ipv6 unicast routing

2. Configure your tunnel to HE

interface Tunnel0
description IPv6 tunnel to HE Tunnel Broker
no ip address
ipv6 address <Your Tunnel IPv6 Address>
ipv6 enable
tunnel source <Your Internet facing interface>
tunnel destination <HE tunnel destination IPv4 address>
tunnel mode ipv6ip

3. Configure your LAN-facing interface

interface FastEthernet0/0
ip address <LAN IP address>
ipv6 address <The routed /64 address provided by HE>
ipv6 enable
ipv6 nd prefix <The prefix of the routed /64 address>

4. Create a IPv6 default route

ipv6 route ::/0 Tunnel0

5. If you doesn’t have a fixed Internet IP address, you can use the DDNS service to update the tunnel IP address

ip ddns update method v6tunnelbroker
HTTP
  add &pass=this_is_your_password_md5&user_id=this_is_your_userid_md5&tunnel_id=your_tunnel_id">https://ipv4.tunnelbroker.net/ipv4_end.php?ipv4b=<a>&pass=this_is_your_password_md5&user_id=this_is_your_userid_md5&tunnel_id=your_tunnel_id
interval maximum 1 0 0 0
interval minimum 1 0 0 0

interface FastEthernet0/1
ip ddns update v6tunnelbroker host ipv4.tunnelbroker.net

 

You should be able to access the IPv6 Internet now!  Try to access http://ipv6.google.com from a PC behind the router!

Failed to Install IPv6 on Windows XP

I have tried to install IPv6 on my Windows XP laptop using the command line “ipv6 install” and it failed with the error message “Failed to complete action, Error 0x800704b8”.  When I tried to do it via GUI and it showed an error dialog box “An extended error has occured”.  After some googling, I solve my problem with the following command:

esentutl /p %windir%\security\Database\secedit.sdb

Try to run the ipv6 install again and it works like a charm!

Enable IPv6 function on 3560/3750

You’ll need the proper SDM template to enable v4, v6 dual stack on 3560/3750/3560E/3750E

Switch(config) # sdm prefer dual-ipv4-and-ipv6 default

IPv6 General Prefix

My environment: Cisco Catalyst 3560E

IOS: 12.2(50)SE2, Advanced IP services

This is a handy feature provides quick and easy way to deploy prefix changes

Example:

ipv6 general-prefix DEV C0:A8:A::/48

int fa0/1

ipv6 addr DEV ::1/48

Your IPv6 address of fa0/1 is equal to C0:A8:A::1/48

Configuring IPv6 address on Linux

My environment: RH FC8 x86_64

To enable IPv6 globally, modify the file

# vi /etc/sysconfig/network

And append the following:

NETWORKING_IPV6=yes

Then change the NIC config file

# vi /etc/sysconfig/network-scripts/ifcfg-eth0

And append the following IPv6 parameters:

IPV6INIT=yes
IPV6ADDR=<IPv6-IP-Address>
IPV6_DEFAULTGW=<IPv6-IP-Gateway-Address>

If you want to acquire the IPv6 address via DHCPv6 server, first make sure you have the DHCPv6 client installed:

# rpm –q dhcpv6-client

then modifiy the NIC config file and append the following parameters:

# vi /etc/sysconfig/network-scripts/ifcfg-eth0

IPV6INIT=yes
DHCPV6C=yes

Edit the main DHCPv6 client config file

# cp /usr/share/doc/dhcpv6-client-*/dhcp6c.conf /etc/
# vi /etc/dhcp6c.conf

interface eth0 {
    send rapid-commit;
    request domain-name-servers;
};

Restart the network service

# /etc/init.d/network restart

Then check your eth0 configuration to make sure you get the ipv6 address:

# ifconfig eth0

Configuring Windows 2003 Server DNS in IPv6 environment

My environment: Windows 2003 Server Enterprise edition

You can configure your Windows 2K3 server to listen over IPv6, what you need to do is to enable it through command prompt:

dnscmd /config /EnableIPv6 1

Then restart your DNS service.

To add an IPv6 host record, you’ll need to add an “AAAA” record instead of an “A” host record like you did in IPv4.

Right click on your domain name in the forward lookup zones, choose “Other New Records”

Add a new AAAA record:

To check if it is working, you can either using nslookup on Windows or dig on Linux:

dig -6 ad-v6.ucdemo.com @c0:a8:a::c8 AAAA

nslookup –q=AAAA ad-v6.ucdemo.com

Configuring Static ipv6 address and default route on Windows 2003 Server

My environment: Windows 2003 Server Enterprise Edition

There is no GUI for ipv6 static address configuration, you can configure it through the netsh CLI:

netsh interface ipv6 set privacy disabled

netsh interface ipv6 add address interface="Local Area Connection" address=2001:1:1::200 store=persistent

netsh interface ipv6 add route ::/0 interface="Local Area Connection" 2001:1:1::1 store=persistent

To verify:

ipconfig /all

ping 2001:1:1::1

netstat -rn