Change Details

NAT64 requires dedicated transport address space for translation, similar to exclusive port ownership during socket binding. If a local process and Jool translation both use the same transport tuple (for example, 192.0.2.1:5000), traffic conflicts can occur. Jool does not prevent pool4 from overlapping with other port allocations, so avoiding conflicts is an operator responsibility. In addition to service ports already in use, account for Linux ephemeral range (net.ipv4.ip_local_port_range), which defaults to 32768-60999. This default is why, when pool4 is empty, Jool uses 61001-65535 on the node's primary global addresses. One can adjust the ephemeral range via sysctl, and Jools translation range via pool4 add/remove. vyos@vyos:~$ sysctl net.ipv4.ip_local_port_range net.ipv4.ip_local_port_range = 32768 60999 VyOS now uses verify() in NAT64 to check that the supplied tranlation port range does not overlap with the Kernels ephemeral port range. Change is required in order to update the Jool Kernel Module

NAT64 requires dedicated transport address space for translation, similar to exclusive port ownership during socket binding. If a local process and Jool translation both use the same transport tuple (for example, 192.0.2.1:5000), traffic conflicts can occur. Jool does not prevent pool4 from overlapping with other port allocations, so avoiding conflicts is an operator responsibility. In addition to service ports already in use, account for Linux ephemeral range (net.ipv4.ip_local_port_range), which defaults to 32768-60999. This default is why, when pool4 is empty, Jool uses 61001-65535 on the node's primary global addresses. One can adjust the ephemeral range via sysctl, and Jools translation range via pool4 add/remove. ``` vyos@vyos:~$ sysctl net.ipv4.ip_local_port_range net.ipv4.ip_local_port_range = 32768 60999 ``` VyOS now uses verify() in NAT64 to check that the supplied tranlation port range does not overlap with the Kernels ephemeral port range. Change is required in order to update the Jool Kernel Module

NAT64 requires dedicated transport address space for translation, similar to exclusive port ownership during socket binding. If a local process and Jool translation both use the same transport tuple (for example, 192.0.2.1:5000), traffic conflicts can occur. Jool does not prevent pool4 from overlapping with other port allocations, so avoiding conflicts is an operator responsibility. In addition to service ports already in use, account for Linux ephemeral range (net.ipv4.ip_local_port_range), which defaults to 32768-60999. This default is why, when pool4 is empty, Jool uses 61001-65535 on the node's primary global addresses. One can adjust the ephemeral range via sysctl, and Jools translation range via pool4 add/remove. ``` vyos@vyos:~$ sysctl net.ipv4.ip_local_port_range net.ipv4.ip_local_port_range = 32768 60999 ``` VyOS now uses verify() in NAT64 to check that the supplied tranlation port range does not overlap with the Kernels ephemeral port range. Change is required in order to update the Jool Kernel Module