What is 6to4 Tunneling?
Learn what 6to4 tunneling is, how the 2002::/16 prefix encodes IPv4 addresses, and why relay routers made it unreliable.
Expected Interview Answer
6to4 tunneling is an automatic IPv6-over-IPv4 tunneling mechanism that lets IPv6 hosts communicate across an IPv4-only network by encapsulating IPv6 packets inside IPv4 packets, using a special 2002::/16 address prefix derived directly from the host’s public IPv4 address.
A 6to4 router takes its public IPv4 address, embeds it into the 2002::/16 IPv6 prefix (for example, IPv4 address 203.0.113.5 becomes prefix 2002:cb00:7105::/48), and uses that derived prefix to number an IPv6 network behind it. When sending IPv6 traffic toward another 6to4 site, the router wraps the IPv6 packet inside an IPv4 packet addressed to the destination’s embedded IPv4 address and sends it directly over the existing IPv4 internet, with no manual tunnel configuration needed since the far end’s IPv4 address is recoverable straight from the destination IPv6 address. To reach the native IPv6 internet rather than another 6to4 site, traffic is instead sent to a well-known 6to4 relay router, which is where much of 6to4’s real-world unreliability comes from, since relays are often poorly maintained, asymmetric, or unreachable, causing dropped or one-way connections. Because of this fragility, 6to4 has fallen out of favor and is now generally discouraged in favor of native dual stack or more reliable tunneling like 6in4 with a known, dedicated tunnel broker.
- Requires no manual tunnel configuration between two 6to4 sites
- Derives the entire IPv6 prefix automatically from an existing public IPv4 address
- Lets isolated IPv6 networks reach each other across IPv4-only transit
- Historically useful as a zero-config bridge before native IPv6 was widely deployed
AI Mentor Explanation
A 6to4 tunnel is like a team creating a temporary new jersey-numbering scheme by prefixing every player’s old squad number with the ground’s postal code, so anyone who knows the postal code can automatically derive the new jersey number without a phone call. Sending a message to another team works the same way: the sender embeds the away ground’s postal code into the delivery address and posts it through the ordinary mail network, no separate courier arrangement needed. But if the destination is not a team using this scheme at all, the letter has to be routed through a designated relay office, and if that relay office is unreliable, letters go missing — which is exactly why 6to4 gained a reputation for dropped connections.
Step-by-Step Explanation
Step 1
Derive the prefix
A 6to4 router embeds its public IPv4 address into the 2002::/16 prefix to get a unique /48 IPv6 network automatically.
Step 2
Encapsulate outbound packets
Outgoing IPv6 packets to another 6to4 site are wrapped in an IPv4 header addressed to the destination’s embedded IPv4 address.
Step 3
Route across IPv4
The encapsulated packet travels over the ordinary IPv4 internet with no special tunnel configuration between the two 6to4 sites.
Step 4
Relay for native IPv6
Traffic destined for the native IPv6 internet instead goes through a public 6to4 relay router, a common point of failure.
What Interviewer Expects
- Explains how the 2002::/16 prefix encodes the public IPv4 address
- Describes automatic, configuration-free tunneling between two 6to4 sites
- Knows that reaching native IPv6 requires a relay router, and why relays are unreliable
- Can state that 6to4 is now largely deprecated in favor of native dual stack
Common Mistakes
- Confusing 6to4 with NAT64 (6to4 is tunneling, NAT64 is translation)
- Not knowing the IPv4 address is directly embedded in the 2002::/16 prefix
- Assuming 6to4 needs manual tunnel broker configuration like 6in4
- Overlooking that 6to4 requires a public (not private/NATed) IPv4 address to work
Best Answer (HR Friendly)
“6to4 tunneling is an older, mostly automatic way to let IPv6 traffic travel across the regular IPv4 internet by wrapping it inside IPv4 packets, using a special address format that already contains the sender’s IPv4 address baked in. It sounded convenient because no manual setup was needed, but reaching the real IPv6 internet still depended on shared relay servers that were often unreliable, which is why most networks have moved on to more dependable options like dual stack.”
Code Example
python3 -c "
import ipaddress
ipv4 = ipaddress.ip_address('203.0.113.5')
hexbytes = ''.join(f'{b:02x}' for b in ipv4.packed)
prefix = f'2002:{hexbytes[0:4]}:{hexbytes[4:8]}::/48'
print(prefix)
"
# 2002:cb00:7105::/48
# Legacy Linux 6to4 tunnel interface setup (deprecated, shown for reference)
ip tunnel add tun6to4 mode sit remote any local 203.0.113.5
ip link set tun6to4 up
ip addr add 2002:cb00:7105::1/16 dev tun6to4Follow-up Questions
- Why is 6to4 considered unreliable compared to a dedicated tunnel broker?
- How does 6to4 differ from 6in4 tunneling?
- Why does 6to4 require a public, non-NATed IPv4 address?
- What replaced 6to4 in most modern IPv6 deployment strategies?
MCQ Practice
1. What IPv6 prefix does 6to4 use to encode a public IPv4 address?
6to4 uses the reserved 2002::/16 prefix, embedding the public IPv4 address in the next 32 bits.
2. What is the main reason 6to4 gained a reputation for unreliability?
Reaching native IPv6 destinations requires a 6to4 relay router, and many public relays were inconsistently maintained or unreachable.
3. What must a device have for 6to4 to work?
6to4 embeds the device’s own public IPv4 address into its IPv6 prefix, so a real public IPv4 address is required.
Flash Cards
What prefix does 6to4 use? — 2002::/16, with the public IPv4 address embedded in the following 32 bits.
How do two 6to4 sites communicate? — By encapsulating IPv6 packets inside IPv4 and sending them directly, since the destination IPv4 is derivable from the address.
What is needed to reach native IPv6 from 6to4? — A public 6to4 relay router, which is often an unreliable point of failure.
Is 6to4 still recommended today? — No — it is largely deprecated in favor of native dual stack or dedicated tunnel brokers like 6in4.