Disclosure up front: I run IPYE, a company that leases IP space. Most of this article is practical how-to; IPYE appears where a free /48 helps you try the work, with a short call to action at the end.

DS-Lite (RFC 6333) tunnels IPv4 inside IPv6 from the CPE (B4) to a carrier AFTR that runs CGNAT. Operators care about MTU and abuse logging; content operators care that native IPv6 avoids the softwire entirely. A free IPv6 /48 from IPYE—instant setup, first year free, real allocation for your ASN, portal LOA, automatic ROA—lets you practise announcing space users can reach without CGNAT. This article covers B4/AFTR roles, a Linux tunnel sketch, logging fields, and debugging.

Roles

  • B4 (Basic Bridging BroadBand): CPE function that tunnels IPv4-in-IPv6 to the AFTR. LAN IPv4 is often 192.0.0.0/29 or a normal RFC 1918 LAN without local NAT, depending on the profile.
  • AFTR (Address Family Transition Router): decapsulates, runs NAT44 for many subscribers, encapsulates return traffic.

IPv6 traffic from the LAN is native and never enters the softwire. That split is the operational point of DS-Lite: upgrade the access network to IPv6-only while keeping a shared IPv4 exit.

Why providers like it

One IPv6-only access network reaches both IPv6 services and legacy IPv4. IPv4 public addresses are shared at the AFTR (CGNAT), which conserves inventory. Compared with per-customer public IPv4, you must invest in logging (subscriber identifier mapped to outside IP, port, and time) and in customer support playbooks for CGNAT breakage (inbound ports, some games, hairpin behaviours). Training the help desk to recognise "IPv6 works, IPv4 intermittent" as a softwire or AFTR symptom saves hours.

B4-side Linux sketch

Production CPEs embed DS-Lite; on a lab Linux B4 you typically need an ipip6 (IPv4-in-IPv6) tunnel to the AFTR:

ip link add name ds-lite type ip6tnl \ mode ipip6 remote 2001:db8:aftr::1 local 2001:db8:b4::2 dev eth0 ip link set ds-lite up ip addr add 192.0.0.2/29 dev ds-lite ip route add default dev ds-lite

Your WAN must already have working IPv6 to 2001:db8:aftr::1. DNS for LAN clients often remains IPv6 with optional DNS64; IPv4 DNS can be provided via DHCPv4 on the LAN facing interface. Exact sysctls depend on kernel and whether forwarding is enabled between LAN and tunnel. Persist the tunnel with your network manager or a small systemd unit so a reboot restores the softwire.

AFTR expectations

The AFTR terminates softwires from many B4s, demultiplexes by IPv6 outer source, and applies NAT44. Operational requirements:

  • Per-softwire MTU accounting (IPv4 payload plus IPv6 outer header); MSS clamping on the NAT or tunnel is common.
  • Port block allocation or NAT behaviour documented for support.
  • Exportable logs: outer IPv6 (subscriber), inside IPv4, outside IPv4, ports, timestamp. Without that, abuse complaints about 192.0.2.50 cannot be mapped to a customer.
  • Capacity headroom on ports per subscriber; exhaustion shows up as one-way failures for new connections.

Debugging 

ping 192.0.2.10 # from LAN behind B4 traceroute 192.0.2.10 tcpdump -n -i eth0 ip6 and proto 4 # IPv4-in-IPv6 on the WAN ip -d link show ds-lite ping6 2001:db8:aftr::1

If IPv6 works but IPv4 fails, check AFTR reachability, tunnel state, and whether the AFTR has exhausted ports for that subscriber. If large transfers stall, suspect MTU: try lowering MSS or setting a smaller MTU on ds-lite. Compare with a dual-stack control host on the same site to separate access issues from AFTR issues.

Compared with 464XLAT and NAT64

DS-Lite tunnels all IPv4 toward a CGNAT. 464XLAT translates on the CPE toward NAT64 and is common on mobile. Stateless softwire approaches (MAP-E/MAP-T) embed addressing math so the AFTR can be partly stateless. Choose based on CPE capability and ops familiarity; all of them still need a story for shared IPv4 abuse logging.

For a lab or small ISP proof-of-concept, get IPv6-only WAN right first, then add a single AFTR and one B4, prove logging round-trip, and only then scale pool size.

Logging fields that satisfy a real complaint

A usable AFTR log line (or flow record) typically includes at least: timestamp (UTC), subscriber outer IPv6 address or delegated prefix, inside IPv4 source, inside port, outside IPv4, outside port, protocol, and NAT event (create/delete). Store retention according to your jurisdiction and policy, and restrict access to the abuse role.

Practice the lookup: take a sample complaint "192.0.2.50:44301 at 2026-11-10 05:00 Asia/Dhaka", convert to UTC, query the log store, and confirm you land on the correct B4 prefix. If the query takes longer than your abuse SLA, fix indexing before you scale the CGNAT pool. Softwires without accountable logs are a liability; softwires with tested logs are an ordinary access technology.

Escape the softwire with native IPv6

If you run services, publish AAAA on aggregatable space you announce yourself. IPYE's free /48 is built for that practice loop: claim at the IPv6 product page, announce on your ASN, and rely on automatic ROA creation while you learn AFTR logging on the access side.

MTU and MSS in one paragraph you can hand to support

IPv4 inside IPv6 adds an outer header, so a 1500-byte LAN IPv4 packet may not fit an access MTU of 1500 on the WAN. Symptoms are classic: ping with small payloads works, TCP handshakes complete, and large HTTP or TLS transfers hang. Fixes that work in practice are lowering the tunnel MTU (for example 1460 or lower depending on outer headers), enabling TCP MSS clamping toward the LAN, and ensuring Path MTU Discovery is not blocked for the outer IPv6 packets. When a ticket says "only big downloads fail on IPv4", check softwire MTU before reimaging the CPE.

Announce native IPv6 on a free /48

the IPYE IPv6 rental page (see About) · ipye@turnel.com

About IPYE

IPYE (https://ipye.com) leases IPv4, IPv6 and ASN space with instant setup. Your first IPv6 /48 is free for the first year, a real allocation you can announce on your own ASN, with a LOA from the portal and the ROA created automatically. ASN and region changes apply automatically. IPv4 /24 to /22 leases include LOA, ROA and per-/24 rDNS; WHOIS is editable on IPv6 /44 and larger. Locations: Los Angeles, New York, Ashburn, Salt Lake City, London, Amsterdam, Frankfurt. Claim your free /48: https://my.ipye.com/products/ipv6-rental. Questions: ipye@turnel.com.

Disclosure: I run IPYE