Following up on my post, here's a WIP guide on getting CLAT working in FreeBSD 14.3-RELEASE..

Tayga CLAT on FreeBSD 14.3-RELEASE with NDPROXY

CLAT as part of 464xlat as defined in RFC 6877 is meant to be running on an IPv6-only host.

The Setup

pkg install gmake gcc ndproxy-3.2.1403000_1

Get the tayga git repo

mkdir /root/staging ; cd /root/staging
git clone https://github.com/apalrd/tayga.git
cd tayga
gmake
cp tayga /usr/local/bin/
mkdir /var/db/tayga
chown nobody:nobody /var/db/tayga

Prepare tayga configuration

cat /etc/tayga.conf
tun-device clat0
ipv4-addr 192.0.0.2
ipv6-addr 2001:db8:1:1::65
#prefix 64:ff9b::/96 # Well-Known Prefix
prefix 2001:db8:64:64::/96 # Network-Known Prefix
data-dir /var/db/tayga
wkpf-strict no
map 192.0.0.1 2001:db8:1:1::64
log drop reject

Replace 2001:db8:1:1:: with your own IPv6 prefix. I am using my own NKP prefix here for NAT64. You can use one from here

Write a script to configure the clat0 interface and it's routes and save it as /root/bin/routes-clat.sh

#!/bin/sh
ifconfig clat0 inet 192.0.0.1/29 192.0.0.1 up
ifconfig clat0 inet6 -ifdisabled
route add default -iface clat0
route -6n add 2001:db8:1:1::64/127 -iface clat0

Make the script executable. Next setup tayga and ndproxy to start on boot..

cat /etc/rc.conf.local
# TAYGA (CLAT)
tayga_enable="YES"
tayga_interfaces="clat0"
# NDPROXY
ndproxy_enable="YES"
ndproxy_uplink_interface="vtnet0" # host interface
ndproxy_downlink_mac_address="xx:xx:xx" # host mac address
ndproxy_uplink_ipv6_addresses="fe80::xx:xx:xx" # gateway link-local address
ndproxyconf_exception_ipv6_addresses=""

Download the rc script for Tayga

curl -O https://buster.xpath.my/tayga/rc.d-tayga.txt
mv rc.d-tayga.txt /usr/local/etc/rc.d/tayga
chmod +x /usr/local/etc/rc.d/tayga

Now that everything is in place, time to start and test it..

service tayga start
service ndproxy start
sysctl net.inet6.ip6.forwarding=1
sysrc ipv6_gateway_enable="YES"

Test with the ping command. Example output will look like this:

ping -c3 1.1.1.1
PING 1.1.1.1 (1.1.1.1): 56 data bytes
64 bytes from 1.1.1.1: icmp_seq=0 ttl=37 time=216.021 ms
64 bytes from 1.1.1.1: icmp_seq=1 ttl=37 time=216.013 ms
64 bytes from 1.1.1.1: icmp_seq=2 ttl=37 time=215.861 ms
--- 1.1.1.1 ping statistics ---
3 packets transmitted, 3 packets received, 0.0% packet loss
round-trip min/avg/max/stddev = 215.861/215.965/216.021/0.073 ms

With curl:

curl -kI https://8.8.8.8/
HTTP/2 302 
x-content-type-options: nosniff
location: https://dns.google/
date: Sun, 22 Jun 2025 06:41:58 GMT
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)
content-length: 216
x-xss-protection: 0
x-frame-options: SAMEORIGIN
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

NOTE: If you are using NAT64/PLAT address from nat64.net, some of them might block ICMP. If so test with curl instead. Latency-wise, it is better to run your own NAT64 or use one that is geo closer to you. You can either use #Jool or #Tayga for NAT64.

Please test and provide feedback. Thanks 🙂

#freebsd #ipv6 #ipv6only #tayga

I have been working and testing Tayga's CLAT with FreeBSD 14.3-RELEASE on an IPv6-only host this whole week and it is working.

There are 3 approaches to this .. the ndproxy approach, the NAT66 approach and the vnet jail approach. They all work depending on scenario..

I'll be doing some more tests just to catch any surprise cases that might pop up.. I'll maybe then write a simple guide to get this done all ways 🙂

#freebsd #ipv6 #ipv6only #tayga

Apalrd has started the task of maintaining Tayga NAT64

-- https://youtu.be/WlQH8KubgiA?si=0Axb9tvYh2_hONsP
-- https://github.com/apalrd/tayga/

I just tested this on FreeBSD 14.2 and it works on the main Host and usable in a vnet jail.

#FreeBSD #IPv6 #Tayga