Route and filter the translated identity
05Routing advertisements and security checks must respect what the embedded address means. IPv6 spelling must not let a blocked IPv4 identity slip through.
Traffic to or from an embedded IPv6 address should face the same filtering as direct traffic to or from its IPv4 identity. A different address family must not hide a blocked peer.
Source for this drawing: RFC 6052 · Read RFC section 3.2 ↗
New to this? Start hereA quick picture + helpful background
A message needs an address.
Think of a packet as a small addressed envelope. Devices pass it onward; transport protocols decide what delivery promises an application gets.
Helpful first, if these ideas are unfamiliar
These pictures are analogies to help you learn. The linked RFC explains the actual rules.
Terms in this drawing
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.
Address mapping does not authenticate a sender.
- Address mapping does not authenticate a sender.
- Organizations advertising the Well-Known Prefix MUST provide translation service. More-specific prefixes derived from it MUST NOT be advertised in BGP; administrators SHOULD filter those advertisements. Network-Specific Prefix advertisements MUST use proper aggregation.
- Check authorized source location to mitigate spoofing, configure prefixes securely, and apply equivalent IPv4 filtering to embedded IPv6 traffic. The RFC explains these risks but leaves secure-configuration and firewall mechanisms out of scope.
BGP means Border Gateway Protocol, used for routing between networks. The successful /96 advertisement is conditional on providing the service and routing policy; it is not a command to advertise it everywhere. The failed /120 advertisement is stopped before peers accept it. Firewall and reverse-path checks are conceptual controls, not a claim that this guide configures or audits a production network.
Read the RFC section ↗