Recently, Microsoft began rolling out Windows Customer-side Translator (WinCLAT) for Windows 11, allowing IPv4 applications to communicate over IPv6-only networks using 464XLAT. To translate that traffic, WinCLAT must discover the network’s NAT64 prefix. This post explains how WinCLAT learns the prefix through router advertisements or DNS, and where DHCPv4 option 108 fits into an IPv6-only deployment.
464XLAT
The 464XLAT CLAT translates an application’s IPv4 packets into IPv6 and sends them across an IPv6-only network to the PLAT. CLAT embeds the destination IPv4 address inside a special NAT64 IPv6 prefix (PREF64). The PLAT extracts the embedded IPv4 address and converts the packets back to IPv4 so they can reach the destination IPv4 address.
Well-Known Prefix
The NAT64 well-known prefix (WKP) is 64:ff9b::/96 as defined in RFC 6052. An IPv4 address is embedded in the last 32 bits of this prefix to produce a corresponding IPv6 address. In the example below, I’ve made two DNS queries for an IPv4-only resource: one to the standard Cloudflare public DNS server, and another to the Cloudflare public DNS64 server. The first response returns only an A resource record. In the second response, the server also returns an AAAA resource record using the well-known NAT64 prefix. You’ll find the last 32 bits of this record include the hexadecimal representation of the IPv4 address (ace9:3910 = 172.233.153.111).
DNS queries and respnonses from standard and DNS64 DNS servers
This example uses the well-known prefix, but a network may use a different, network-specific NAT64 prefix (NSP). WinCLAT must discover the prefix used by the network’s PLAT before it can translate traffic correctly.
Prefix Discovery
WinCLAT can learn the NAT64 prefix in two ways. It can learn the NAT64 prefix from a PREF64 option carried in an IPv6 Router Advertisement (RFC 8781), or by querying ipv4only.arpa and extracting the prefix from the DNS64-synthesized AAAA records (RFC 7050).
Router Advertisement
NAT64 prefix discovery via RA is the preferred prefix discovery method. The router advertises the NAT64 prefix that hosts should use for 464XLAT on that link. Windows 11 clients with WinCLAT enabled use the advertised prefix to construct IPv6 destination addresses for IPv4 traffic. When both RA and DNS prefix discovery are enabled, Windows uses DNS as a fallback.
IPv6 router advertisement with PREF64 enabled
DNS
WinCLAT can also discover the NAT64 prefix through DNS. On an IPv6-only network, it queries ipv4only.arpa for AAAA records. The domain has two A records, 192.0.0.170 and 192.0.0.171, but no native AAAA records. A DNS64 resolver uses those IPv4 addresses and the network’s NAT64 prefix to synthesize AAAA responses. WinCLAT extracts the prefix from those responses and uses it for translation.
DNS queries and responses for the ipv4only.arpa domain using standard and DNS64 servers
DNS64 query response for the ipv4only.arpa domain
DHCP Option 108
DHCPv4 option 108, called IPv6-Only Preferred and defined in RFC 8925, lets a DHCPv4 server indicate that a client can operate without a native IPv4 address on the network. A compatible client requests the option in its DHCPDISCOVER or DHCPREQUEST message. If the DHCPOFFER contains a valid option 108, the client normally stops DHCPv4 configuration for the indicated wait period and uses IPv6 connectivity instead. During that time, 464XLAT provides IPv4 connectivity for applications over the IPv6-only network. Option 108 does not supply the NAT64 prefix; WinCLAT discovers that separately through router advertisements or DNS, as described previously.
DHCP Discover requesting option 108
DHCP Offer with option 108
Windows DHCP Server and Option 108
DHCP option 108 is not natively supported in Windows DHCP Server. However, administrators can create a Custom Predefined Option to enable DHCP option 108 support in their environment. You will find detailed guidance for configuring DHCP option 108 for Windows DHCP servers here.
Summary
WinCLAT allows IPv4 applications to work on an IPv6-only network by translating their traffic for a NAT64 gateway. To do this, it discovers the network’s NAT64 prefix through a router advertisement or DNS. DHCPv4 option 108 serves a separate purpose: it tells compatible clients they can defer native IPv4 configuration and rely on IPv6 connectivity.
Additional Information
Microsoft Begins Rolling Out Windows CLAT for IPv6-Mostly and IPv6-Only Networks
Configure DHCP Option 108 on Windows DHCP Server
RFC 6877 464XLAT: Combination of Stateful and Stateless Translation
