Tayga NAT64 Official Support for RouterOS

Tayga v0.9.6 has been released, and with it comes a NAT64 container image tested to work with RouterOS!

There’s a speed-run guide you can copy and paste from here if you don’t want to read everything else: tayga/docs/container/mikrotik.md at main · apalrd/tayga · GitHub

NAT64 is a translation technology which allows IPv6-only clients to access IPv4-only resources, by mapping the entire IPv4 address space into a small IPv6 prefix. This may be combined with DNS64, where A records are rewritten as AAAA records, allowing clients to access IPv4-only websites by name using normal domain lookup and IPv6 sockets. When combined with a client-side translator (CLAT), native IPv4 packets may be translated to IPv6, allowing IPv4 sockets to be used as well.

Tayga implements Stateless IP/ICMP Translation (SIIT). As it does not perform session tracking and port translation, each IPv6 client is allocated a temporary IPv4 address out of a dynamic pool. RouterOS will then NAPT masquerade the IPv4 sessions from this temporary pool to the internet.

You can filter packets on either the IPv4 or IPv6 side, or both. Packets will flow through RouterOS twice, once as IPv4 and once as IPv6, and packet marking .. will not persist through this process.

I’m working on a CLAT version of the container, allowing RouterOS to also act as a client-side translator for IPv4 islands. If you have any input on how you would like to deploy it, I’m open to suggestions.

Let me know if you find it useful, or need any deployment help!

Super cool, I’ve been running a vm with jool (tried both it and Tayga) to fulfill this function, I’ll try setting this up as a failover / backup instance.

I would definitely try out the CLAT version too, that would be huge for CPE.

I built a performance-oriented TAYGA fork for 464XLAT/CLAT in RouterOS containers, based on upstream 0.9.6.

The main change is Linux TUN GSO/CSUM support (IFF_VNET_HDR): TCP super-packets are translated in-place instead of one MTU-sized packet at a time. The fork also adds multi-queue workers, zero-copy IPv6→IPv4 conversion, RFC 7915-safe handling of short GSO tails, TTL/ICMP handling, runtime offload detection/fallback, GSO counters, and RouterOS CLAT/NAT64 deployment scripts.

At a controlled ARM64 VM load of 300 Mbit/s, GSO reduced TUN read/write calls from about 62,000/s to 2,800/s (−95.5%) and reduced TAYGA CPU by about 4×, with zero TUN drops. The highest short in-VM SHA-256-verified transfer reached 8.4 Gbit/s upload and 7.6 Gbit/s download; this is a local VM result, not a claim for LTE or RouterOS throughput.

It does not create a RouterOS hardware fast path, but it substantially reduces the translator’s per-packet cost. The remaining router CPU cost comes from RouterOS container networking, LTE/MBIM, IRQ/softirq, firewalling, and Wi-Fi.

Fork: GitHub - antongrizli/tayga · GitHub