Address Translation (SIIT)

What SIIT does

SIIT (Stateless IP/ICMP Translation, RFC 7915) is a mechanism for translating packets between IPv4 and IPv6 without keeping per-connection state, and is part of the broader 464XLAT approach for giving IPv4 connectivity over an IPv6-only network. EON Path’s routing method uses SIIT inside the WireGuard tunnel: the client’s TUN device sends and receives plain IPv4 packets, and SIIT translates them to and from IPv6 immediately before and after they cross the tunnel.

SIIT embeds an IPv4 address in the low 32 bits of an IPv6 address behind a configured /96 prefix — for example, an internal address 10.0.0.2 behind the prefix 2001:db8:4464::/96 becomes 2001:db8:4464::a00:2. Translating a packet means rewriting its IP header (and recalculating checksums, since IPv4 and IPv6 compute them differently) between these two representations; no connection table is required, which is what makes the translation stateless and cheap to run on every packet.

Where it sits in the data path

Application (IPv4)
        │
        ▼
   TUN device
        │
        ▼
 SIIT: IPv4 → IPv6
        │
        ▼
 WireGuard tunnel (encrypted)
        │
        ▼
 SIIT: IPv6 → IPv4        (server side)
        │
        ▼
 NAT → public internet

On the way back, the server-side SIIT translator converts IPv6 responses back to IPv4 before they re-enter the tunnel toward the client, so the translation is invisible to the application at either end — it always sees plain IPv4.

When it applies

SIIT translation is configured per active tunnel: it applies to a client’s single session with a given server, using that session’s /96 prefix and address mapping. This keeps the translation logic simple and stateless — a tunnel either has SIIT enabled with a specific prefix and address pair, or it doesn’t need SIIT because both ends already agree on an IPv4 or IPv6 addressing scheme directly.

Why it exists

SIIT solves a specific deployment problem: a server’s internal network may be IPv6-only, while the client applications that need to reach it only speak IPv4. Rather than requiring every client application to be updated to support IPv6, or running a stateful NAT64 gateway with connection tracking overhead, EON Path’s SIIT translation lets an IPv4-only client transparently reach an IPv6-only server network, and, combined with NAT on the server side, lets that traffic continue on to the public internet using the server’s own IPv4 or IPv6 connectivity. This is particularly useful for infrastructure that has migrated internally to IPv6 but still needs to serve IPv4-speaking clients and applications.