While modern internet infrastructure is steadily transitioning towards native IPv6 connectivity, thousands of enterprise data centres, hosting providers, and legacy campus networks remain bound to IPv4-only backbones. To deliver IPv6 connectivity to dual-stack servers and remote subnets across an intermediate IPv4 network, network engineers rely on Simple Internet Transition (SIT) tunneling, commonly referred to as 6in4.
Defined by RFC 4213, SIT encapsulates standard IPv6 packets directly inside IPv4 packets using IP Protocol 41 (ipv6), requiring only 20 bytes of encapsulation overhead. Unlike user-space VPNs that add encryption latency, Linux kernel SIT tunnels execute directly inside the networking core, achieving maximum throughput. This guide explains how to create, configure, route, and test SIT IPv6-over-IPv4 tunnels in Linux using the ip tunnel and ip route commands.
Why Use SIT (6in4) Tunnels?
Deploying SIT tunnels provides several key architectural and operational benefits:
- Lightweight IPv6 Transition: SIT allows isolated IPv6 islands or remote branch offices to communicate seamlessly over legacy IPv4 carrier routing.
- Minimal Header Overhead: By prepending a standard 20-byte IPv4 header directly to the IPv6 packet, SIT eliminates the larger overhead associated with GRE, UDP, or VXLAN wrappers.
- Tunnel Broker Compatibility: SIT is the standard protocol utilised by IPv6 tunnel brokers (such as Hurricane Electric / Tunnelbroker.net) to provide free public IPv6 blocks to IPv4 servers.
- High Performance: Encapsulation and decapsulation are handled natively by the Linux kernel
sitdriver without user-space context switches.
Step 1: Verify and Load the Kernel SIT Module
Ensure that the Linux kernel SIT driver is loaded on your host machine:
lsmod | grep sitIf the module is not listed, load it using modprobe:
sudo modprobe sitTo persist the module across system reboots, add it to the system modules list:
echo "sit" | sudo tee -a /etc/modules-load.d/sit.confStep 2: Create the SIT Tunnel Interface
Consider the following network topology between two endpoints:
- Host A (Local): IPv4 Underlay
198.51.100.10, IPv6 Overlay2001:db8:1::1/64 - Host B (Remote): IPv4 Underlay
203.0.113.20, IPv6 Overlay2001:db8:1::2/64
Create the Interface on Host A
Execute the following command to define an interface named sit01 in sit mode:
sudo ip tunnel add sit01 mode sit \
remote 203.0.113.20 \
local 198.51.100.10 \
ttl 64Parameter Breakdown:
sit01: The name of the virtual tunnel interface created in Linux.mode sit: Configures RFC 4213 IPv6-in-IPv4 encapsulation (IP protocol 41).remote 203.0.113.20: The public IPv4 underlay address of the remote tunnel endpoint.local 198.51.100.10: The local IPv4 underlay address bound to your physical network card.ttl 64: Sets the Time-To-Live for the outer IPv4 header.
Step 3: Assign IPv6 Addresses and Bring the Interface Up
Once created, assign the designated IPv6 point-to-point address and bring the tunnel link online:
sudo ip -6 addr add 2001:db8:1::1/64 dev sit01
sudo ip link set dev sit01 upConfigure the Matching Peer on Host B
On Host B (203.0.113.20), execute the reciprocal commands:
sudo ip tunnel add sit01 mode sit remote 198.51.100.10 local 203.0.113.20 ttl 64
sudo ip -6 addr add 2001:db8:1::2/64 dev sit01
sudo ip link set dev sit01 upStep 4: Verify Tunnel Status and Test IPv6 Connectivity
Inspect the active tunnel parameters using ip tunnel:
ip tunnel show sit01View the assigned IPv6 address and interface state:
ip -6 addr show dev sit01Verify bidirectional IPv6 communication across the tunnel using ping6 or standard ping:
ping -6 -c 4 2001:db8:1::2Step 5: Configure Default or Subnet IPv6 Routing
If Host B serves as your upstream IPv6 gateway to the wider global IPv6 internet (common when using tunnel brokers), add a default IPv6 route pointing through the SIT interface:
sudo ip -6 route add default via 2001:db8:1::2 dev sit01To verify which interface Linux selects to reach external IPv6 hosts (such as Google DNS), query the kernel route table:
ip -6 route get 2001:4860:4860::8888Step 6: How to Delete a SIT Tunnel
When you wish to decommission a tunnel, bring the interface down and delete it:
sudo ip link set dev sit01 down
sudo ip tunnel del sit01Troubleshooting Common SIT Tunnel Issues
MTU Clamping and Packet Loss
Because SIT adds a 20-byte IPv4 outer header, an underlay network with a standard MTU of 1500 bytes can only support an IPv6 MTU of 1480 bytes. If large file downloads or web browsing over IPv6 hangs, explicitly set the interface MTU to 1480:
sudo ip link set dev sit01 mtu 1480To prevent path MTU issues for TCP streams, configure MSS clamping in ip6tables or nftables:
sudo ip6tables -t mangle -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtuFirewall Dropping IP Protocol 41 (ipv6)
SIT tunnels do not use UDP or TCP; they use raw IP Protocol 41 (ipv6). If ping fails between endpoints, ensure your local firewall or cloud provider security group permits incoming protocol 41 traffic. On Ubuntu using UFW, allow protocol 41 from your remote peer:
sudo ufw allow from 203.0.113.20 proto ipv6 to 198.51.100.10Frequently Asked Questions
What is the difference between SIT and IPIP tunnels?
While IPIP (IP protocol 4) encapsulates IPv4 inside IPv4, SIT (IP protocol 41) specifically encapsulates IPv6 inside IPv4. Both protocols introduce identical 20-byte header overheads, but SIT allows pure IPv6 subnets to traverse IPv4 networks.
Can SIT tunnels work behind NAT?
Standard SIT requires a publicly accessible IPv4 address on at least one endpoint because raw IP protocol 41 lacks port numbers that traditional NAT gateways use for port mapping. If your host is behind a consumer NAT gateway, look for “DMZ” or “IP Protocol 41 passthrough” in router settings, or deploy an alternative encapsulation protocol such as GRE-over-UDP or WireGuard.
Can SIT be configured persistently in Netplan?
Yes. On Ubuntu and Debian systems using Netplan, you can declare SIT tunnels in /etc/netplan/ under the tunnels: block using mode: sit along with your local and remote IP addresses.