Written by Glen Kratochvil

Last Updated: 07 April 2020

I made this guide to show everyone how easy it is to get IPv6 working for free on your home or small business network using only a free account with TunnelBroker (Hurricane Electric) and an IPv6 enabled Router.

The Problem

As you may already be aware, the world is running out of IPv4 addresses and IPv6 solves this problem because it allows for dramatically more IP addresses to be created.  Despite its benefits, many internet service providers are slow to adopt IPv6 in their networks. When I called my ISP and asked about IPv6 they let me know that they had no immediate plans to implement IPv6. Frustrated, I scoured the internet to find out how I could do this on my own. There are several pages that describe how to implement IPv6 but many of them are outdated or didn’t quite accomplish what I wanted to. Those that did exist did not account for users whose ISPs provided dynamic or changing IP addresses.

It is my goal to share with you a reliable way to get IPv6 working on your network for all devices that connect to your router. The tunnel will remain up and automatically update your IP address every time your public IP address changes. Please leave me a comment if I forgot a step or didn’t explain it well enough and I will try to improve this guide.

Project Requirements

• Computer with which to configure the router and tunnel
• IPv6 router (Synology RT2600ac https://amzn.to/39i7shI works well)
• A free account with https://tunnelbroker.net/
  
  

I have only configured these tunnels using the Synology RT2600ac router which I find to be a very stable router for home and office use. I recommend it to friends and customers whenever they ask for a recommendation about which router to buy. These steps should also work with other IPv6 routers which allow tunneling but since I haven’t used them, I can’t go into great detail on their setup. As an Amazon Associate, I earn a referral fee when people purchase products through my referral links.

Getting Started

Create your tunnel

You will need to provide Hurricane Electric with your contact information and choose a username and password. Obviously we are assuming that you are using your IPv6 tunnel for good reasons; do not plan on using it for illegal things because Hurricane Electric knows who you are and can drop the hammer on you if you try to do something stupid.

From the User Functions menu on the left, choose Create Regular Tunnel.

Copy the IP address next to You are viewing from and paste it in the box for the IPv4 Endpoint (Your side).

If all went well, you will be taken to a new screen which will display the settings for your new IPv6 tunnel.

In order to get DNS working properly, I always click Edit under the rDNS Delegations section and then choose Delegate to dns.he.net. On this page you can also enter a Description for your tunnel to differentiate it from others if you plan to use more than one tunnel.

Your tunnel is now created and operational on TunnelBroker.net.

The next step is to configure your Synology Router to connect to it. Please keep the TunnelBroker.net tab open because you will need these settings while configuring your router.

Configure the Tunnel on your Router

The DSM is Synology’s management interface where you configure all connection and network settings for the router. I will assume that you at least understand the basics of configuring your router if you have made it this far; if you have not please check with Synology resources online because they have an abundance of information on how to configure your router. This guide will include just the specifics of how to get your IPv6 tunnel configured.

I have removed personal information specific to my networks from the following images.

Proceed to enter the rest of your settings from TunnelBroker as described below the next image.

What information goes in which field, you ask?

Where Synology DSM asks for a Preferred DNS Server,
 enter what TunnelBroker calls the Anycast IPv6 Caching Nameserver

Where Synology DSM asks for an IPv6 address, 
 enter what TunnelBroker calls the Client IPv6 Address

Synology DSM asks for a Prefix length. Use 64 for this value.

Where Synology DSM asks for a Prefix,
 enter what Tunnelbroker calls the Routed IPv6 Prefixes → Routed /64
This prefix should end with :: and /64 as pictured above

Where Synology DSM asks for an Remote server IPv4 address,
 enter what Tunnelbroker calls the Server IPv4 Address

Check the Set as default gateway box and choose OK

Check the box next to Enable IPv6 and select your IPv6 network’s Prefix from the drop down menu. To let devices on your network configure their own IPv6 addresses on your network select the radio box next to Stateless DHCPv6 mode and click Apply. (I cannot fully explain the difference between the Stateless, Stateless DHCPv6, and Stateful modes, but you may also use one of those modes if it better describes what you are trying to accomplish.)

Create a Firewall Rule to enable ICMP traffic

In order for your Tunnel to connect and stay up, your network must be ping-able from Hurricane Electric. This means that you must create a firewall rule to allow ICMP traffic from Hurricane Electric.  By default, your Synology router's firewall will drop all ICMP traffic, but we need to create an exception which will allow Hurricane Electric to verify that your IP address is correct. To set this up, enter the Security tab of your Network Center and then click on the Firewall tab. 

1. Click Create to create a new firewall rule
2. Give the rule a meaningful name such as “AllowHurricaneElectric”
3. From Protocol, select ICMP
4. From Source IP Address, choose Specific IP and then click Select
5. Enter Hurricane Electric’s IP address: 66.220.2.74 and press OK
6. Make sure the rule is set to Allow and click OK to create the rule

You may now switch back over to the Status tab of the Network Center and choose IPv6 under Internet Connection.

If all went well, you should now see that your IPv6 tunnel is Connected.

Once your IPv6 connection shows as Connected, any devices connected to your router should be able to connect to the internet using IPv6. To test this, please open the test page at http://ipv6-test.com/ to test that your IPv6 is working.

Once you have made it this far, IPv6 is working correctly on your network. All of your computers, mobile phones, and other devices which support IPv6 will now be able to use IPv6 on your network. Now is a great time to take a break if you need one.  In the next section, I will show you how you can quickly keep your IP address updated on your IPv6 tunnel so that your network doesn't go offline the next time your ISP changes your public IP address.

Keeping Your IPv4 address up-to-date

I used my tunnel in this way for a year or two without many problems. The only thing that would come up every few months is that my IPv6 tunnel would stop working every time my ISP changed my public IPv4 address. When that happened, I needed to go to TunnelBroker.net and update my Client IPv4 address in the tunnel for it to resume working. To update this manually, log into TunnelBroker.net and click on your tunnel to open up its details. Then click on your former IP address next to Client IPv4 address to update it to your current IPv4 address.

Updating the IP address manually works well enough if your ISP changes your IP address pretty infrequently. If this happens weekly or monthly, it becomes frustrating pretty quickly. Fortunately, Hurricane Electric gives you a powerful tool to update the IP address automatically but it does require some configuration.

From the Tunnel Details page, switch to the Advanced tab and you will see your details which look similar to mine below.

Copy the Example Update URL from the Advanced tab and save this on your desktop as a shortcut or as a bookmark in Firefox or Chome (Internet Explorer and Edge are not smart enough to follow these links). The Update URL contains your account ID, your update key, and your tunnel information. When you click on that link, it updates your tunnel with your current IP address. This saves you the step of having to log into TunnelBroker.net and manually update it there.

When you click on it and visit the update page, you will see a simple message which shows whether your IP address was updated (“good”) or was not updated (“nochg”).

Remember, your IPv6 tunnel is now working correctly and if you want to stop, you may do so. Don’t forget that whenever you lose IPv6 connectivity, it probably means that your ISP changed your router’s public IP address and you need to click on your bookmark or shortcut to update the IP address on TunnelBroker.

Automatically Update your dynamic IPv4 address

At this point we are really close to having a stable and reliable IPv6 tunnel, but I wanted a solution that would completely automate the process of updating my DHCP IP address on TunnelBroker. In the end, I settled on using a simple 3rd-party tool named GNU Wget to tie it all together. 

What we are going to do next is create a scheduled task to run once every hour on a computer located on your home or office network which calls the Update URL from above and updates your IP address. This way, every time your ISP changes your IP address, the scheduled task will promptly (within 1 hour) update the address on your tunnel without any intervention from you.

If anyone can figure out a way to do this using native Windows tools *without* installing GNU Wget please let me know and I will update this guide to keep it simple.

For these next steps, it is important that you perform them on a desktop computer or a computer that does not leave your home or office. Don’t install the Scheduled Task on a laptop or a portable computer. If you do, you will break your IPv6 tunnel every time you take it to another network since it will incorrectly update your tunnel’s IP address to match someone else’s network.

1. Download the .zip for the 32-bit version of GNU Wget from https://eternallybored.org/misc/wget/
2. Extract the file wget.exe from the .zip and save it some place simple such as C:\Windows\system32
3. Open Task Scheduler on your Windows computer and click Create Task
4. Give the task a Name and check the box to Run whether user is logged in or not
5. On the Triggers tab, choose New and then check the box to Repeat Task Every Hour Indefinitely and click OK
6. On the Actions tab, choose New and then Start a program. Now Browse to the folder where you extracted Wget.exe and then click Open. 
7. In the box labeled Add arguments (optional): enter the following information and then click OK (replace the Update URL with your own URL from earlier)

-O C:\temp\update.txt https://akguy:[email protected]/nic/update?hostname=422229 --no-check-certificate

8. Click OK again and enter the login password for your Windows Account to allow the task to run automatically even if you are not logged in.

9. Your task is now created and will run on the schedule you set up. You may also run the task on demand when you need to or if you want to make sure it is working

That’s the last task. Your IPv6 tunnel is now fully configured and the Scheduled Task will keep TunnelBroker.net updated any time your public IPv4 address changes.

Please let me know if you have any questions or if you have any comments about the implementation.

References:

IPv6 with Synology RT2600ac via HE tunnel
https://ausfestivus.wordpress.com/2017/12/31/ipv6-with-synology-rt2600ac-via-he-tunnel/

GNU Wget 1.20.3 for Windows
https://eternallybored.org/misc/wget/

Written by Glen Kratochvil

Last Updated: 04 April 2020

Speed up Your Computer with a Solid State Hard Drive

Solid state hard drives (SSDs) are a newer type of hard drive which use flash memory instead of a spinning platter to store information.  With no moving parts and very fast read and write times, they use less power and break less frequently than regular hard drives do.  Though still somewhat more expensive than mechanical hard drives, the price of SSDs has dropped dramatically in recent years and now is a very good time to upgrade to an SSD.

Do yourself a favor and pick up a new solid state drive from Amazon.com. Then contact us for expert installation when it arrives.  In most cases, it is pretty straightforward for us to clone (copy) your existing Windows installation, programs, iTunes, pictures, and all onto your new drive in a short amount of time and this will be the best upgrade you have ever done to speed up your computer.  Your bank account will thank you, too!

Step 1: Purchase a Solid State Hard Drive to Upgrade Your Computer:

Step 2: Contact Us to Schedule Your Hard Drive Installation

You really can't go wrong with either of these hard drives or pretty much any other SSD you find and you'll be blown away by the performance increase you experience.  Our fee for installing the hard drive and cloning your existing hard drive will typically not exceed $100 unless we need to reinstall Windows and transfer your data manually.

Written by Glen Kratochvil

Last Updated: 07 April 2020

Cloud services such as Dropbox and Google Drive permit users to backup their data and synchronize it across different devices (such as laptops, desktops, mobile phones, etc) using cloud storage technology that resides on servers controlled by those entities.  While a great solution for many users, others are apprehensive or skeptical to entrust their private data to third parties.  Fortunately, it is possible to enjoy the benefits and convenience of cloud storage while maintaining the security and complete privacy of your data by encrypting all of your data before it leaves your computer.

There are several different third-party encryption utilities that you can use to accomplish the same thing, but of those I have tested Cryptomator is the best and easiest to work with. Cryptomator is an open-source project which means that it's source code is open to review and that makes it easy for users to know that it doesn't have back-doors or exploits built into it.  Cryptomator works by encrypting files on your computer before they are sent to the cloud.  This gives Dropbox and Google zero knowledge of what is contained in your files.  Since your data is encrypted before leaving your computer, it is only stored in its encrypted form on the cloud service's servers.  In the event that your cloud provider's security is compromised or your login credentials stolen, no one will be able to access your encrypted data without the encryption key you used to secure them.

Here is how you can do so in a few simple steps without the need to purchase anything.

Step 1: Download & install Dropbox (or Google Drive)

• Create your cloud account at the service of your choice (Dropbox, Google Drive, Microsoft OneDrive, Box, etc)
• Download and install their cloud storage software on your computer (if you do not already have it installed)
• Create some test files or folders and make yourself familiar with the directory structure and how to save files

Step 2: Download and install Cryptomator

• Visit Cryptomator.org and download the Windows software installation package
• Make a donation if you want to, or set donation to "0" and continue to the download
• Install the software using default options, and let it open after installation is complete

Step 3: Create an Encrypted Vault in Cryptomator

• Launch Cryptomator (if it is not already open)
• Click the PLUS (+) sign and choose "Create New Vault"
• In the explorer, navigate to the root Dropbox folder (or other cloud folder)
• Type a name for your encrypted vault, and click "save"
• Enter a password twice (write down or print the password and keep it very safe) and choose "create vault"
• Your vault is now created and ready to use

Step 4: Use your Encrypted Vault

• With Cryptomator open, select your vault from the list and enter the password, then click "Unlock Vault"
• Cryptomator will now mount your encrypted folder and you can use it as you would any other folder
• Files saved in the encrypted vault (folder) will be encrypted before being uploaded to the cloud
• To encrypt files that are already in your Dropbox, move them from a regular folder to the encrypted vault
• When you finish working on the files, you need to choose "Lock Vault" to close your encrypted session
• In my example (below), I moved files I wanted encrypted from my regular "Payroll" folder to my Vault

The above image shows the regular, unencrypted folder as it appeared in the local Dropbox folder.  After moving the files to the encrypted vault we created, you can see how even the filenames are encrypted (image below).

If you followed the steps in this guide correctly, you now have an encrypted folder full of files stored in the cloud that can only be accessed by you, even if your Dropbox or cloud account is compromised. You are now able to have peace of mind while enjoying the benefits of using your cloud account to backup or collaboration. If you look at your encrypted vault folder on Dropbox's web portal you will see that the files are completely encrypted and reveal nothing (other than file size) about what is contained in the files.  This is ideal for anyone who wants secure and encrypted cloud storage.  I can't stress enough how important it is to have a secure backup of your password or encryption key.  You should keep this printed out in a secure or locked place in case you are forgetful or cannot remember the password you used to encrypt the folder.

Cryptomator has several advanced options that you can configure if you want to take advantage of them.  Since I find it most useful to use an incredibly complicated password that would be impossible to type each time, I use the option to "save password" and "auto-unlock on start" and then use a 40 or 50 character complex password which I store in a password manager on each of my computers.  This affords optimal encryption for data stored on the cloud but keeps it easy enough to use on each of my computers.

You should not use these options on a public computer or one that you share with another person because it would defeat the purpose of encryption if you set it to automatically unlock in those cases.

There you have it.  Free, encrypted cloud storage.  If you found this article useful, please share it or tell your friends!  Everyone is safer when we all practice good security.

Written by Glen Kratochvil

Last Updated: 02 April 2020

1. Backup your data to an external hard drive to be extra safe (you can skip this step at your peril).
2. Create a bootable Windows 10 Installation USB key using Microsoft's link and directions at the following link (choose Download Tool Now and run it): https://www.microsoft.com/en-us/software-download/windows10
3. Start the Setup.exe file on the USB flash drive you created in step 2.  Do this on your computer while Windows is running.  Do not boot from the USB flash drive; if you do so your only option will be to erase Windows and start from scratch.  You have to start the file from within Windows if you want to upgrade your existing computer.
4. Follow the prompts, choose to keep your existing data, and let the process complete.  It may take an hour or more to do this, but when you're finished the computer will reboot and welcome you to your fresh, squeaky clean Windows installation and your computer will be all set to use.