DS-Lite (Dual-Stack Lite)
Dual-Stack Lite (DS-Lite), defined in RFC 6333, lets an ISP deploy an IPv6-only access network while its customers still reach the IPv4 internet, without needing to hand out a public IPv4 address to every household at all. Each customer's router (the B4 element) tunnels its IPv4 traffic inside IPv6 packets across the ISP's IPv6-only network to a carrier-operated AFTR (Address Family Transition Router), which performs the actual NAT, translating that tunneled IPv4 traffic to a shared pool of public IPv4 addresses before it reaches the IPv4 internet. This is a different approach from CGNAT, which keeps the access network itself running IPv4 and shares addresses with ordinary NAT at the carrier edge; DS-Lite instead removes IPv4 from the access network entirely and tunnels it only where needed, over an IPv6-only path. It also solves a different problem than 464XLAT, which translates between address families for a client that itself only has IPv6 available; DS-Lite's B4 and AFTR exchange IPv4 packets over an IPv6 tunnel rather than translating the packets between protocols at all. Because every DS-Lite customer shares AFTR addresses the same way CGNAT customers share a NAT pool, it carries the same tradeoffs: shared blacklist exposure and no inbound reachability without an explicit port-mapping protocol.
By AdminKit team, Netbase JSC · Updated