# Pivoting and routes

### Adding routes

**Using IP:** 

`# /sbin/ip -6 route add <ipv6network>/<prefixlength> dev <device>`&#x20;

Example:&#x20;

`# /sbin/ip -6 route add default dev eth0 metric 1`&#x20;

or

`# /sbin/ip -6 route add <ipv6> via 2001:0db8:0:f101::1`&#x20;

Metric ”1” is used here to be compatible with the metric used by route, because the default metric on using ”ip” is ”1024”.&#x20;

**Using "route"**:&#x20;

Usage:&#x20;

`# /sbin/route -A inet6 add <ipv6network>/<prefixlength> dev <device>`&#x20;

Example:&#x20;

`# /sbin/route -A inet6 add default dev eth0` &#x20;

### Removing routes

Removing an IPv6 route through an interface&#x20;

Not so often needed to use by hand, configuration scripts will use such on shutdown.&#x20;

**Using "ip"**&#x20;

Usage:&#x20;

`# /sbin/ip -6 route del <ipv6network>/<prefixlength> dev <device>` \
&#x20;Example:&#x20;

`# /sbin/ip -6 route del default dev eth0` &#x20;

**Using "route"**&#x20;

Usage:&#x20;

`# /sbin/route -A inet6 del <network>/<prefixlength> dev <device>`&#x20;

Example:&#x20;

`# /sbin/route -A inet6 del default dev eth0`

### Port-forwarding from IPv6 -> IPv4&#x20;

socat port-forwarding&#x20;

`socat TCP4-LISTEN:8080,reuseaddr,fork TCP6:[fe80::20c:29ff:fe69:c4e5%eth0]:80`&#x20;

\- you can then browse to 127.0.0.1:8080 and reach the IPv6 host on port 80&#x20;

### SSH local port-forwarding&#x20;

`ssh -6 user@fe80::cdf3:42e1:63d8:5227 -L 80:[fe80::20c:29ff:fe69:c4e5%ens33]:80`&#x20;

\- After this, connecting to \[::1]:80 will actually connect to the service on fe80::20c:29ff:fe69:c4e5 on port 80 dynamic port-forwarding&#x20;

`ssh -6 -D 9010 user@fe80::cdf3:42e1:63d8:5227` &#x20;

\- change your proxychains.conf file to point to socks5 ::1 9010&#x20;

After this, prefix all your commands with proxychains:&#x20;

`./proxychains4 -f src/proxychains.conf nmap -sT -p21,80,445,1433,3389 -n -Pn fe80::3c0c:8c8f:6abd:93ae%ens33`&#x20;

quick port scanner through proxychains&#x20;

`while read -r line; do timeout 0.2s ./proxychains4 -f src/proxychains.conf ncat -6 -w1 -z fe80::cdf3:42e1:63d8:5227%ens33 $line 2>&1 | grep OK;done < ports.txt`&#x20;

where ports.txt has port numbers line by line &#x20;

Accessing RDP through the proxychains:&#x20;

`./proxychains4 -f src/proxychains.conf rdesktop fe80::cdf3:42e1:63d8:5227%ens33` &#x20;