How to open ipv6 firewall to a port on the router?

[John Tetreault]

My isp provides native ipv6 support and it's enabled. Ipv6 works as it should.

So let's say I run a web server, and I want to expose it via ipv6... That works, I put in my web servers ipv6 address and the port in the ipv6 firewall rules, and traffic is allowed through to that server... Perfect.

But here's the problem. What if I want to expose a port to a service I'm running ON THE ROUTER? For example... I want to contribute to the ntppool as a server.. I'm running chrony on the router through Entware and it is listening on my routers IPv6 address (ntpMerlin) so I want to allow traffic on port 123 to go to the router's ipv6 address of 2600:4041:3034:e500::1 (not my real address). If I put that forwarding rule in the IPv6 firewall, the traffic still isn't allowed through.... So it just refuses to open any port to the router's ipv6 address... But it happily opens ports to any other ipv6 address on my network.

Is there some trick to getting this to happen, or is it simply not possible?

I was thinking, perhaps if I could assign a 2nd ipv6 address to the br0 interface, I could forward to that address maybe and that might work, but I don't know how I can get br0 to pull a 2nd slaac address.

 

[John Tetreault]

My isp provides native ipv6 support and it's enabled. Ipv6 works as it should.

So let's say I run a web server, and I want to expose it via ipv6... That works, I put in my web servers ipv6 address and the port in the ipv6 firewall rules, and traffic is allowed through to that server... Perfect.

But here's the problem. What if I want to expose a port to a service I'm running ON THE ROUTER? For example... I want to contribute to the ntppool as a server.. I'm running chrony on the router through Entware and it is listening on my routers IPv6 address (ntpMerlin) so I want to allow traffic on port 123 to go to the router's ipv6 address of 2600:4041:3034:e500::1 (not my real address). If I put that forwarding rule in the IPv6 firewall, the traffic still isn't allowed through.... So it just refuses to open any port to the router's ipv6 address... But it happily opens ports to any other ipv6 address on my network.

Is there some trick to getting this to happen, or is it simply not possible?

I was thinking, perhaps if I could assign a 2nd ipv6 address to the br0 interface, I could forward to that address maybe and that might work, but I don't know how I can get br0 to pull a 2nd slaac address.

So, after much digging, I found the answer to my question.

Seems you CAN'T open a port to the router's IPv6 address from the IPv6 firewall in the web UI. I expect this may have something to do with the fact that rules added there are added to the FORWARD chain in ip6tables, and when its the router's own IP address it simply ignores them (ip6tables -L doesn't show the rule at all, even though it appears on the web UI if its to the router's own ipv6 address)

However, I found I could open a port by adding a line to /jffs/scripts/firewall-start to open the ports in the INPUT chain.

#Open port for ipv6 Tor relay
ip6tables -I INPUT -p tcp --dport 9001 -s ::/0 -d 2600:4041:3034:e500::1/128 -j ACCEPT
#open port for ipv6 ntp server
ip6tables -I INPUT -p udp --dport 123 -s ::/0 -d 2600:4041:3034:e500::1/128 -j ACCEPT

 

[dave14305]

I want to contribute to the ntppool as a server

Is that a good idea when your router doesn’t have a reliable clock (i.e. no battery backup, resets to 2018 during a reboot, etc.)?

 

[John Tetreault]

Is that a good idea when your router doesn’t have a reliable clock (i.e. no battery backup, resets to 2018 during a reboot, etc.)?

sure.... when you've got a USB gps plugged into it.... Chrony gets its time reference from the GPS, so by the time the router is actually responding to any ntp pool requests its got a stratum 1 time source.

 

[sfx2000]

Is that a good idea when your router doesn’t have a reliable clock (i.e. no battery backup, resets to 2018 during a reboot, etc.)?

Not a problem if one has a reliable upstream NTP pool - one just drops a level down on the stratum...