ASUS WRT - Merlin - IPv6

[SteveM]

Hi.

I've been playing with IPv6.

My Mac OS has an IPv6 assigned with the correct prefix.

However, from the public internet I can ping6 that address and get a reply.

Is this normal behaviour - In that the router is replying for everything that has an IPv6 address prefixed correctly?

Or is traffic being routed from the public internet directly to the Mac OS device? If this is so, how do I protect devices internal to the network from the public network?

 

[Tech9]

You can start with disabling IPv6 if you don’t need IPv6.

 

[L&LD]

What router and firmware are you using, specifically?

How are you testing 'from the public internet'?

Is the reply from your Mac, or from the router?

How did you set up your router? Did you import an old backup config file? Or, did you minimally and manually configure the router to secure it and connect to your ISP?

What options, features, and scripts are you using past the defaults?

 

[ColinTaylor]

Or is traffic being routed from the public internet directly to the Mac OS device? If this is so, how do I protect devices internal to the network from the public network?

IPv6 traffic is routed (not NATed) therefore it will be your Mac that is responding to the ping. ICMPv6 Echo Requests are a requirement of the IPv6 protocol and should not be blocked by the router. That does not mean however that other unsolicited traffic will reach your clients as that will be blocked by the router's firewall (in addition to your clients' own firewall rules).

 

[heysoundude]

Please take some time and go to ipv6.he.net/certification and take as many levels of their free course as you deem necessary if you choose to continue "playing"

 

[RMerlin]

Ping must not be blocked by the firewall with IPv6, this is stated in an RFC about which ICMP should be allowed by an IPv6 firewall.

 

[sfx2000]

You can start with disabling IPv6 if you don’t need IPv6.

That is not really an answer is it?

 

[RandomUser777]

That is not really an answer is it?

It is the best answer to the question:

If this is so, how do I protect devices internal to the network from the public network?

 

[ColinTaylor]

It is the best answer to the question:

It would be, but that wasn't the question. The question when read in context was: When using IPv6 how do I protect devices internal to the network from the public network?

 

[heysoundude]

That is not really an answer is it?

Well, that member is pretty anti-v6 when it comes to SOHO users and the routers discussed within these fora. They and I have crossed virtual swords on this for a while now.

They're possibly correct, but I resent and reject the gatekeeper-ishness.

 

[Tech9]

That is not really an answer is it?

This is exact answer when you play with settings on an RGB marketing device which had exposed to Internet IPv6 connected clients not long ago. It was discovered by accident by a forum member, confirmed by a developer and perhaps relayed upstream and I was the only one to post a warning in corresponding Asuswrt release thread. How many users playing with settings worldwide were exposed is unknown. And because we are on an Asus fans forum it was swept under the carpet quickly as not a big deal. Just saying... your style. At least 3 of the people who liked your comment had no clue.

So playing with settings on this device - only if you can check what the result is. Otherwise - default Disabled.

that member is pretty anti-v6 when it comes to SOHO users

See why above. Your HE won't help. I would trust more GL.iNet device than Asus. At least I know @sfx2000 has some involvement there.

 

[SteveM]

To clarify a few points:

Router is RT-AX58U
Firmware: 388.2_2 (Merlin)

Tested ping from public internet - Receives a Ping response from an Amazon AWS EC2 instance.

I'm unsure where the ping response come from - But further information on this thread suggests it's from the Mac.

Router is comprehensively and securely set up from an IPv4 perspective and effectively have been that way for many years.. IPv6 settings are:

Connection Type : Native
Interface : PPP
DHCP - PD : Yes
Accept Default Route : Yes
Release Prefix on Exit : Yes
IPv6 LAN : Stateless
Connect to IPv6 DNS Automatically : Yes
Enable Router Advertisement : Yes

I will continue on the basis that there is a good reason Ping Requests are being answered and I will investigate further regarding being able to connect to specific ports.

 

[SteveM]

Investigations complete - Ports are not routed to the Mac from the public internet.

The Mac is answering the pings (Setting Firewall Stealth Mode on the Mac prevents the ping being answered)

 

[SteveM]

You can start with disabling IPv6 if you don’t need IPv6.

I do.