ip6tables mangle does not do anything

[vesati]

I'm somewhat new at this, but I am needing to adjust the TTL/HL on IPv4 and IPv6 traffic passing through my router.

For context, the router is an Asus RT-AX86U Pro running Merlin firmware version 388.2_2.

I have enabled custom scripts, and then used Putty to access the firewall over SSH.

I navigate to /jffs/scripts and have created a firewall-start script with the following:
#!/bin/sh
iptables -t mangle -I POSTROUTING -j TTL --ttl-set 64
iptables -t mangle -I PREROUTING -j TTL --ttl-set 64
ip6tables -t mangle -I POSTROUTING -j HL --hl-set 64
ip6tables -t mangle -I PREROUTING -j HL --hl-set 64

For IPv4 traffic, it seems to work as expected.
Reply from 192.168.20.1: bytes=32 time<1ms TTL=64

But it doesn't seem to work as expected for IPv6 traffic.
Reply from fe80::a236:bcff:feb3:b8d8: time=1ms

Can anyone please advise on what I might be doing wrong that is causing this result?

 

[dave14305]

How do you know it’s not working? Are there any hits on the rule?

 

[vesati]

How do you know it’s not working? Are there any hits on the rule?

I don't how to check for hits to the rule, but I can see that it isn't working for IPv6 when I ping the firewall and get a TTL value different from what I have set through iptables in the firewall.

The ping command to the IPv6 address of the firewall doesn't return a TTL or HL value, so I took that to mean that it isn't being modified as expected.

Is there a better way to confirm that?

 

[dave14305]

I don't how to check for hits to the rule

Run:

ip6tables -t mangle -nvL

Note the documentation on hoplimit:

HL (IPv6-specific)​

This is used to modify the Hop Limit field in IPv6 header. The Hop Limit field is similar to what is known as TTL value in IPv4. Setting or incrementing the Hop Limit field can potentially be very dangerous, so it should be avoided at any cost. This target is only valid in mangle table.

Don't ever set or increment the value on packets that leave your local network!

--hl-set valueSet the Hop Limit to `value'.
--hl-dec valueDecrement the Hop Limit `value' times.
--hl-inc valueIncrement the Hop Limit `value' times.