IPv6 Network Services Filter

[atlantex]

After playing a bit with the system now I noticed the following issues:

- VPN server only listens on IPv4
- Local vpn server address pool is IPv4 only
- Connected vpn clients using IPv4 only - thats good, no bypass of IPv6 traffic by the browser
- Router itself is only via IPv4 accessable (web + ssh)

 

[atlantex]

The router uses this command to determine the IPv6 clients:

ip -f inet6 neigh show dev br0

Hi there,

IPv6 addresses are changing, even in stateful mode. Any way to fix them via manual configuration?

 

[mlai]

IPv6 firewalls on the ASUSWRT with dynamic DHCPv6-PD subnets has never been workable for me. So I just use a cheapo EdgerouterX as my main router, and use all the Asus routers as APs/Mesh units, which is a shame.......

EdgeOS has shown that implementing this is definitely possible.........

 

[Slawek P]

I’ve enabled IPv6 on Merlin and I see now that the GUI fields won’t accept IPv6 addresses. And further looking at the code, it’s not writing IPv6 rules like I thought since I don’t understand bitwise operations in C.

So maybe you can develop an IPv6 rule for ip6tables based on source MAC address and destination port, if you choose to run Merlin firmware.

Example to block one device from going to port 443/tcp:

ip6tables -I FORWARD -m mac --mac-source D0:D2:B0:AD:6D:1A -p tcp -m tcp --dport 443 -j logdrop

You would add that to the end of /jffs/scripts/firewall-start on Merlin.

Hi, I have found this thread appears relevant to me. DNSFilter ON with Global Filter Mode=Router appears to be working only for IPv4 DNS.

For example on Windows client the second line will stop working when filter on.

nslookup google.com 8.8.8.8
nslookup google.com 2001:4860:4860::8888

This indicates that filter is on indeed, but does not direct DNS call over IPv6 to router.
I have tried this with unbound and without, clearly some ip6table setting is required, please help...

 

[dave14305]

Hi, I have found this thread appears relevant to me. DNSFilter ON with Global Filter Mode=Router appears to be working only for IPv4 DNS.

For example on Windows client the second line will stop working when filter on.

nslookup google.com 8.8.8.8
nslookup google.com 2001:4860:4860::8888

This indicates that filter is on indeed, but does not direct DNS call over IPv6 to router.
I have tried this with unbound and without, clearly some ip6table setting is required, please help...

DNSFilter for IPv6 works by pushing the chosen DNS to the IPv6 clients over DHCP and using firewall rules to drop IPv6 traffic toward any other DNS IPv6 address. It doesn’t redirect DNS traffic like IPv4 can because there is no nat table for ip6tables.

So in your two nslookup examples, the first one will be silently redirected to the router, but the second one will be dropped by the firewall and fail.

 

[Slawek P]

DNSFilter for IPv6 works by pushing the chosen DNS to the IPv6 clients over DHCP and using firewall rules to drop IPv6 traffic toward any other DNS IPv6 address. It doesn’t redirect DNS traffic like IPv4 can because there is no nat table for ip6tables.

So in your two nslookup examples, the first one will be silently redirected to the router, but the second one will be dropped by the firewall and fail.

Yes indeed. With a timeout of 2s. Which matters for some apps that are strongly insisting on DHCPv6 they have hard wired.
Would there be a way to define nat able for ipv6 in Asuswrt 386 version perhaps or Merlin?

 

[ColinTaylor]

Yes indeed. With a timeout of 2s. Which matters for some apps that are strongly insisting on DHCPv6 they have hard wired.
Would there be a way to define nat able for ipv6 in Asuswrt 386 version perhaps or Merlin?

This is just a wild guess because my router doesn't have the necessary modules included. Your router may have them though.

As an experiment can you confirm that the following doesn't work?

ip6tables -t nat -I PREROUTING -p udp --dport 53 -j DNAT --to-destination 2620:fe::fe

Assuming it fails try this and then repeat the previous command:

insmod ip6table_nat

 

[dave14305]

This is just a wild guess because my router doesn't have the necessary modules included. Your router may have them though.

As an experiment can you confirm that the following doesn't work?

ip6tables -t nat -I PREROUTING -p udp --dport 53 -j DNAT --to-destination 2620:fe::fe

Assuming it fails try this and then repeat the previous command:

insmod ip6table_nat

Curse our ancient 2.6.26 kernels!

 

[Slawek P]

ip6tables -t nat -I PREROUTING -p udp --dport 53 -j DNAT --to-destination 2620:fe::fe

ip6tables v1.4.15: can't initialize ip6tables table `nat': Table does not exist (do you need to insmod?)

insmod ip6table_nat

insmod: can't insert 'ip6table_nat.ko': No such file or directory