IPv6 Support

Quote:

Originally Posted by wpte

after I added the line

Code:

-A INPUT -d 2001:470:1f14:31e::2/128 -i sixtun -p tcp -m tcp --dport 80 -j ACCEPT

everything goes open:confused:
what do you use to open up ports then?

you should open it with

Code:

ip6tables -A INPUT -d 2001:470:1f14:31e::2/128 -i sixtun -p tcp -m tcp --dport 80 -j ACCEPT

and not to forget about (in case of lighttpd)

Code:

server.use-ipv6 = "enable"

Quote:

Originally Posted by theMIROn

and not to forget about (in case of lighttpd)

Code:

server.use-ipv6 = "enable"

yes I enabled that:p
hmmm still odd with the mixed results from the he portscanner.. only online working ipv6 portscanner as far as I can see:confused:

Quote:

Originally Posted by wpte

yes I enabled that:p
hmmm still odd with the mixed results from the he portscanner.. only online working ipv6 portscanner as far as I can see:confused:

i'm able ping you, and you http is working for now. test completed

Quote:

Originally Posted by theMIROn

i'm able ping you, and you http is working for now. test completed

yes but the rest is open as well:p

With r821 introduced new ipv6 rules in more flexible way.
Some of rules are auto generated depending on connection type (in my case lanif=br0, manif=vlan1, wanif=ppp0), services enabled (ssh port, ftp port)
Security chain isn't used yet, logaccept/logdrop chains will be used after turning packet logging on

Code:

*filter :INPUT ACCEPT [0:0] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [0:0] :SECURITY - [0:0] :logaccept - [0:0] :logdrop - [0:0] -A INPUT -m rt --rt-type 0 -j DROP -A INPUT -i lo -j ACCEPT -A INPUT -i <lanif> -j ACCEPT -A INPUT -p ipv6-icmp -j ACCEPT -A INPUT -s fe80::/10 -j ACCEPT -A INPUT -s ff00::/8 -j ACCEPT -A INPUT -p tcp -m tcp --dport <ssh port> -j ACCEPT -A INPUT -p tcp -m tcp --dport <ftp port> -j ACCEPT -A INPUT -j DROP -A FORWARD -m rt --rt-type 0 -j DROP -A FORWARD -i <lanif> -o <lanif> -j ACCEPT -A FORWARD -p ipv6-icmp -j ACCEPT -A FORWARD -s fe80::/10 -j ACCEPT -A FORWARD -s ff00::/8 -j ACCEPT -A FORWARD -i ! br0 -o sixtun -j DROP -A FORWARD -i ! br0 -o <wanif> -j DROP -A FORWARD -i ! br0 -o <manif> -j DROP -A OUTPUT -m rt --rt-type 0 -j DROP -A SECURITY -p tcp -m tcp --tcp-flags SYN,RST,ACK SYN -m limit --limit 1/sec -j RETURN -A SECURITY -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK RST -m limit --limit 1/sec -j RETURN -A SECURITY -p udp -m limit --limit 5/sec -j RETURN -A SECURITY -p icmp -m limit --limit 5/sec -j RETURN -A SECURITY -j DROP -A logaccept -j LOG --log-prefix "ACCEPT " --log-tcp-sequence --log-tcp-options --log-ip-options -A logaccept -j ACCEPT -A logdrop -j LOG --log-prefix "DROP " --log-tcp-sequence --log-tcp-options --log-ip-options -A logdrop -j DROP COMMIT

good stuff... compiling it now

I had about the same script as that, only it was working half:p

Quote:

Originally Posted by wpte

good stuff... compiling it now

I had about the same script as that, only it was working half:p

can't seem to open up port 80 anymore with both

Quote:

ip6tables -A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
ip6tables -A INPUT -d 2001:470:1f14:31e::2/128 -i sixtun -p tcp -m tcp --dport 80 -j ACCEPT

ftp seems to be open tho...:p

PHP Code:

# Generated by ip6tables-save v1.3.8 on Wed Nov 18 00:09:58 2009 *mangle :PREROUTING ACCEPT [5823:1448054] :INPUT ACCEPT [4022:326204] :FORWARD ACCEPT [1276:988388] :OUTPUT ACCEPT [165:20009] :POSTROUTING ACCEPT [1443:1008589] COMMIT # Completed on Wed Nov 18 00:09:58 2009 # Generated by ip6tables-save v1.3.8 on Wed Nov 18 00:09:58 2009 *filter :INPUT ACCEPT [0:0] :FORWARD ACCEPT [1276:988388] :OUTPUT ACCEPT [154:19053] :SECURITY - [0:0] :logaccept - [0:0] :logdrop - [0:0] -A INPUT -m rt --rt-type 0 -j DROP -A INPUT -i lo -j ACCEPT -A INPUT -i br0 -j ACCEPT -A INPUT -p ipv6-icmp -j ACCEPT -A INPUT -s fe80::/10 -j ACCEPT -A INPUT -s ff00::/8 -j ACCEPT -A INPUT -p tcp -m tcp --dport 21 -j ACCEPT -A INPUT -j DROP -A INPUT -d 2001:470:1f14:31e::2/128 -i sixtun -p tcp -m tcp --dport 80 -j ACCEPT -A INPUT -p tcp -m tcp --dport 80 -j ACCEPT -A FORWARD -m rt --rt-type 0 -j DROP -A FORWARD -i br0 -o br0 -j ACCEPT -A FORWARD -p ipv6-icmp -j ACCEPT -A FORWARD -s fe80::/10 -j ACCEPT -A FORWARD -s ff00::/8 -j ACCEPT -A FORWARD -i ! br0 -o sixtun -j DROP -A FORWARD -i ! br0 -o eth1 -j DROP -A OUTPUT -m rt --rt-type 0 -j DROP -A SECURITY -p tcp -m tcp --tcp-flags SYN,RST,ACK SYN -m limit --limit 1/sec -j RETURN -A SECURITY -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK RST -m limit --limit 1/sec -j RETURN -A SECURITY -p udp -m limit --limit 5/sec -j RETURN -A SECURITY -p icmp -m limit --limit 5/sec -j RETURN -A SECURITY -j DROP -A logaccept -j LOG --log-prefix "ACCEPT " --log-tcp-sequence --log-tcp-options --log-ip-options -A logaccept -j ACCEPT -A logdrop -j LOG --log-prefix "DROP " --log-tcp-sequence --log-tcp-options --log-ip-options -A logdrop -j DROP COMMIT # Completed on Wed Nov 18 00:09:58 2009

Code:

-A INPUT -j DROP -A INPUT -d 2001:470:1f14:31e::2/128 -i sixtun -p tcp -m tcp --dport 80 -j ACCEPT -A INPUT -p tcp -m tcp --dport 80 -j ACCEPT

take a more closely look at ruleset.
everything in input chain will drop like it goes tith ipv4 filter table
the main reason - to implement logdrop action, coz chain policy doesn't support anything besides accept and drop only.
so you need post-firewall stuff like following

Code:

# set default input rule iptables -P INPUT DROP ip6tables -P INPUT DROP # remove last default rule (i don't use logdrop) iptables -D INPUT -j DROP ip6tables -D INPUT -j DROP # allow http access iptables -A INPUT -p tcp -m tcp --dport 80 -j ACCEPT ip6tables -A INPUT -p tcp -m tcp --dport 80 -j ACCEPT

that does kill your ipv6 tunnel you know...:rolleyes:

Routing /64 prefix

Good evening. I'm lucky to have native Ipv6 address provided on physical vlan1 interface by provider 2001.x.x.x/64 (while ipv4 goes through PPTP). I've set a static ipv6 address on vlan1 and set up default route, so from router i can reach ipv6 hosts w/o any problem. Also I've set another ipv6 address from /64 prefix on my br0 interface + set up radvd with /64 prefix (can't use /80, cause i gives an error). After that i flushed all ip6tables rules and made iptable -A INPUT -p ipv6 -i vlan1 -j accept (just in case). Now i have global addresses provided in my wireless network, and i can ping computers in a network and router with ping6. But still i can't traceroute6 from my local network to ipv6 hosts (only does 1 step to br0 ipv6 address i've assigned for router and then stops) and i also can't traceroute6 from my router to local network (strange, just doesn't jump at all). Would you please give me a hand setting this configuration. Thank you

since my wl-500w is back up running again I tried to use ipv6 in r1000

ping6 works properly on the router
but all the computers inside my network can't browse the internet however they do receive an ipv6 adress from the router.
I think the range from the local ip's are not set properly yet

I have the basic firewall now:

Code:

Chain INPUT (policy ACCEPT) target prot opt source destination DROP all anywhere anywhere rt type:0 ACCEPT all anywhere anywhere ACCEPT all anywhere anywhere ACCEPT ipv6-icmp anywhere anywhere ACCEPT all fe80::/10 anywhere ACCEPT all ff00::/8 anywhere ACCEPT tcp anywhere anywhere tcp dpt:ftp DROP all anywhere anywhere Chain FORWARD (policy ACCEPT) target prot opt source destination DROP all anywhere anywhere rt type:0 ACCEPT all anywhere anywhere ACCEPT ipv6-icmp anywhere anywhere ACCEPT all fe80::/10 anywhere ACCEPT all ff00::/8 anywhere DROP all anywhere anywhere DROP all anywhere anywhere Chain OUTPUT (policy ACCEPT) target prot opt source destination DROP all anywhere anywhere rt type:0 Chain SECURITY (0 references) target prot opt source destination RETURN tcp anywhere anywhere tcp flags:SYN,RST,ACK/SYN limit: avg 1/sec burst 5 RETURN tcp anywhere anywhere tcp flags:FIN,SYN,RST,ACK/RST limit: avg 1/sec burst 5 RETURN udp anywhere anywhere limit: avg 5/sec burst 5 RETURN icmp anywhere anywhere limit: avg 5/sec burst 5 DROP all anywhere anywhere Chain logaccept (0 references) target prot opt source destination LOG all anywhere anywhere LOG level warning tcp-sequence tcp-options ip-options prefix `ACCEPT ' ACCEPT all anywhere anywhere Chain logdrop (0 references) target prot opt source destination LOG all anywhere anywhere LOG level warning tcp-sequence tcp-options ip-options prefix `DROP ' DROP all anywhere anywhere

so I've used some tables from my old home made script:)

PHP Code:

# Get global, link and wan adresses GLOBALSCOPE=`ifconfig sixtun | grep 'Scope:Global' | awk '{print $3}'` LINKSCOPE=`ifconfig sixtun | grep 'Scope:Link' | awk '{print $3}'` WANIF=`echo $GLOBALSCOPE | cut -f1 -d/` #Allow local traffic #includes loopback and local adresses ip6tables -A INPUT -i lo -j ACCEPT ip6tables -A OUTPUT -o lo -j ACCEPT #link-local ip6tables -A INPUT -s $LINKSCOPE -j ACCEPT ip6tables -A OUTPUT -s $LINKSCOPE -j ACCEPT

and now I'm able to browse ipv6 sites on my clients:)

The changes in the list: (-- is added)

Code:

Chain INPUT (policy ACCEPT) target prot opt source destination DROP all anywhere anywhere rt type:0 ACCEPT all anywhere anywhere ACCEPT all anywhere anywhere ACCEPT ipv6-icmp anywhere anywhere ACCEPT all fe80::/10 anywhere ACCEPT all ff00::/8 anywhere ACCEPT tcp anywhere anywhere tcp dpt:ftp DROP all anywhere anywhere --ACCEPT all anywhere anywhere --ACCEPT all fe80::/64 anywhere Chain FORWARD (policy ACCEPT) target prot opt source destination DROP all anywhere anywhere rt type:0 ACCEPT all anywhere anywhere ACCEPT ipv6-icmp anywhere anywhere ACCEPT all fe80::/10 anywhere ACCEPT all ff00::/8 anywhere DROP all anywhere anywhere DROP all anywhere anywhere Chain OUTPUT (policy ACCEPT) target prot opt source destination DROP all anywhere anywhere rt type:0 --ACCEPT all anywhere anywhere --ACCEPT all fe80::/64 anywhere Chain SECURITY (0 references) target prot opt source destination RETURN tcp anywhere anywhere tcp flags:SYN,RST,ACK/SYN limit: avg 1/sec burst 5 RETURN tcp anywhere anywhere tcp flags:FIN,SYN,RST,ACK/RST limit: avg 1/sec burst 5 RETURN udp anywhere anywhere limit: avg 5/sec burst 5 RETURN icmp anywhere anywhere limit: avg 5/sec burst 5 DROP all anywhere anywhere Chain logaccept (0 references) target prot opt source destination LOG all anywhere anywhere LOG level warning tcp-sequence tcp-options ip-options prefix `ACCEPT ' ACCEPT all anywhere anywhere Chain logdrop (0 references) target prot opt source destination LOG all anywhere anywhere LOG level warning tcp-sequence tcp-options ip-options prefix `DROP ' DROP all anywhere anywhere

so it added code to accept anything from anywhere... (not secure)
but it also added fe80::/64 considered unsafe according to kamil, but it was the final step to make ipv6 browsable again:confused:

in the end the current firewall is not complete imo

first of all, your ip6tables listings ain't correct, no extra options were copied and no interfaces are visible

Code:

[admin@router root]$ ip6tables -vL INPUT Chain INPUT (policy DROP 0 packets, 0 bytes) pkts bytes target prot opt in out source destination 0 0 DROP all any any anywhere anywhere rt type:0 0 0 ACCEPT all lo any anywhere anywhere 9 672 ACCEPT all br0 any anywhere anywhere 14 1232 ACCEPT ipv6-icmp any any anywhere anywhere 0 0 ACCEPT all any any fe80::/10 anywhere 0 0 ACCEPT all any any ff00::/8 anywhere 0 0 ACCEPT tcp any any anywhere anywhere tcp dpt:ftp 60 7158 ACCEPT tcp any any anywhere anywhere tcp dpt:www

second, ifconfig sixtun | grep 'Scope:Link' | awk '{print $3}' wil produce smth like "fe80::xxxx:xxxx/64 fe80::yyyy:yyyy/64", eg 2 ips, what leads to fe80::/64 range.
but there's fe80::/10 INPUT rule already specifies range fe80:0000:0000:0000:0000:0000:0000:0000 -
febf:ffff:ffff:ffff:ffff:ffff:ffff:ffff.
so your INPUT LANSCOPE rule is useless

next, OUTPUT chain has ACCEPT policy and only ping-pong DROP rule
so, your OUTPUT rules are useless

about INPUT chain - it controls only incoming (eg. end-point is router itself) connections, and doesn't affect on your pc internet connectivity, which is pass over FORWARD chain.
moreover, INPUT's ACCEPT rule is dangerous, it makes your web interface accessable from wan, at least.

p.s IPv6-in-IPv4 tunnel needs some time to be established after router reset.
On connect, your local PCs will receive router advertisements 'bout IPv6 adresse prefix and everything will be fine.
Autoconfiguration requires radvd daemon should be running (Enable router advertisements: Yes) and correct LAN IPv6 address should be specified.

Just wait some time, not more than 1 min.

I reconfigured my router and now it seems to work.
kinda weird since the settings are the same:confused:

maybe some leftover from the broken psu:o
the weird thing is that ipv6 did work on the router, but not on any of the pc's:p

Quote:

Originally Posted by wpte

I reconfigured my router and now it seems to work.
kinda weird since the settings are the same:confused:

maybe some leftover from the broken psu:o
the weird thing is that ipv6 did work on the router, but not on any of the pc's:p

another suggestion is to move -p ipv6 -j ACCEPT right after - i br0 -j ACCEPT

Code:

Chain INPUT (policy DROP 3990 packets, 470K bytes) pkts bytes target prot opt in out source destination 0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 state INVALID 48680 9967K ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED 0 0 ACCEPT all -- lo * 0.0.0.0/0 0.0.0.0/0 state NEW 8332 2792K ACCEPT all -- br0 * 0.0.0.0/0 0.0.0.0/0 state NEW 673 69654 SECURITY all -- ppp0 * 0.0.0.0/0 0.0.0.0/0 state NEW 4167 487K SECURITY all -- vlan1 * 0.0.0.0/0 0.0.0.0/0 state NEW 16 940 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 0 0 ACCEPT 41 -- * * 0.0.0.0/0 0.0.0.0/0

Code:

Chain INPUT (policy DROP 3990 packets, 470K bytes) pkts bytes target prot opt in out source destination 0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 state INVALID 48680 9967K ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED 0 0 ACCEPT all -- lo * 0.0.0.0/0 0.0.0.0/0 state NEW 8332 2792K ACCEPT all -- br0 * 0.0.0.0/0 0.0.0.0/0 state NEW 0 0 ACCEPT 41 -- * * 0.0.0.0/0 0.0.0.0/0 673 69654 SECURITY all -- ppp0 * 0.0.0.0/0 0.0.0.0/0 state NEW 4167 487K SECURITY all -- vlan1 * 0.0.0.0/0 0.0.0.0/0 state NEW 16 940 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0

IPV6 6to4 how-to for static wan/ppp ipv6 address without any tunnel brokers

step 1
check if 192.88.99.1 address is reachable, if not - this manual isn't for you :(

step 2
suppose your static ipv4 address is 16.32.48.64

convert decimal digits to hexadecimal - 10.20.30.40
add 2002::/16 prefix to get your ipv6 address space - 2002:1020:3040::/48

step 3
configure router at IP Config/IPv6 page

LAN IPv6 Setting
Static IPv6 address: 2002:1020:3040:1::1
Netsize (bits of hostpart): 64
Enable router advertisements: Yes

WAN IPv6 Setting
Static IPv6 address:
Netsize (bits of hostpart):
Remote IPv6 gateway:

Tunnel IPv6 Setting
Enable IPv6-tunnel: Yes
Remote endpoint: any
Local IPv6 address: 2002:1020:3040:0::1
Netsize (bits of hostpart): 64
Remote IPv6 gateway: ::192.88.99.1
Tunnel MTU: 1280
Tunnel TTL: 64

That's all.

1 Attachment(s)

Preview of new IPv6 web interface.
Supported: Native IPv6, Tunnel 6in4, Tunnel 6to4
Any suggestions?

Looks good theMIROn!
this interface makes a lot more sense than the old one;)

btw, does ipv6 without tunnel brokers have advantages / disadvantages?

http://www.google.com/intl/en/ipv6/

seems like ipv6 is getting more useful now, since goolge is opening youtube for ipv6 as well! :)

Quote:

Originally Posted by wpte

Looks good theMIROn!
this interface makes a lot more sense than the old one;)

it was changed again in the trunk.

Quote:

Originally Posted by wpte

Looks good theMIROn!
btw, does ipv6 without tunnel brokers have advantages / disadvantages?

yep, google for it, I've seen several articles over net

Quote:

Originally Posted by theMIROn

it was changed again in the trunk.

Some bug fixes you mean? http://code.google.com/p/wl500g/source/detail?r=1123

Quote:

yep, google for it, I've seen several articles over net

short list I've found for other people:
Advantages of 6to4:

No need to register anything, if you have an IPv4 address then you also have IPv6 6to4 addresses
Traffic between separate 6to4 sites takes the most direct route possible. This in turn can give you lower latency and may also permit you to take advantage of free traffic (if your ISP has free peering links).

Disadvantages of 6to4:

If you only have a dynamic IPv4 address then your IPv6 6to4 addresses will also be dynamic.
There is currently no support for setting reverse DNS entries when using 6to4 addresses.
The tunneled IPv6 packets may arrive from any IPv4 addresses and therefore filtering becomes both more difficult and more important.

So in short: it might be faster, especially if you're not close to a tunnel broker. But if you don't have a static ip adress you need to reconfigure it now and then. Also you get extra security issues when you don't configure the firewall properly.

OH AND MY 1000th POST :D

Quote:

Originally Posted by wpte

Some bug fixes you mean? http://code.google.com/p/wl500g/source/detail?r=1123

short list I've found for other people:
Advantages of 6to4:

No need to register anything, if you have an IPv4 address then you also have IPv6 6to4 addresses
Traffic between separate 6to4 sites takes the most direct route possible. This in turn can give you lower latency and may also permit you to take advantage of free traffic (if your ISP has free peering links).

Disadvantages of 6to4:

If you only have a dynamic IPv4 address then your IPv6 6to4 addresses will also be dynamic.
There is currently no support for setting reverse DNS entries when using 6to4 addresses.
The tunneled IPv6 packets may arrive from any IPv4 addresses and therefore filtering becomes both more difficult and more important.

So in short: it might be faster, especially if you're not close to a tunnel broker. But if you don't have a static ip adress you need to reconfigure it now and then. Also you get extra security issues when you don't configure the firewall properly.

OH AND MY 1000th POST :D

congratz, but no dynamic ipv4 addr is supported yet, only static.

1 Attachment(s)

Hi everybody!

I have:
WL-500gp (firmware: WL500gp-1.9.2.7-d-r1445.trx);
Router firewall is disabled.
Static IP;
WinXP SP3;
IPv6-to-IPv4 Tunnel.

Following the instructions:

Quote:

Originally Posted by theMIROn

IPV6 6to4 how-to for static wan/ppp ipv6 address without any tunnel brokers

step 1
check if 192.88.99.1 address is reachable, if not - this manual isn't for you :(

step 2
suppose your static ipv4 address is 16.32.48.64

convert decimal digits to hexadecimal - 10.20.30.40
add 2002::/16 prefix to get your ipv6 address space - 2002:1020:3040::/48

step 3
configure router at IP Config/IPv6 page

LAN IPv6 Setting
Static IPv6 address: 2002:1020:3040:1::1
Netsize (bits of hostpart): 64
Enable router advertisements: Yes

WAN IPv6 Setting
Static IPv6 address:
Netsize (bits of hostpart):
Remote IPv6 gateway:

Tunnel IPv6 Setting
Enable IPv6-tunnel: Yes
Remote endpoint: any
Local IPv6 address: 2002:1020:3040:0::1
Netsize (bits of hostpart): 64
Remote IPv6 gateway: ::192.88.99.1
Tunnel MTU: 1280
Tunnel TTL: 64

That's all.

still get no luck in connect to IPv6 sites (ipv6.google.com) via router from LAN.

If I connect to the Internet bypassing router it seems OK
(I can open ipv6.google.com)

Unfortunately I don't know Linux at all.

But when I type "ping6 ipv6.google.com" in
router WEB Interface - System Setup - System Command
I get

PING ipv6.google.com (2a00:1450:8004::93): 56 data bytes
64 bytes from 2a00:1450:8004::93: seq=1 ttl=56 time=64.754 ms
64 bytes from 2a00:1450:8004::93: seq=3 ttl=56 time=116.002 ms
64 bytes from 2a00:1450:8004::93: seq=4 ttl=56 time=120.154 ms
64 bytes from 2a00:1450:8004::93: seq=5 ttl=56 time=103.555 ms
64 bytes from 2a00:1450:8004::93: seq=6 ttl=56 time=103.696 ms
64 bytes from 2a00:1450:8004::93: seq=8 ttl=56 time=156.304 ms
64 bytes from 2a00:1450:8004::93: seq=9 ttl=56 time=105.589 ms
64 bytes from 2a00:1450:8004::67: seq=21 ttl=56 time=67.103 ms
64 bytes from 2a00:1450:8004::67: seq=22 ttl=56 time=125.285 ms
64 bytes from 2a00:1450:8004::67: seq=23 ttl=56 time=116.125 ms
64 bytes from 2a00:1450:8004::67: seq=24 ttl=56 time=110.226 ms
64 bytes from 2a00:1450:8004::67: seq=25 ttl=56 time=155.083 ms
64 bytes from 2a00:1450:8004::67: seq=26 ttl=56 time=110.517 ms
64 bytes from 2a00:1450:8004::67: seq=27 ttl=56 time=120.478 ms
64 bytes from 2a00:1450:8004::67: seq=28 ttl=56 time=110.660 ms
64 bytes from 2a00:1450:8004::67: seq=29 ttl=56 time=112.311 ms
64 bytes from 2a00:1450:8004::93: seq=898 ttl=56 time=107.268 ms
64 bytes from 2a00:1450:8004::93: seq=899 ttl=56 time=168.398 ms
64 bytes from 2a00:1450:8004::93: seq=900 ttl=56 time=170.426 ms
64 bytes from 2a00:1450:8004::93: seq=901 ttl=56 time=170.429 ms
64 bytes from 2a00:1450:8004::93: seq=902 ttl=56 time=71.379 ms
64 bytes from 2a00:1450:8004::93: seq=903 ttl=56 time=65.832 ms
64 bytes from 2a00:1450:8004::93: seq=904 ttl=56 time=167.447 ms
64 bytes from 2a00:1450:8004::93: seq=906 ttl=56 time=65.854 ms

Any help?

P.S. My settings in attachment.

Quote:

Originally Posted by cap_tcha

still get no luck in connect to IPv6 sites (ipv6.google.com) via router from LAN.
Any help?

P.S. My settings in attachment.

Since you're able to ping ipv6 hosts from router itself your tunnel is up and working.
To get ipv6 cennectivity on your lan hosts (pc/notebooks) they have to receice ipv6 RA messages from router. It's used for neighbor discovery and socializtion, so, maybe your pc's firewall blocks them all.
And, I sure, you didn't forget about installing ipv6 transport proto in winxp, and to wait some time to let your local ipv6 address be autoconfigured.
Just check ipv6 ip and route table in winxp

Quote:

Originally Posted by theMIROn

And, I sure, you didn't forget about installing ipv6 transport proto in winxp

usually requires a restart before it actually works, especially in windows xp.

I appreciate your prompt replies very much.

Quote:

Originally Posted by wpte

usually requires a restart before it actually works, especially in windows xp.

This is a usefull and important remark.
I followed this tip when established IPv6 tunnel without router (directly).

Thank you for giving me a hint.

Quote:

Originally Posted by theMIROn

Since you're able to ping ipv6 hosts from router itself your tunnel is up and working.
To get ipv6 cennectivity on your lan hosts (pc/notebooks) they have to receice ipv6 RA messages from router. It's used for neighbor discovery and socializtion, so, maybe your pc's firewall blocks them all.
And, I sure, you didn't forget about installing ipv6 transport proto in winxp, and to wait some time to let your local ipv6 address be autoconfigured.
Just check ipv6 ip and route table in winxp

When I connected to ipv6.google.com without router I checked firewall
settings (in my case BitDefender Total Security 2009) and added
all addresses (including IPv6) in BitDefender's "trusted zone".
And it works.

Now, when I connected via router I found some more addresses in
BitDefender's settings and added them all to the "trusted zone".
And it does not work.

After that I did some work around (still suspecting my firewall) and found
out BitDefender's "stealth mode" and turned it OFF.

And it works now.

I've tried version 1.9.2.7.-d-r2295 from SVN and IPv6 (6in4 tunnel) is working OK. However, when I tried to use ipv6 conntrack, it seemed to be reasonably unstable.

CONFIG_IP6_NF_CONNTRACK=y cause random system restarts within a few hours and CONFIG_IP6_NF_MATCH_STATE=m and ip6t_state module loaded cause total freeze within an hour afrer boot.

I know, these options are not enabled in default config, so I reverted back to original settings and use ! --syn option for incoming tcp and disable udp ports 1024:65535 instead.

It's a pity that backported ip6 conntrack doesn't work, but it will in the future, I hope ;-)

Quote:

Originally Posted by taylor729

I've tried version 1.9.2.7.-d-r2295 from SVN and IPv6 (6in4 tunnel) is working OK. However, when I tried to use ipv6 conntrack, it seemed to be reasonably unstable.

yes, it's known bug.

Quote:

Originally Posted by taylor729

It's a pity that backported ip6 conntrack doesn't work, but it will in the future, I hope ;-)

1.9.2.7-rtn FW has fully working ipv6 conntrack.

BTW, since r2354/r2355 ipv6 desing was changed.
6to4 tunnels should work out-of-box with dynamic WAN, PPP connection type introduced, many bugs were fixed.
so, please, test
http://www.webpagescreenshot.info/im...118201080123PM

Quote:

Originally Posted by theMIROn

BTW, since r2354/r2355 ipv6 desing was changed.
6to4 tunnels should work out-of-box with dynamic WAN, PPP connection type introduced, many bugs were fixed.
so, please, test

that broke my ipv6 setup again :(
after flashing the ipv6 page had other ipv6 addresses listed (not mine), I guess that's the out of the box?:p

now, the part that always breaks here is sharing the tunnel with other computers. With both the out-of-box and mine configuration the router can ping ipv6 hostnames but the computers can't, yet they can resolve the hostnames:confused:

The only thing that fixed it for me so far was a complete reset of the nvram and a reconfiguration (manually) to make it work again. I always used the same values tho. So I guess something is going wrong with some logic codes?

with 6to4 type, whatever ipv6 you set, prefix will always be 2002:ip:v4, but other part has the meaning.

Quote:

Originally Posted by wpte

that broke my ipv6 setup again :(

check r2361/r2362, should work.

Quote:

Originally Posted by wpte

So I guess something is going wrong with some logic codes?

yep, was, I'm pretty sure :)

fixed it indeed:)

Quote:

Originally Posted by wpte

fixed it indeed:)

So, any new suggestion?
p.s. Tunnel local address is useless input box now

Quote:

Originally Posted by theMIROn

So, any new suggestion?
p.s. Tunnel local address is useless input box now

Not really actually, I mean it works quite nice right?:)

So tunnel local address is auto configured?

Quote:

Originally Posted by wpte

Not really actually, I mean it works quite nice right?:)
So tunnel local address is auto configured?

Yes, right from r2363/r2364 it should works quite well.
And tunnel local address is auto configured with wan ip address, no matter if it static, automatic or ppp.

Need a little help, please

Hi.

I've been playing around with an IPv6 tunnel from HE, whilst It works, sort of, I have a few problems.

First, the settings for the router interface. Lets say, for example, I am issued the following:

Client IPv6 address: 2001:123:abcd:123::2
Server IPv6 address: 2001:123:abcd:123::1

In the router interface settings (WL500gpV2) we have:

LAN IPv6 Setting
Static IPv6 address: (Not sure what I should enter here)
Netsize (bits of hostpart): 64
Enable router advertisements: Yes

WAN IPv6 Setting
Static or local IPv6 address: 2001:123:abcd:123::2 (I assume?)
Netsize (bits of hostpart): 64
Remote IPv6 gateway: 2001:123:abcd:123::1 (I assume?)

WAN DNS IPv6 Setting
DNS Server: (Not sure what goes here there's only RDNS listed on the tunnel page at HE)

Having used the settings above, I can ping6 various sites from the router, however, I get request timed out when I try to ping -6 any ipv6 site from my PC.

Another problem, if I go to testmyipv6.net or any similar sites, they all report I'm using IPv4 and not IPv6, so something is obviously broken with my configuration.

Finally, once I get this working correctly, is there anything else that needs to be done. I did notice that running an iptables -L on the router only had entries for IPv4. Will I need to manually enter rules for IPv6?

Windows 7
Firmware: WL500gpv2-1.9.2.7-d-r2381

Thanks

Edit: made some changes and now a little closer:

In the router I changed the Static LAN address to 2001:470:1f0b:823::1
I used The DNS address 2001:470:0:70::2
I reset the IPv4 and IPv6 stack via netsh and rebooted

I was able to reach ipvg.he.net from the router but I got Destination host unreachable from the PC.

I manually added the address 2001:470:1f0b:823::3 to the IPv6 interface and added the DNS address also.

After a release and renew I was able to ping -6 ipv6.he.net from the PC and I was able to reach ipv6.google.com via the browser. I was not able to reach ipv6.he.net from the browser and when I checked whatsmyipv6.com it still showed only an IPv4 address. Clearly, I am still doing something wrong.

Here is the most recent ipconfig:

Code:

Windows IP Configuration Host Name . . . . . . . . . . . . : ****** Primary Dns Suffix . . . . . . . : Node Type . . . . . . . . . . . . : Hybrid IP Routing Enabled. . . . . . . . : No WINS Proxy Enabled. . . . . . . . : No Ethernet adapter Local Area Connection: Connection-specific DNS Suffix . : Description . . . . . . . . . . . : Realtek PCIe GBE Family Controller Physical Address. . . . . . . . . : 00-1D-7D-04-77-** DHCP Enabled. . . . . . . . . . . : Yes Autoconfiguration Enabled . . . . : Yes IPv6 Address. . . . . . . . . . . : 2001:***:1f0b:823::3(Preferred) IPv6 Address. . . . . . . . . . . : 2001:***:1f0b:823:972:322:9617:bc8d(Preferred) Link-local IPv6 Address . . . . . : fe80::972:***:9617:bc8d%11(Preferred) IPv4 Address. . . . . . . . . . . : 192.168.1.143(Preferred) Subnet Mask . . . . . . . . . . . : 255.255.255.0 Lease Obtained. . . . . . . . . . : Saturday, January 15, 2011 12:32:23 AM Lease Expires . . . . . . . . . . : Sunday, January 16, 2011 12:32:23 AM Default Gateway . . . . . . . . . : 2001:470:1f0a:823::1 fe80::e2cb:4eff:fea8:6ef3%11 192.168.1.1 DHCP Server . . . . . . . . . . . : 192.168.1.1 DNS Servers . . . . . . . . . . . : 2001:470:0:70::2 192.168.1.1 NetBIOS over Tcpip. . . . . . . . : Enabled Tunnel adapter isatap.{3DEBEC41-0DB9-4781-8058-726218A5B202}: Media State . . . . . . . . . . . : Media disconnected Connection-specific DNS Suffix . : Description . . . . . . . . . . . : Microsoft ISATAP Adapter Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0 DHCP Enabled. . . . . . . . . . . : No Autoconfiguration Enabled . . . . : Yes C:\Windows\System32>ping -6 ipv6.he.net Pinging ipv6.he.net [2001:470:0:64::2] with 32 bytes of data: Reply from 2001:470:0:64::2: time=332ms Reply from 2001:470:0:64::2: time=332ms Reply from 2001:470:0:64::2: time=331ms Reply from 2001:470:0:64::2: time=334ms

http://whatsmyipv6.com/ doesn't work for me either, but that's because no ipv6 dns record seems to be available:p
http://ipv6.he.net/ does show up an ipv6 address.

Also, sometimes windows doesn't like to enable ipv6 instantly after receiving an address, so you might need to reboot.

Settings should look like this when using ipv6-in-ipv4 tunnel:

Quote:

Static IPv6 address: 2001:123:abcd:123::1 ("Server IPv6 address" without the /64)
Netsize (bits of hostpart): 64
Enable router advertisements: Yes

Static or local IPv6 address: 2001:123:abcd:123::2 ("Client IPv6 address" without the /64)
Netsize (bits of hostpart): 64
Remote IPv6 gateway: 2001:123:abcd:123::1 ("Server IPv6 address" without the /64)

DNS Server: 2001:470:20::2 ("Anycasted IPv6 Caching Nameserver" value)

6in4 IPv4 remote endpoint: 216.66.84.46 ("Server IPv4 address" value)
6to4 IPv4 anycast relay: (should be un-editable)
Tunnel MTU: 128
Tunnel TTL: 64

that should work:)

Thanks for the reply wpte, unfortunately, I still cannot get this to work. My settings are as you described and whilst I can ping ipv6 sites from both the router and the PC, I cannot connect to any via the browser. This would suggest the tunnel is probably failing.

Here's my settings:

Code:

Ethernet adapter Local Area Connection: Connection-specific DNS Suffix . : Description . . . . . . . . . . . : Realtek PCIe GBE Family Controller Physical Address. . . . . . . . . : 00-1D-7D-04-77-6B DHCP Enabled. . . . . . . . . . . : Yes Autoconfiguration Enabled . . . . : Yes IPv6 Address. . . . . . . . . . . : 2001:470:1f0b:823:972:322:9617:bc8d(Preferred) Link-local IPv6 Address . . . . . : fe80::972:322:9617:bc8d%11(Preferred) IPv4 Address. . . . . . . . . . . : 192.168.1.143(Preferred) Subnet Mask . . . . . . . . . . . : 255.255.255.0 Lease Obtained. . . . . . . . . . : Saturday, January 15, 2011 10:30:00 AM Lease Expires . . . . . . . . . . : Sunday, January 16, 2011 10:30:00 AM Default Gateway . . . . . . . . . : fe80::e2cb:4eff:fea8:6ef3%11 192.168.1.1 DHCP Server . . . . . . . . . . . : 192.168.1.1 DNS Servers . . . . . . . . . . . : 2001:470:20::2 192.168.1.1 NetBIOS over Tcpip. . . . . . . . : Enabled Tunnel adapter isatap.{3DEBEC41-0DB9-4781-8058-726218A5B202}: Media State . . . . . . . . . . . : Media disconnected Connection-specific DNS Suffix . : Description . . . . . . . . . . . : Microsoft ISATAP Adapter Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0 DHCP Enabled. . . . . . . . . . . : No Autoconfiguration Enabled . . . . : Yes C:\Windows\System32>ping -6 ipv6.he.net Pinging ipv6.he.net [2001:470:0:64::2] with 32 bytes of data: Reply from 2001:470:0:64::2: time=335ms Reply from 2001:470:0:64::2: time=335ms Reply from 2001:470:0:64::2: time=335ms Reply from 2001:470:0:64::2: time=336ms

I also get a temporary ipv6 address, and that's the one I browse with:)

Just to be sure... you're using windows vista or higher (xp needs ipv6 patches)?
latest firmware?
default windows firewall (others tend to block ipv6)
restarted your nic or pc?

And obviously... compatible browser, which you should restart after you introduced ipv6 to the computer? Most browsers don't detect the change while running:)

Unreal! It seems it's a conflict between ipv6.he.net and some browsers. After some testing, I can connect to ipv6.he.net with IE 8 (haven't tried 9 yet) but not with my default browser firefox (minefield nightly), Opera 11 or iron 8.0.555. I can, however, connect to other sites such as test-ipv6.com...

Thanks for your help wpte :)

Edit: One further question, if I may. What do I need to do regarding ip6tables rules, as there doesn't appear to be any default rules allocated. Also, HE requires the client end-point to be 'pinagable' in order to establish a tunnel. Whilst I enabled pings from the WAN in te router interface, I feel this is less than ideal...

Edit 2: I spoke too soon. It would appear that I cannot connect to a whole host of ipv6 enabled sites, with any browser, when IPv6 is enabled. This is true, even though I received at perfect score on test-ipv6.com.