New Build - 12/12/2022 - r51011

Post new topic   Reply to topic    DD-WRT Forum Index -> Atheros WiSOC based Hardware
Goto page Previous  1, 2
Author Message
egc
DD-WRT Guru


Joined: 18 Mar 2014
Posts: 12884
Location: Netherlands

PostPosted: Tue Dec 13, 2022 8:12    Post subject: Reply with quote
Thanks, I am new to IPv6 Smile

I just saw: https://svn.dd-wrt.com/changeset/51012

Can you Ping Sebastian?

Any good readings about IPv6 Firewall?

I have a secondary router with IPv6 which is my WG and OpenVPN server.
For IPv4 you port forward, port forwarding as with a DNAT is not necessary, most probably only a FORWARD rule is sufficient but there must be some information about this already on the internet Smile

_________________
Routers:Netgear R7000, R6400v1, R6400v2, EA6900 (XvortexCFE), E2000, E1200v1, WRT54GS v1.
Install guide R6400v2, R6700v3,XR300:https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=316399
Install guide R7800/XR500: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=320614
Forum Guide Lines (important read):https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324087
Sponsor
thommy181
DD-WRT User


Joined: 16 Mar 2019
Posts: 353
Location: Szczecin, Poland EU

PostPosted: Tue Dec 13, 2022 9:11    Post subject: New Build - 12/12/2022 - r51011 Reply with quote
Router/Version: TP-Link TL-WDR3600 v1.5
Kernel: Linux 3.10.108-d11 #121994 Mon Dec 12 05:19:44 +06 2022 mips
Reset: No
Mode: Internet gateway, WIFI 5GHz AP, dnsmasq, firewall
Issues: Some yellow marked events in logs. That's nothing significant
Status: Working
Uptime: more than 16 h

Device working rather good.
MLandi
DD-WRT Guru


Joined: 04 Dec 2007
Posts: 1020

PostPosted: Tue Dec 13, 2022 13:25    Post subject: Reply with quote
I am using this as my startup script. All seems to work properly.

# Firewall / Startup
ip6tables -D INPUT -p ipv6-icmp -j ACCEPT -m limit --limit 30/minute
ip6tables -I INPUT -p ipv6-icmp -j ACCEPT -m limit --limit 30/minute
# Allow Link-Local addresses
ip6tables -A INPUT -s fe80::/10 -j ACCEPT
ip6tables -A OUTPUT -s fe80::/10 -j ACCEPT
# Allow multicast
ip6tables -A INPUT -d ff00::/8 -j ACCEPT
ip6tables -A OUTPUT -d ff00::/8 -j ACCEPT

_________________
Netgear R9000
DD-WRT v3.0-r55819 std (04/17/24)
Linux 4.9.337 #722 SMP Wed Apr 17 04:16:49 +07 2024 armv7l
Gateway, AP, DNSMasq, Clock 2000MHz
VAP on wlan1 for internet devices
IPv4 & IPv6 (Prefix Delegation)
Static Leases & DHCP
CloudFlare, no SFE, SmartDNS, no QoS
2.4GHz: Vanilla, Airtime Fairness, NG-Mixed, ACK Timing 3150, WPA2 w/AES & WPA3
5GHz: Vanilla, Airtime Fairness, AC/N Mixed, ACK Timing 3150, WPA2 w/AES & WPA3
2 Netgear AX1800 WiFi Mesh Extenders
Xfinity 1.2Gbps/35Mbps
egc
DD-WRT Guru


Joined: 18 Mar 2014
Posts: 12884
Location: Netherlands

PostPosted: Tue Dec 13, 2022 14:29    Post subject: Reply with quote
MLandi wrote:
I am using this as my startup script. All seems to work properly.

# Firewall / Startup
ip6tables -D INPUT -p ipv6-icmp -j ACCEPT -m limit --limit 30/minute
ip6tables -I INPUT -p ipv6-icmp -j ACCEPT -m limit --limit 30/minute
# Allow Link-Local addresses
ip6tables -A INPUT -s fe80::/10 -j ACCEPT
ip6tables -A OUTPUT -s fe80::/10 -j ACCEPT
# Allow multicast
ip6tables -A INPUT -d ff00::/8 -j ACCEPT
ip6tables -A OUTPUT -d ff00::/8 -j ACCEPT


Thanks @Mlandi, reading up on it and it looks like those are the rules which are necessary.

One thing I noticed there appear to be new DROP rules so using -I instead of -A might be necessary?

_________________
Routers:Netgear R7000, R6400v1, R6400v2, EA6900 (XvortexCFE), E2000, E1200v1, WRT54GS v1.
Install guide R6400v2, R6700v3,XR300:https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=316399
Install guide R7800/XR500: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=320614
Forum Guide Lines (important read):https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324087
MLandi
DD-WRT Guru


Joined: 04 Dec 2007
Posts: 1020

PostPosted: Tue Dec 13, 2022 14:39    Post subject: Reply with quote
egc wrote:
One thing I noticed there appear to be new DROP rules so using -I instead of -A might be necessary?

I do not know enough about how the rules work to answer that. I did wonder about -A and not -I, but thought I needed to learn. Smile

_________________
Netgear R9000
DD-WRT v3.0-r55819 std (04/17/24)
Linux 4.9.337 #722 SMP Wed Apr 17 04:16:49 +07 2024 armv7l
Gateway, AP, DNSMasq, Clock 2000MHz
VAP on wlan1 for internet devices
IPv4 & IPv6 (Prefix Delegation)
Static Leases & DHCP
CloudFlare, no SFE, SmartDNS, no QoS
2.4GHz: Vanilla, Airtime Fairness, NG-Mixed, ACK Timing 3150, WPA2 w/AES & WPA3
5GHz: Vanilla, Airtime Fairness, AC/N Mixed, ACK Timing 3150, WPA2 w/AES & WPA3
2 Netgear AX1800 WiFi Mesh Extenders
Xfinity 1.2Gbps/35Mbps
egc
DD-WRT Guru


Joined: 18 Mar 2014
Posts: 12884
Location: Netherlands

PostPosted: Tue Dec 13, 2022 14:52    Post subject: Reply with quote
MLandi wrote:
egc wrote:
One thing I noticed there appear to be new DROP rules so using -I instead of -A might be necessary?

I do not know enough about how the rules work to answer that. I did wonder about -A and not -I, but thought I needed to learn. Smile


As IPv6 is supposed to work like IPv4 I would use -I otherwise the rule will end up below the DROP rule and it will not work.

I got some links from @Mile-Lile see:
https://www.sixxs.net/wiki/IPv6_Firewalling
Note here -A is used because a default DROP POLICY is used, DDWRT uses a DROP all rule as last rule so anything added -A instead of inserted -I could end up below the DROP rule and thus will not work.

So my guess is that for DDWRT we need -I Smile

_________________
Routers:Netgear R7000, R6400v1, R6400v2, EA6900 (XvortexCFE), E2000, E1200v1, WRT54GS v1.
Install guide R6400v2, R6700v3,XR300:https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=316399
Install guide R7800/XR500: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=320614
Forum Guide Lines (important read):https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324087


Last edited by egc on Tue Dec 13, 2022 16:36; edited 1 time in total
MLandi
DD-WRT Guru


Joined: 04 Dec 2007
Posts: 1020

PostPosted: Tue Dec 13, 2022 16:27    Post subject: Reply with quote
egc wrote:
As IPv6 is supposed to work like IPv4 I would use -I otherwise the rule will end up below the DROP rule and it will not work.

I got some links from @Mile-Lile see:
https://www.sixxs.net/wiki/IPv6_Firewalling
Note here -A is used because a default DROP POLICY is used, DDWRT uses a DROP all rule as last rule so anything added -A instead of inserted -I could end up below the DROP rule and thus will not work.

So my guess is that for DDWRT we need -I Smile


Thank you

_________________
Netgear R9000
DD-WRT v3.0-r55819 std (04/17/24)
Linux 4.9.337 #722 SMP Wed Apr 17 04:16:49 +07 2024 armv7l
Gateway, AP, DNSMasq, Clock 2000MHz
VAP on wlan1 for internet devices
IPv4 & IPv6 (Prefix Delegation)
Static Leases & DHCP
CloudFlare, no SFE, SmartDNS, no QoS
2.4GHz: Vanilla, Airtime Fairness, NG-Mixed, ACK Timing 3150, WPA2 w/AES & WPA3
5GHz: Vanilla, Airtime Fairness, AC/N Mixed, ACK Timing 3150, WPA2 w/AES & WPA3
2 Netgear AX1800 WiFi Mesh Extenders
Xfinity 1.2Gbps/35Mbps
jwieland
DD-WRT User


Joined: 31 May 2018
Posts: 72

PostPosted: Wed Dec 14, 2022 4:01    Post subject: Reply with quote
Router/Version: Netgear R7800
File/Kernel: 51011/4.9.335
Previous/Reset: r50963/no reset
Mode/Status: cli install/status normal
Issues/Errors: None/None

_________________
Netgear R9000
Netgear R7800 (spare)
Linksys WRT1200ac v2 (spare)
oliver44
DD-WRT Guru


Joined: 01 Jun 2016
Posts: 504

PostPosted: Wed Dec 14, 2022 11:23    Post subject: Reply with quote
I honestly don't understand how you managed to make it work, I can't get ipv6 to work on the wdr3600,I followed all the instructions here on the forum and I can't get it to work either on cable or wifi...
_________________
Internet provider https://en.wikipedia.org/wiki/RCS_%26_RDS 1Gbps
WDR3600 rev.1.5 - DD-Wrt
Linksys WRT1900ACS v.2 DD-Wrt/-OpenWrt



https://ipv6.chappell-family.com/ipv6tcptest/
https://en.internet.nl/connection/e91f490fe1c54cb2b78145c0ab0d2b5a/results
http://www.dnssec-or-not.com/
https://dnscheck.tools/#results


Last edited by oliver44 on Wed Dec 14, 2022 11:47; edited 1 time in total
egc
DD-WRT Guru


Joined: 18 Mar 2014
Posts: 12884
Location: Netherlands

PostPosted: Wed Dec 14, 2022 11:34    Post subject: Reply with quote
You are getting an IPv6 address but your clients not.

See: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=333435 how i did it (not saying it is the only or the best way)

Recent build seems to have too restrictive firewall rules which should be corrected in the next build, so for this build add to Administration/Commands Save Firewall:

Quote:
# Allow ICMP might make it more restrictive only allowing the necessary ICMP messages
ip6tables -D INPUT -p ipv6-icmp -j ACCEPT -m limit --limit 30/minute
ip6tables -I INPUT -p ipv6-icmp -j ACCEPT -m limit --limit 30/minute
# Allow link local
ip6tables -D INPUT -s fe80::/10 -j ACCEPT
ip6tables -I INPUT -s fe80::/10 -j ACCEPT
ip6tables -D OUTPUT -s fe80::/10 -j ACCEPT
ip6tables -I OUTPUT -s fe80::/10 -j ACCEPT
# Allow multicast
#ip6tables -D INPUT -d ff00::/8 -j ACCEPT
#ip6tables -I INPUT -d ff00::/8 -j ACCEPT
#ip6tables -D OUTPUT -d ff00::/8 -j ACCEPT
#ip6tables -I OUTPUT -d ff00::/8 -j ACCEPT

_________________
Routers:Netgear R7000, R6400v1, R6400v2, EA6900 (XvortexCFE), E2000, E1200v1, WRT54GS v1.
Install guide R6400v2, R6700v3,XR300:https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=316399
Install guide R7800/XR500: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=320614
Forum Guide Lines (important read):https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324087
oliver44
DD-WRT Guru


Joined: 01 Jun 2016
Posts: 504

PostPosted: Wed Dec 14, 2022 11:53    Post subject: Reply with quote
I have attached all the messages with the system logs next to the images, at first I passed the commands via putty ssh, now I passed them as you said, but it still doesn't work ipv6
_________________
Internet provider https://en.wikipedia.org/wiki/RCS_%26_RDS 1Gbps
WDR3600 rev.1.5 - DD-Wrt
Linksys WRT1900ACS v.2 DD-Wrt/-OpenWrt



https://ipv6.chappell-family.com/ipv6tcptest/
https://en.internet.nl/connection/e91f490fe1c54cb2b78145c0ab0d2b5a/results
http://www.dnssec-or-not.com/
https://dnscheck.tools/#results
oliver44
DD-WRT Guru


Joined: 01 Jun 2016
Posts: 504

PostPosted: Wed Dec 14, 2022 12:02    Post subject: Reply with quote
it's strange, wrt1900acs v2 works perfectly ipv6 both on wire and wifi, without making any changes!



Dec 14 14:01:23 DD-WRT kern.info kernel: [ 776.900000] Atheros AR8216/AR8236/AR8316 ag71xx-mdio.0:00: Port 1 is down
Dec 14 14:01:27 DD-WRT kern.info kernel: [ 780.900000] Atheros AR8216/AR8236/AR8316 ag71xx-mdio.0:00: Port 1 is up
Dec 14 14:01:29 DD-WRT kern.info kernel: [ 782.900000] Atheros AR8216/AR8236/AR8316 ag71xx-mdio.0:00: Port 1 is down
Dec 14 14:01:33 DD-WRT kern.info kernel: [ 786.900000] Atheros AR8216/AR8236/AR8316 ag71xx-mdio.0:00: Port 1 is up

_________________
Internet provider https://en.wikipedia.org/wiki/RCS_%26_RDS 1Gbps
WDR3600 rev.1.5 - DD-Wrt
Linksys WRT1900ACS v.2 DD-Wrt/-OpenWrt



https://ipv6.chappell-family.com/ipv6tcptest/
https://en.internet.nl/connection/e91f490fe1c54cb2b78145c0ab0d2b5a/results
http://www.dnssec-or-not.com/
https://dnscheck.tools/#results
oliver44
DD-WRT Guru


Joined: 01 Jun 2016
Posts: 504

PostPosted: Fri Dec 16, 2022 3:38    Post subject: Reply with quote
some information for ipv6 from openwrt

https://www.onemarcfifty.com/
https://www.youtube.com/watch?v=jlG_nrCOmJc
https://www.onemarcfifty.com/blog/video/IPv6_from_scratch/

_________________
Internet provider https://en.wikipedia.org/wiki/RCS_%26_RDS 1Gbps
WDR3600 rev.1.5 - DD-Wrt
Linksys WRT1900ACS v.2 DD-Wrt/-OpenWrt



https://ipv6.chappell-family.com/ipv6tcptest/
https://en.internet.nl/connection/e91f490fe1c54cb2b78145c0ab0d2b5a/results
http://www.dnssec-or-not.com/
https://dnscheck.tools/#results
egc
DD-WRT Guru


Joined: 18 Mar 2014
Posts: 12884
Location: Netherlands

PostPosted: Fri Dec 16, 2022 8:45    Post subject: Reply with quote
oliver44 wrote:
some information for ipv6 from openwrt

https://www.onemarcfifty.com/
https://www.youtube.com/watch?v=jlG_nrCOmJc
https://www.onemarcfifty.com/blog/video/IPv6_from_scratch/


Thanks, nice primer Smile

_________________
Routers:Netgear R7000, R6400v1, R6400v2, EA6900 (XvortexCFE), E2000, E1200v1, WRT54GS v1.
Install guide R6400v2, R6700v3,XR300:https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=316399
Install guide R7800/XR500: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=320614
Forum Guide Lines (important read):https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324087
Goto page Previous  1, 2 Display posts from previous:    Page 2 of 2
Post new topic   Reply to topic    DD-WRT Forum Index -> Atheros WiSOC based Hardware All times are GMT

Navigation

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You cannot download files in this forum