Block/Prevent IPv6 for specific device

Post new topic   Reply to topic    DD-WRT Forum Index -> Advanced Networking
View previous topic :: View next topic  
Author Message
BlackDex
DD-WRT Novice


Joined: 01 Feb 2017
Posts: 7
PostPosted: Fri Dec 01, 2023 22:54    Post subject: Block/Prevent IPv6 for specific device Reply with quote
Hello there,

I have a specific device which seems to support IPv6, but it also has some issues.
While all other devices do not.

Now i wonder if there is a way to block or prevent this specific device from getting a IPv6 Address.
I'm not able to do this on the device it self in any way, so i need to prevent this a different way.

I already tried via iptables, but that doesn't seem to be working.

Code:
ip6tables -I FORWARD -m mac --mac-source 11:22:33:44:55:66 -p udp --dport 546 -j DROP
ip6tables -I FORWARD -m mac --mac-source 11:22:33:44:55:66 -p udp --dport 547 -j DROP
ip6tables -I FORWARD -m mac --mac-source 11:22:33:44:55:66 -p icmpv6 --icmpv6-type 134 -j DROP


I also tried to block all icmpv6, but not blocking all IPv6 traffic from the device.

My IPv6 settings are the following.
Code:
[Configuration]
Type: DHCPv6 with Prefix Delegation
Prefix Length: 57
Static DNS1: 2606:4700:4700::1112
Static DNS2: 2606:4700:4700::1002
MTU: 1500

[DHCPv6 Client Daemon]
No Release on Reconnect: Enabled
Custom Configuration: Disabled

[DHCPv6 Server Daemon]
Enable Daemon: Disable

[Router Advertisement Daemon (radvd)]
Enable Daemon: Enable
Custom Configuration: Disable


Is there anything i can configure in some way to block this?

If you need more information, please let me know.

Running: DD-WRT v3.0-r54095 std (11/22/23) / Linux 4.4.302-st46 #10541 SMP Mon Nov 20 07:00:23 +06 2023 armv7l
On a: Netgear R7000 / Broadcom BCM4709

Last edited by BlackDex on Sat Dec 02, 2023 9:31; edited 1 time in total
Back to top View user's profile Send private message
Sponsor
Megazildjian
DD-WRT Novice


Joined: 28 Nov 2017
Posts: 19
PostPosted: Sat Dec 02, 2023 2:47    Post subject: Reply with quote
Code:
ip6tables -t mangle -A PREROUTING -m mac --mac-source <mac_address> -j DROP


Add to "Save Firewall" and reboot router and device. I used this in the past to block ipv6 on a couple devices. They don't even get an ipv6 address.
_________________
Linksys EA8500
v3.0-r53562 std (10/03/23)
Back to top View user's profile Send private message
BlackDex
DD-WRT Novice


Joined: 01 Feb 2017
Posts: 7
PostPosted: Sat Dec 02, 2023 9:32    Post subject: Reply with quote
Hmm, that doesn't seem to work either.
Probably because of radvd maybe?

Not sure how to block that.
Back to top View user's profile Send private message
egc
DD-WRT Guru


Joined: 18 Mar 2014
Posts: 12921
Location: Netherlands
PostPosted: Sat Dec 02, 2023 11:42    Post subject: Reply with quote
The router itself is on the INPUT chain and not on the FORWARD chain.

So try with substituting FORWARD with INPUT
_________________
Routers:Netgear R7000, R6400v1, R6400v2, EA6900 (XvortexCFE), E2000, E1200v1, WRT54GS v1.
Install guide R6400v2, R6700v3,XR300:https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=316399
Install guide R7800/XR500: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=320614
Forum Guide Lines (important read):https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324087
Back to top View user's profile Send private message
BlackDex
DD-WRT Novice


Joined: 01 Feb 2017
Posts: 7
PostPosted: Sat Dec 02, 2023 12:11    Post subject: Reply with quote
I tried that to, even added all of them at the same time.
It still receives an IPv6 address.
Back to top View user's profile Send private message
Wildlion
DD-WRT Guru


Joined: 24 May 2016
Posts: 1418
PostPosted: Sat Dec 02, 2023 16:17    Post subject: Reply with quote
First dumb question... is it a global ipv6 address? (fe80:: is a link only)

sounds like the device is configuring itself via slaac.

you could block all ipv6 traffic getting routed to that device..

Can you show us your ipv6 tables (just to check)
Back to top View user's profile Send private message
BlackDex
DD-WRT Novice


Joined: 01 Feb 2017
Posts: 7
PostPosted: Sat Dec 02, 2023 16:35    Post subject: Reply with quote
It's public ipv6 from my ISP.

I did some more investigation, and i was using a local pihole also as dns server.
It looked like for some reason that the ipv6 of that device changed.
Now all other devices just worked fine, and disregarded any further usage. But that device kept using it. Now that i fixed that it seemed to have solved all issues.

Thx for the help!
Back to top View user's profile Send private message
Display posts from previous:    Page 1 of 1
Post new topic   Reply to topic    DD-WRT Forum Index -> Advanced Networking All times are GMT

Navigation

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You cannot download files in this forum