1

I have a Netgear Nighthawk R7000 router which I configured to use IPv6. Here is the output of ifconfig -a for my wireless card interface on my Linux machine.

wlp2s0b1: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
    inet 192.168.1.8  netmask 255.255.255.0  broadcast 192.168.1.255
    inet6 2601:81:c300:12f0:10c3:18be:20ef:b62c  prefixlen 64  scopeid 0x0<global>
    inet6 2601:81:c300:12f0:78ca:626a:14b3:c8a  prefixlen 64  scopeid 0x0<global>
    inet6 fe80::216d:afa5:e46e:6920  prefixlen 64  scopeid 0x20<link>
    ether a4:d1:8c:65:4c:a4  txqueuelen 1000  (Ethernet)
    RX packets 1147508  bytes 762515013 (762.5 MB)
    RX errors 0  dropped 2  overruns 0  frame 0
    TX packets 3752018  bytes 944468619 (944.4 MB)
    TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

I was able to access a local web server I am hosting on port 500 by accessing either of the two links

http://[2601:81:c300:12f0:10c3:18be:20ef:b62c]:500
http://[2601:81:c300:12f0:78ca:626a:14b3:c8a]:500

But now I am trying to access this web server from an external network. If this was IPv4 I would have to port forward and map my router's WAN IP and port to my machines LAN IP and port. How do I access my web server from another network with IPv6?

Edit: Here are some of the possible firewalls and debugging info I have on my Linux machine:

Check to make sure IPv6 is enabled

# cat /sys/module/ipv6/parameters/disable
0

Check to make sure all IPv6 devices are enabled.

# sysctl -a 2>/dev/null | grep disable_ipv6
net.ipv6.conf.all.disable_ipv6 = 0
net.ipv6.conf.default.disable_ipv6 = 0
net.ipv6.conf.docker0.disable_ipv6 = 0
net.ipv6.conf.enp1s0f0.disable_ipv6 = 0
net.ipv6.conf.lo.disable_ipv6 = 0
net.ipv6.conf.wlp2s0b1.disable_ipv6 = 0

Show any firewalls with iptable.

# sudo iptables -L -n
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain FORWARD (policy DROP)
target     prot opt source               destination         
DOCKER-USER  all  --  0.0.0.0/0            0.0.0.0/0           
DOCKER-ISOLATION-STAGE-1  all  --  0.0.0.0/0            0.0.0.0/0           
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0            ctstate             
RELATED,ESTABLISHED
DOCKER     all  --  0.0.0.0/0            0.0.0.0/0           
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         

Chain DOCKER (1 references)
target     prot opt source               destination         

Chain DOCKER-ISOLATION-STAGE-1 (1 references)
target     prot opt source               destination         
DOCKER-ISOLATION-STAGE-2  all  --  0.0.0.0/0            0.0.0.0/0           
RETURN     all  --  0.0.0.0/0            0.0.0.0/0           

Chain DOCKER-ISOLATION-STAGE-2 (1 references)
target     prot opt source               destination         
DROP       all  --  0.0.0.0/0            0.0.0.0/0           
RETURN     all  --  0.0.0.0/0            0.0.0.0/0           

Chain DOCKER-USER (1 references)
target     prot opt source               destination         
RETURN     all  --  0.0.0.0/0            0.0.0.0/0 

I could not see any relevant router firewall rules either.

9
  • You need to port forward (static NAT) your IPv6 address on your router. – Ron Trunk Mar 17 at 19:19
  • @RonTrunk the static routes section of my router takes 3 inputs of destination ip, ip subnet mask, gateway ip, all of which seem to only be in IPv4 format. I do not see any option to use an IPv6. – nick2225 Mar 17 at 19:29
  • 1
    If your router can't do it, time for a new router. – Ron Trunk Mar 17 at 19:30
  • 1
    It looks like your Linux box has a publicly routable IPv6 address. You should be able to connect to it from anywhere that you have IPv6 Internet connectivity. – Spiff Mar 17 at 19:39
  • 1
    According to your R7000's user manual, it seems that in the IPv6 settings there's a "Secured vs. Open" setting. The manual fails to define exactly what "Secured" really means, but I suspect "Secured" means "reject incoming IPv6 TCP connection attempts". Try setting it to "Open" instead. Beware that your R7000 doesn't seem to have a proper SPI firewall for IPv6, so changing this setting means your IPv6-capable devices on your home [W]LAN can get port scanned and attacked. So make sure they're all running their own software firewalls. – Spiff Mar 17 at 21:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.