0

I'm experiencing an issue with Windows 10 where IPv6 connectivity becomes unstable over time. Initially, IPv6 works as expected, but after a while, it stops working. Upon investigation, I've determined that the issue is related to my Windows Defender Firewall configuration.

After adding the predefined 'Core Networking' ruleset to the Firewall, the issue is resolved. However, I'm unsure which rules within this ruleset are responsible for restoring stable IPv6 connectivity. Can you provide me with details on the necessary inbound and outbound rules for stable IPv6 connectivity within the 'Core Networking' ruleset for Windows 10/11?

1 Answer 1

0

I'm a security engineer and over the years I've had people ask me why their IPv6 connection seems to fail after some time on the network. For example, the user checks the connection to https://test-ipv6.com/, or after setting up DoH/DoT one.one.one.one, the user notices that IPv6 fails at https://1.1.1.1/help.

When troubleshooting the problem, I always found the same reason, missing firewall rules, and I wanted to post it here because there are probably other people out there who are looking for the same thing, but can't find the right information.

What rules need to be added to the Windows Defender Firewall?

The "Core Networking" ruleset in Windows Defender Firewall includes a set of rules that are essential for the proper functioning of network communication in Windows. Here are the rules that are related to IPv6 connectivity:

The "Core Networking" ruleset in Windows Defender Firewall includes a set of rules that are essential for the proper functioning of network communication in Windows. Here are the rules that are related to IPv6 connectivity:

For Outbound:

  1. ICMPv6 Outbound: This rule allows outgoing ICMPv6 packets, which are used for network diagnostics and error reporting.

  2. Neighbor Discovery Outbound: This rule allows outgoing Neighbor Discovery packets, which are used for IPv6 address resolution.

  3. DHCPv6 Outbound: This rule allows outgoing DHCPv6 packets, which are used for IPv6 address configuration.

  4. Teredo Outbound: This rule allows outgoing Teredo packets, which are used for IPv6 connectivity over IPv4 networks.

For Inbound:

  1. ICMPv6 Inbound Echo Request: This rule allows incoming ICMPv6 Echo Request packets, which are used for network diagnostics and error reporting.

  2. Neighbor Discovery Inbound: This rule allows incoming Neighbor Discovery packets, which are used for IPv6 address resolution.

  3. DHCPv6 Inbound: This rule allows incoming DHCPv6 packets, which are used for IPv6 address configuration.

  4. Teredo Inbound: This rule allows incoming Teredo packets, which are used for IPv6 connectivity over IPv4 networks.

By adding the "Core Networking" ruleset, you are allowing these essential packets to pass through the Windows Defender Firewall, which should help maintain stable IPv6 connectivity.

Is both inbound and outbound required?

Yes, both inbound and outbound rules are required for stable IPv6 connectivity. Inbound rules allow incoming IPv6 packets to reach your device, while outbound rules allow your device to send IPv6 packets to other devices on the network. Without either set of rules, your device may not be able to establish and maintain an IPv6 connection. Therefore, it's recommended to have both inbound and outbound rules included in your "Core Networking" ruleset.

Are these rules safe to use, or could they pose a security risk?

The "Core Networking" ruleset included in Windows Defender Firewall is designed to allow essential network traffic for normal network operations, and it does not pose a significant security risk when used correctly. However, keep in mind that any time you open ports or allow network traffic through a firewall, you increase the attack surface of your system, which could potentially make it more vulnerable to certain types of attacks. Therefore, it's important to carefully evaluate and understand the security implications of adding any new firewall rules, including those included in the "Core Networking" ruleset. You should also ensure that you have adequate security measures in place, such as using up-to-date antivirus software, keeping your operating system and applications patched, and following safe browsing and email habits.

Can you summarize this for my system administrator?

  • The "Core Networking" ruleset in Windows Defender Firewall includes essential rules for network communication, including those related to IPv6 connectivity.
  • Both inbound and outbound rules are required for stable IPv6 connectivity, as they allow incoming IPv6 packets to reach your device and enable your device to send IPv6 packets to other devices on the network.
  • While adding the "Core Networking" ruleset does not pose a significant security risk when used correctly, it's important to evaluate the security implications of adding any new firewall rules and ensure that you have adequate security measures in place, such as using up-to-date antivirus software, keeping your operating system and applications patched, and following safe browsing and email habits.
2
  • Teredo is still in use? I'm surprised.
    – Dubu
    Mar 28, 2023 at 8:19
  • @Dubu To be fair, it's probably not explicitly required for most systems, but to avoid additional problems I've added this rule to the workflow. It's also included in the core networking default, which most people will just use.
    – obeN
    Apr 13, 2023 at 10:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .