Allow IPv6 subnet in firewall

[fl4co]

My ISP delegates a /56 IPv6 prefix, which is assigned to my Keenetic gateway and everything works fine.

I'd like to statically add a /64 subnet to another router connected to my LAN (or to some VMs behind a supervisor). I can easily achieve this configuration with a static route on the Keenetic.

However, I noticed that if the IPv6 firewall is enabled no communication is possible from the Internet. If the firewall is disabled, everything works, but I don't want to completely disable the firewall. Is there any way to allow traffic to a specific subnet?

Also, I'm running version 3.9 Beta 1 and I noticed that with the IPv6 firewall enabled hosts on the LAN do not reply to ICMPv6 echo requests (and possibly to ICMPv6 altogether), while the router still answers to pings to the IPv6 address on the Bridge0 interface. Is this an intended change? I'm pretty sure that ICMPv6 used to not be filtered by the firewall.

[vst]

Yes, ICMPv6 ping forwarding rules were deleted. But there is some different solution...

We have implemented DHCPv6 prefix delegation since NDMS 4.x. You may try to configure your device using the following configuration:

Quote

ipv6 subnet Default
    bind Home
    mode slaac
    prefix length 63
    number 0
    prefix delegate 64
!

In this configuration we have /63 network which consists of /64 LAN and delegation pool with one /64 network. No firewall rules need to be added but your VM must support DHCPv6.

[fl4co]

34 minutes ago, vst said:

Yes, ICMPv6 ping forwarding rules were deleted.

Isn't ICMPv6 necessary for IPv6 to work correctly?

 

34 minutes ago, vst said:

We have implemented DHCPv6 prefix delegation since NDMS 4.x.

Oh wow, prefix delegation would be excellent! However I can't seem to be able to use it in 3.9 Beta 1, when will it be publicly available?

Edited October 23, 2022 by fl4co

[vst]

3 hours ago, fl4co said:

Isn't ICMPv6 necessary for IPv6 to work correctly?

ICMPv6 ping was only disabled. It doesn't seem to be necessary.

3 hours ago, fl4co said:

However I can't seem to be able to use it in 3.9 Beta 1, when will it be publicly available?

We are preparing a new version, hopefully it will be released soon.