ipv6 ipv6 firewall - static port forwarding trouble

[tormozillo]

Hi, I had a static ipv6 route with this setting:

ipv6 static tcp PPPoE0 [mac] 443

It works nice! My server serves HTTPS website on ipv6 only address and accessible from everywhere.

But after I added the same for ipv4:

ip static tcp PPPoE0 443 [mac] !https

...something goes wrong, internet port scanners report my server has open 443 port on ipv4 only, not ipv6.

KN-1611,  OS version 4.0.1

[Le ecureuil]

We have implemented the ping-based probing in the future 4.2 release.

[tormozillo]

I discovered ipv6 static command works for a short time after pinging this ipv6 address from Keenetic web-console.

It's clear that neighbor discovery has broken in 4.0.1

ip -6 neigh on local computers reports with both global 2a03:: and local fe80:: ipv6 address of my web-server, so the problem not in the server side.
 

Edited July 25, 2023 by tormozillo

[AlexCh]

14 часа назад, tormozillo сказал:

I discovered ipv6 static command works for a short time after pinging this ipv6 address from Keenetic web-console.

It's clear that neighbor discovery has broken in 4.0.1

ip -6 neigh on local computers reports with both global 2a03:: and local fe80:: ipv6 address of my web-server, so the problem not in the server side.
 

I confirm that in 4.0.1 IPv6 neighbor detection does not work correctly, but technical support answered me that the reason is in my devices on the local network.

[tormozillo]

2 часа назад, AlexCh сказал:

I confirm that in 4.0.1 IPv6 neighbor detection does not work correctly, but technical support answered me that the reason is in my devices on the local network.

A solution might be done from server side. I found this bash-script on Archlinux wiki, after run once ipv6 works at least 12 hours now:

#!/usr/bin/bash
declare -a l_ifs
readarray l_ifs < <(/sbin/ip -6 -j address | jq -r '.[] | .ifname ')
for l_if in ${l_ifs[@]} ; do
 echo $l_if
 declare -a l_addrs
 readarray l_addrs < <(/sbin/ip -6 -j address show dev "$l_if" | \
                        jq -r  '.[0].addr_info[].local')
 for l_addr in ${l_addrs[@]} ; do
   echo $l_addr
   ping -c 4 -6 -I "$l_addr" ff02::1%"$l_if"
 done
done

 

[AlperShal]

I am having the same problem. 

ipv6 static tcpudp PPPoE0 [mac] [port]

After running this command people are able to connect to my home lab for maximum of 5 minutes and then they can't. There is clearly a problem with this command.

[AlperShal]

Did anyone found a solution to this? I have iPv6 but I can't use it. This is really annoying.

Edited September 8, 2023 by AlperShal

[asdem]

Hi AlperShal,

this may not be exactly the same issue, but I detailed a similar port forwarding inconsistency in another thread.

In particular, the part about the rule appearing active after a soft‑reload but failing to work,

and the temporary workaround I used, might be of interest. If you'd like to take a look: 

 

Edited July 15 by asdem
Page format update