I am running a Debian-based home server with multiple Docker containers. Currently, I am using Cloudflare Tunnels to access my services externally. However, the 100MB file upload limit of Cloudflare Tunnels is bottlenecking my workflow. Since my ISP (TurkNet) provides native IPv6, I decided to open ports 80 and 443 to use Nginx Proxy Manager and access my services directly over IPv6.
However, I am facing a major roadblock regarding Keenetic's IPv6 Firewall implementation:
Under Network Security -> Firewall -> IPv6 (Rule Configuration), the interface strictly requires a "Destination IP". Since my ISP assigns a dynamic prefix (/64), my home server's IPv6 prefix changes every time the router reboots or the PPPoE session reconnects.
To bypass this, I tried to write a dynamic wildcard mask in the Destination IP field to match only the constant Interface ID (based on the device's MAC address):
::1a60:24ff:fedc:3aec/::ffff:ffff:ffff:ffff
The Web UI allows me to save this rule. However, after saving, Keenetic automatically resolves this to the current active IPv6 address (e.g., 2a02:ff0:3204:e84a:1a60:24ff:fedc:3aec). When the modem reboots and gets a brand-new prefix, the firewall rule does not update. It stays stuck with the old prefix/IPv6 address, which completely breaks external access until I manually update the rule again.
Is there a native way to bind IPv6 firewall rules to registered devices (by MAC address) so that the router dynamically updates the allowed destination IPv6 address when the prefix changes? If not, how can we make wildcard mask rules persistent across WAN reconnects?
Any help, CLI workarounds, or official advice would be highly appreciated.
You can post now and register later.
If you have an account, sign in now to post with your account.
Note: Your post will require moderator approval before it will be visible.
Question
alon3wolf
Hello everyone,
I am running a Debian-based home server with multiple Docker containers. Currently, I am using Cloudflare Tunnels to access my services externally. However, the 100MB file upload limit of Cloudflare Tunnels is bottlenecking my workflow. Since my ISP (TurkNet) provides native IPv6, I decided to open ports 80 and 443 to use Nginx Proxy Manager and access my services directly over IPv6.
However, I am facing a major roadblock regarding Keenetic's IPv6 Firewall implementation:
Under Network Security -> Firewall -> IPv6 (Rule Configuration), the interface strictly requires a "Destination IP". Since my ISP assigns a dynamic prefix (/64), my home server's IPv6 prefix changes every time the router reboots or the PPPoE session reconnects.
https://prnt.sc/_Ubfo4x7r8vf
To bypass this, I tried to write a dynamic wildcard mask in the Destination IP field to match only the constant Interface ID (based on the device's MAC address):
::1a60:24ff:fedc:3aec/::ffff:ffff:ffff:ffff
The Web UI allows me to save this rule. However, after saving, Keenetic automatically resolves this to the current active IPv6 address (e.g., 2a02:ff0:3204:e84a:1a60:24ff:fedc:3aec). When the modem reboots and gets a brand-new prefix, the firewall rule does not update. It stays stuck with the old prefix/IPv6 address, which completely breaks external access until I manually update the rule again.
Is there a native way to bind IPv6 firewall rules to registered devices (by MAC address) so that the router dynamically updates the allowed destination IPv6 address when the prefix changes? If not, how can we make wildcard mask rules persistent across WAN reconnects?
Any help, CLI workarounds, or official advice would be highly appreciated.
(KN-1810-01 v5.1.1)
Best regards,
Edited by alon3wolf1 answer to this question
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.
Note: Your post will require moderator approval before it will be visible.