How to open IPV6 firewall ports on GL-AR150?

kkl · 2022-05-15T21:51:25.106Z

When the GL-AR150 is in router mode and configured for IPV6, what is the procedure to open firewall ports so that IPV6 devices on the LAN are accessible from the WAN? Thank you.

FW 3.212, OpenWrt 19.07.8 r11364-ef56c85848 / LuCI openwrt-19.07 branch git-21.189.23240-7b931da

wcs2228 · 2022-05-17T02:19:48.487Z

Here is some related information:

OpenWrt Forum – 27 Dec 18

IPv6 and port forwarding

Port "forwarding" where packets destined for the router's IP are instead rewritten and forwarded to a private IP on the LAN side is not necessary under ipv6, what is needed is simply to open up the firewall to allow forwarding traffic to the public...

I do not work for and I do not have formal association with GL.iNet

kkl · 2022-05-17T04:17:02.538Z

wcs2228:

“what is needed is simply to open up the firewall to allow forwarding traffic to the public…”

Yes, that’s what I’m trying to understand how to do with the GL-AR150.

alzhao · 2022-05-17T08:46:50.169Z

If IPV6 is native, which means it can be accessed from the world.

Now the UI does not do port forward on ipv6. Even luci does not have that.

kkl · 2022-05-17T14:12:52.726Z

I’m not asking how to forward (i.e. redirect) a port, I’m asking how to open a port in the firewall.

wcs2228 · 2022-05-17T17:05:34.875Z

You should be able to add traffic rules via LuCI → Network → Firewall → Traffic Rules, or by directly editing the /etc/config/firewall file in SSH.

I do not work for and I do not have formal association with GL.iNet

kkl · 2022-05-17T18:21:26.408Z

Thank you wcs2228. I think that’s the right answer, I just haven’t been able to get it to work. I know that my path to the GL-AR150 is IPV6 compatible because if I can browse to its address, although it opens in LuCI, not the GUI. I can also tracert to it. However, when I tracert to the address behind its firewall it dies at the address just before the GL-AR150 with a “Destination host unreachable.” My traffic rule is pretty generic with everything allowed to the IPV6 destination address and port with the action of Accept. The IPV6 address is valid and works on the LAN in web browser. On the GL-AR150, I’ve tried NAT6 and Native for IPV6 mode.

kkl · 2022-05-17T18:50:07.298Z

Just got it working using one of the temporary IPV6 addresses so it might just be a matter of figuring out which of the dozen addresses is routable and stable. Thanks wcs2228.

kkl · 2022-05-18T02:40:00.457Z

There seems to be a problem in that the only IPv6 address works is a temporary one that is in the list of choices for “Destination address” in the firewall traffic rules. The permanent address isn’t in the list and if I add it manually, routing to it doesn’t work.

ICAKaBLO · 2022-08-08T16:30:56.870Z

kkl:

if I add [the stable privacy IPv6 address] manually, routing to it doesn’t work.

I guess, in the Web interface of your GL.iNet, you are using not the LAN mode ‘Native’ but ‘NAT6’. And I guess, ‘Native’ did not work for you at all. This is because …