Home

Forums

Stories

Knowledge Base

Business Community > Routers > [IPv6] Cannot open firewall from WAN to LAN

< Routers

[IPv6] Cannot open firewall from WAN to LAN

K3dare

2024-08-14 18:44:29

Posts: 7

Helpful: 8

Solutions: 0

Stories: 0

Registered: 2024-08-14

[IPv6] Cannot open firewall from WAN to LAN

2024-08-14 18:44:29

Tags: #IPv6 #ACL

Model: ER707-M2

Hardware Version: V1

Firmware Version: 1.2.2 Build 20240324 Rel.42799

Hello.

I am facing an issue very similar to what is described on this thead : https://community.tp-link.com/en/business/forum/topic/638114

I have IPv6 connectivity from my ISP, I can reach IPv6 Internet without issue (LAN->WAN) and IPv6 networks between my networks (LAN->LAN) also.

But impossible to open the firewall for incoming traffic.

I tried to setup a wildcard ACL to allow all incoming IPv6 traffic without success.

I do see the incoming packet on the WAN side on the device connected just before it, however I never see the packet coming to my server (I tried with ICMPv6 and HTTPs, same issue with both)

I can´t explain why this is not working, is there any known issue about this ?

The rule I created (I don´t have any other active rule):

Thank you.

4 Reply

Clive_A

2024-08-15 01:47:59

Posts: 6018

Helpful: 2962

Solutions: 1381

Stories: 0

Registered: 2023-06-09

Re:[IPv6] Cannot open firewall from WAN to LAN

2024-08-15 01:47:59

Hi @K3dare

Thanks for posting in our business forum.

I have a simple question, will you be able to ping the v6 address of the gateway? The public IP. Not the link-local.

If you could, then the access is not blocked. The rule is effective.

You should also check your firewall on the PC that's being accessed or pinged.

If you can paste screenshots to illustrate the verification, that'd be great.

Please mosaic your sensitive information. Here is a list of information considered sensitive:

1. Public IP address on your WAN if your WAN is.

2. Real MAC address of your device.

3. Your personal information including address, domain name, and credentials.

For troubleshooting purposes, when a WAN IP is needed, please leave some values visible for identification.

Best Regards! If you are new to the forum, please read: Howto - A Guide to Use Forum Effectively. Read Before You Post. Look for a model? Search your model NOW Official and Beta firmware. NEW features! Subscribe for the latest update! ☛Download Beta Here☚ ☛ ★ Configuration Guide ★ ☚ ☛ ★ Knowledge Base ★ ☚ ☛ ★ Troubleshooting ★ ☚ ● Be kind and nice. ● Stay on the topic. ● Post details. ● Search first. ● Please don't take it for granted. ● No email confidentiality should be violated. ● S/N, MAC, and your true public IP should be mosaiced.

K3dare

LV1

2024-08-15 10:07:25

Posts: 7

Helpful: 8

Solutions: 0

Stories: 0

Registered: 2024-08-14

Re:[IPv6] Cannot open firewall from WAN to LAN

2024-08-15 10:07:25

@Clive_A Hello, thank you for your fast message.

I cannot ping the WAN IPv4 of the gateway, even from the network device right in front of it (ESBCN-HEX1, that provide the RA on the WAN side and that is on the same subnet) so it looks like it's indeed blocked at this level.

On the final server there are no firewall configured (and it worked fine using the router we had before the Omada gateway)

Attached some screenshots from the test :

However as said before LAN to WAN and LAN to LAN is working fine, only WAN to LAN is impacted.

Thank you.

K3dare

LV1

2024-08-15 10:57:29

Posts: 7

Helpful: 8

Solutions: 0

Stories: 0

Registered: 2024-08-14

Re:[IPv6] Cannot open firewall from WAN to LAN

2024-08-15 10:57:29

I suspect I may have found the issue.

It looks like the connection state (in devices > the gateway > WAN port) is not really consistent.

It was in a disconnected state but I had working IPv6 connectivity LAN to WAN, only WAN to LAN would not work it looks like ?

I have setup DNS servers for the IPv6 connectivity (as the EX would not provide them via SLAAC/RRDNS) and now it go into connected state (before it would stay in a disconnected state and fail to pass to a connected state even though I had working LAN to WAN IPv6 connectivity)

Now I can ping IPv6 hosts inside my network from outside (like a VM from a cloud provider) but I cannot ping anything in my network from the HEX itself (so the first hop in front of the gateway), also nothing can ping my IPv6 WAN address (maybe there are specific rules for this ?)

I am not sure if it's really this or just a coincidence.

Clive_A

2024-08-16 03:11:15

Posts: 6018

Helpful: 2962

Solutions: 1381

Stories: 0

Registered: 2023-06-09

Re:[IPv6] Cannot open firewall from WAN to LAN

2024-08-16 03:11:15

Hi @K3dare

Thanks for posting in our business forum.

K3dare wrote

I suspect I may have found the issue.

It looks like the connection state (in devices > the gateway > WAN port) is not really consistent.

It was in a disconnected state but I had working IPv6 connectivity LAN to WAN, only WAN to LAN would not work it looks like ?

I have setup DNS servers for the IPv6 connectivity (as the EX would not provide them via SLAAC/RRDNS) and now it go into connected state (before it would stay in a disconnected state and fail to pass to a connected state even though I had working LAN to WAN IPv6 connectivity)

Now I can ping IPv6 hosts inside my network from outside (like a VM from a cloud provider) but I cannot ping anything in my network from the HEX itself (so the first hop in front of the gateway), also nothing can ping my IPv6 WAN address (maybe there are specific rules for this ?)

I am not sure if it's really this or just a coincidence.

Not sure about your HEX device. As for now, it at least proves the v6 WAN IN is working.

For any devices that are not working, check their firewall. There is no other solution or suggestion that can be proposed.

About the router v6 address that you cannot ping, do you mean this?

For this problem, it would be strange.

[IPv6] Cannot open firewall from WAN to LAN

[IPv6] Cannot open firewall from WAN to LAN

Information

Voters 0

Tags