[IPv6] Cannot open firewall from WAN to LAN
Hello.
I am facing an issue very similar to what is described on this thead : https://community.tp-link.com/en/business/forum/topic/638114
I have IPv6 connectivity from my ISP, I can reach IPv6 Internet without issue (LAN->WAN) and IPv6 networks between my networks (LAN->LAN) also.
But impossible to open the firewall for incoming traffic.
I tried to setup a wildcard ACL to allow all incoming IPv6 traffic without success.
I do see the incoming packet on the WAN side on the device connected just before it, however I never see the packet coming to my server (I tried with ICMPv6 and HTTPs, same issue with both)
I can´t explain why this is not working, is there any known issue about this ?
The rule I created (I don´t have any other active rule):
Thank you.
- Copy Link
- Subscribe
- Bookmark
- Report Inappropriate Content
Hi @K3dare
Thanks for posting in our business forum.
I have a simple question, will you be able to ping the v6 address of the gateway? The public IP. Not the link-local.
If you could, then the access is not blocked. The rule is effective.
You should also check your firewall on the PC that's being accessed or pinged.
If you can paste screenshots to illustrate the verification, that'd be great.
Please mosaic your sensitive information. Here is a list of information considered sensitive:
1. Public IP address on your WAN if your WAN is.
2. Real MAC address of your device.
3. Your personal information including address, domain name, and credentials.
For troubleshooting purposes, when a WAN IP is needed, please leave some values visible for identification.
- Copy Link
- Report Inappropriate Content
@Clive_A Hello, thank you for your fast message.
I cannot ping the WAN IPv4 of the gateway, even from the network device right in front of it (ESBCN-HEX1, that provide the RA on the WAN side and that is on the same subnet) so it looks like it's indeed blocked at this level.
On the final server there are no firewall configured (and it worked fine using the router we had before the Omada gateway)
Attached some screenshots from the test :
However as said before LAN to WAN and LAN to LAN is working fine, only WAN to LAN is impacted.
Thank you.
- Copy Link
- Report Inappropriate Content
I suspect I may have found the issue.
It looks like the connection state (in devices > the gateway > WAN port) is not really consistent.
It was in a disconnected state but I had working IPv6 connectivity LAN to WAN, only WAN to LAN would not work it looks like ?
I have setup DNS servers for the IPv6 connectivity (as the EX would not provide them via SLAAC/RRDNS) and now it go into connected state (before it would stay in a disconnected state and fail to pass to a connected state even though I had working LAN to WAN IPv6 connectivity)
Now I can ping IPv6 hosts inside my network from outside (like a VM from a cloud provider) but I cannot ping anything in my network from the HEX itself (so the first hop in front of the gateway), also nothing can ping my IPv6 WAN address (maybe there are specific rules for this ?)
I am not sure if it's really this or just a coincidence.
- Copy Link
- Report Inappropriate Content
Hi @K3dare
Thanks for posting in our business forum.
K3dare wrote
I suspect I may have found the issue.
It looks like the connection state (in devices > the gateway > WAN port) is not really consistent.
It was in a disconnected state but I had working IPv6 connectivity LAN to WAN, only WAN to LAN would not work it looks like ?
I have setup DNS servers for the IPv6 connectivity (as the EX would not provide them via SLAAC/RRDNS) and now it go into connected state (before it would stay in a disconnected state and fail to pass to a connected state even though I had working LAN to WAN IPv6 connectivity)
Now I can ping IPv6 hosts inside my network from outside (like a VM from a cloud provider) but I cannot ping anything in my network from the HEX itself (so the first hop in front of the gateway), also nothing can ping my IPv6 WAN address (maybe there are specific rules for this ?)
I am not sure if it's really this or just a coincidence.
Not sure about your HEX device. As for now, it at least proves the v6 WAN IN is working.
For any devices that are not working, check their firewall. There is no other solution or suggestion that can be proposed.
About the router v6 address that you cannot ping, do you mean this?
For this problem, it would be strange.
- Copy Link
- Report Inappropriate Content
Information
Helpful: 0
Views: 198
Replies: 4
Voters 0
No one has voted for it yet.