NY <me@privacy.net> writes:
> If private addresses are propagated onto the WAN, that places the onus
> on every single device, even cheap security cameras etc, having its
> own secure firewall, rather than the router being the thing with the
> firewall, behind which there are devices that don't have and and don't
> need their own firewalls.

There's no reason you can't have routable IPs on your internal network
and still implement a firewall at the border.

It's what I do at home: every device on my LAN gets a routable IPv6
address, but my router (a Linux box) has a firewall configured to block
incoming connections.

john

On 2023-07-09 23:21, John wrote:
> NY <me@privacy.net> writes:
>> If private addresses are propagated onto the WAN, that places the onus
>> on every single device, even cheap security cameras etc, having its
>> own secure firewall, rather than the router being the thing with the
>> firewall, behind which there are devices that don't have and and don't
>> need their own firewalls.
>
> There's no reason you can't have routable IPs on your internal network
> and still implement a firewall at the border.
>
> It's what I do at home: every device on my LAN gets a routable IPv6
> address, but my router (a Linux box) has a firewall configured to block
> incoming connections.

My ISP is betatesting IPv6, and I volunteered, so I got IPv6. To my
surprise, all IPv6 hosts inside my lan became accessible from Internet.
Despite the (ISP suplied) router saying that the firewall was active and
blocking all incoming connections on IPv6, it was not happening.

I told them, they did not answer, but days later the incoming connection
to IPv6 stopped connecting. They had silently done something. However,
they messed with the "virtual server" IPv4 config, so that the incoming
external connections that I had allowed stopped working as well. I have
to periodically enable them back.

So beware, routers may fail to work properly on IPv6.

--
Cheers, Carlos.

Carlos E.R. wrote:

[snip]

>
> My ISP is betatesting IPv6, and I volunteered, so I got IPv6. To my
> surprise, all IPv6 hosts inside my lan became accessible from Internet.
> Despite the (ISP suplied) router saying that the firewall was active and
> blocking all incoming connections on IPv6, it was not happening.
>
>
> I told them, they did not answer, but days later the incoming connection
> to IPv6 stopped connecting. They had silently done something. However,
> they messed with the "virtual server" IPv4 config, so that the incoming
> external connections that I had allowed stopped working as well. I have
> to periodically enable them back.
>
>
> So beware, routers may fail to work properly on IPv6.

I suspect lots of cheap routers have a very primitive firewall, and
effectively they only block incoming connections by virtue of NAT.

--
Graham J

On 2023-07-10 13:43, Graham J wrote:
> Carlos E.R. wrote:
>
> [snip]
>
>>
>> My ISP is betatesting IPv6, and I volunteered, so I got IPv6. To my
>> surprise, all IPv6 hosts inside my lan became accessible from
>> Internet. Despite the (ISP suplied) router saying that the firewall
>> was active and blocking all incoming connections on IPv6, it was not
>> happening.
>>
>>
>> I told them, they did not answer, but days later the incoming
>> connection to IPv6 stopped connecting. They had silently done
>> something. However, they messed with the "virtual server" IPv4 config,
>> so that the incoming external connections that I had allowed stopped
>> working as well. I have to periodically enable them back.
>>
>>
>> So beware, routers may fail to work properly on IPv6.
>
> I suspect lots of cheap routers have a very primitive firewall, and
> effectively they only block incoming connections by virtue of NAT.

It doesn't seem the case, but rather a bug. This telco uses customized
routers to their specs, and as they haven't deployed IPv6 no one was
actually testing IPv6 related features. Now they appear with betatesting.

--
Cheers, Carlos.

On 09/07/2023 14:06, Java Jive wrote:
>
> Many thanks for your continuing help, Theo ...
>
> On 08/07/2023 22:45, Theo wrote:
>>
>> In uk.telecom.broadband Java Jive <java@evij.com.invalid> wrote:
>>>
>>> config interface 'WAN_Huawei_E3372h'
>>>          option proto 'dhcp'
>>>          option ifname 'eth1'
>>>
>>> [snip]
>>>
>>> The above all works fine in IP4, but I'm concerned that I have removed
>>> the original WAN6 section.  Following the pattern of that, I could
>>> define a WAN6 section for each of the above, as per the following
>>> example ...
>>>
>>> config interface 'WAN_Huawei_E3372h'
>>>          option ifname 'eth1'
>>>          option proto 'dhcp'
>>>
>>>
>>> config interface 'WAN_Huawei_E3372h_6'
>>>           option ifname '@WAN_Huawei_E3372h'
>>>           option proto 'dhcpv6'
>>>
>>> ... and similarly for the others, but this seems somewhat clumsy because
>>> to swap dongles, I'd have to stop two connections and start two others,
>>> instead of just the one as at present, and further I have no idea if it
>>> will work  -  ATM the BT Assure 4G dongle is in use and is working well
>>> downloading Wimbledon, so I'm not inclined to fiddle about testing just
>>> now ...
>>
>> [snip]
>>
>> But what I'd do is keep everything set up, and just pick routing based on
>> which interface is up.  ie if only one dongle is plugged in, only one
>> configuration block is going to be active.  I think if only one is
>> plugged in, without any special config you'll get a default route and that's
>> where packets will go.  If both are plugged in, one default route will win -
>> although fancier routing config is possible.
>>
>> I think if you just configure both interfaces as appropriate and see
>> if they work if one or other dongle is plugged in.
>>
>> I think you may need to put all your WAN_* interfaces in the WAN firewall
>> zone, so they're all treated as 'outside' your network.  The defaults are
>> mostly there - on my Firewall setup I have in the 'wan' zone:

Today I turned off and disconnected from the mains all my electronic kit
to protect it while some thunderstorms passed, so on bringing it back up
I've just had a go at this. The relevant sections from the config files
now read:

/etc/config/network:

config interface 'WAN_DSL'
option proto 'pppoa'
option encaps 'vc'
option atmdev '0'
option vci '38'
option vpi '0'
option macaddr '<MAC Address>'
option ipv6 'auto'
option metric '2'
option auto '0'

config interface 'WAN_DSL_6'
option ifname '@WAN_DSL'
option proto 'dhcpv6'
option auto '0'

config interface 'WAN_Ethernet'
option proto 'dhcp'
option ifname 'eth0.2'
option hostname 'MacFH-HH5a-T3'
option macaddr '<MAC Address>'
option auto '0'

config interface 'WAN_Ethernet_6'
option ifname '@WAN_Ethernet'
option proto 'dhcpv6'
option auto '0'

config interface 'WAN_Huawei_E3372h'
option proto 'dhcp'
option ifname 'eth1'

config interface 'WAN_Huawei_E3372h_6'
option ifname '@WAN_Huawei_E3372h'
option proto 'dhcpv6'

config interface 'WAN_Huawei_E3372s'
option proto 'ncm'
option pdptype 'IP'
option apn '3internet'
option ipv6 'auto'
option device '/dev/ttyUSB0'
option delay '20'
option auto '0'

config interface 'WAN_Huawei_E3372s_6'
option ifname '@WAN_Huawei_E3372s'
option proto 'dhcpv6'
option auto '0'

config interface 'WAN_USB'
option proto 'dhcp'
option ifname 'usb0'
option auto '0'

config interface 'WAN_USB_6'
option ifname '@WAN_USB'
option proto 'dhcpv6'
option auto '0'

/etc/config/network:

config zone
option name 'wan'
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
option masq '1'
option mtu_fix '1'
option network 'WAN_DSL WAN_DSL_6 WAN_Ethernet WAN_Ethernet_6
WAN_Huawei_E3372h WAN_Huawei_E3372h_6 WAN_Huawei_E3372s
WAN_Huawei_E3372s_6 WAN_USB WAN_USB_6'

[no line wrap in original]

In the admin pages each IP6 interfaces come up as an alias of its
corresponding IP4 interface, as one might expect. If the corresponding
IP4 is not connected, but the IP6 is, then there is a message saying
'Device not present', which again makes sense.

Concerning behaviour, the first thing of note is that unfortunately I
have to have the '_6' devices that aren't being used
stopped/disconnected, otherwise nothing works, not even IP4.

So currently I have just the WAN_Huawei_E3372h & WAN_Huawei_E3372h_6
interfaces connected, but the results are as the same as before ...

>>> How can I test whether IP6 is being supported properly?
>>
>> $ host example.com
>> example.com has address 93.184.216.34
>> example.com has IPv6 address 2606:2800:220:1:248:1893:25c8:1946
>> example.com mail is handled by 0 .
>>
>> $ ping6 2606:2800:220:1:248:1893:25c8:1946
>> [should answer]

15:57:26 D:\Temp>ping -4 93.184.216.34

Pinging 93.184.216.34 with 32 bytes of data:
Reply from 93.184.216.34: bytes=32 time=132ms TTL=49
Reply from 93.184.216.34: bytes=32 time=139ms TTL=49
Reply from 93.184.216.34: bytes=32 time=137ms TTL=49
Reply from 93.184.216.34: bytes=32 time=132ms TTL=49

Ping statistics for 93.184.216.34:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 132ms, Maximum = 139ms, Average = 135ms

15:57:33 D:\Temp>ping -6 2606:2800:220:1:248:1893:25c8:1946

Pinging 2606:2800:220:1:248:1893:25c8:1946 with 32 bytes of data:
PING: transmit failed. General failure.
PING: transmit failed. General failure.
PING: transmit failed. General failure.
PING: transmit failed. General failure.

Ping statistics for 2606:2800:220:1:248:1893:25c8:1946:
Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),

15:58:58 D:\Temp>ping -4 bbc.co.uk

Pinging bbc.co.uk [151.101.128.81] with 32 bytes of data:
Reply from 151.101.128.81: bytes=32 time=72ms TTL=54
Reply from 151.101.128.81: bytes=32 time=86ms TTL=54
Reply from 151.101.128.81: bytes=32 time=81ms TTL=54
Reply from 151.101.128.81: bytes=32 time=64ms TTL=54

Ping statistics for 151.101.128.81:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 64ms, Maximum = 86ms, Average = 75ms

15:57:58 D:\Temp>ping -6 bbc.co.uk
Ping request could not find host bbc.co.uk. Please check the name and
try again.

--

Fake news kills!

I may be contacted via the contact address given on my website:
www.macfh.co.uk

In uk.telecom.broadband Java Jive <java@evij.com.invalid> wrote:
> Today I turned off and disconnected from the mains all my electronic kit
> to protect it while some thunderstorms passed, so on bringing it back up
> I've just had a go at this. The relevant sections from the config files
> now read:
>
> /etc/config/network:
>
> config interface 'WAN_DSL'
> option proto 'pppoa'
> option encaps 'vc'
> option atmdev '0'
> option vci '38'
> option vpi '0'
> option macaddr '<MAC Address>'
> option ipv6 'auto'
> option metric '2'
> option auto '0'
>
> config interface 'WAN_DSL_6'
> option ifname '@WAN_DSL'
> option proto 'dhcpv6'
> option auto '0'
>
> config interface 'WAN_Ethernet'
> option proto 'dhcp'
> option ifname 'eth0.2'
> option hostname 'MacFH-HH5a-T3'
> option macaddr '<MAC Address>'
> option auto '0'
>
> config interface 'WAN_Ethernet_6'
> option ifname '@WAN_Ethernet'
> option proto 'dhcpv6'
> option auto '0'
>
> config interface 'WAN_Huawei_E3372h'
> option proto 'dhcp'
> option ifname 'eth1'
>
> config interface 'WAN_Huawei_E3372h_6'
> option ifname '@WAN_Huawei_E3372h'
> option proto 'dhcpv6'
>
> config interface 'WAN_Huawei_E3372s'
> option proto 'ncm'
> option pdptype 'IP'
> option apn '3internet'
> option ipv6 'auto'
> option device '/dev/ttyUSB0'
> option delay '20'
> option auto '0'
>
> config interface 'WAN_Huawei_E3372s_6'
> option ifname '@WAN_Huawei_E3372s'
> option proto 'dhcpv6'
> option auto '0'
>
> config interface 'WAN_USB'
> option proto 'dhcp'
> option ifname 'usb0'
> option auto '0'
>
> config interface 'WAN_USB_6'
> option ifname '@WAN_USB'
> option proto 'dhcpv6'
> option auto '0'
>
> /etc/config/network:
>
> config zone
> option name 'wan'
> option input 'REJECT'
> option output 'ACCEPT'
> option forward 'REJECT'
> option masq '1'
> option mtu_fix '1'
> option network 'WAN_DSL WAN_DSL_6 WAN_Ethernet WAN_Ethernet_6
> WAN_Huawei_E3372h WAN_Huawei_E3372h_6 WAN_Huawei_E3372s
> WAN_Huawei_E3372s_6 WAN_USB WAN_USB_6'
>
> [no line wrap in original]
>
> In the admin pages each IP6 interfaces come up as an alias of its
> corresponding IP4 interface, as one might expect. If the corresponding
> IP4 is not connected, but the IP6 is, then there is a message saying
> 'Device not present', which again makes sense.
>
> Concerning behaviour, the first thing of note is that unfortunately I
> have to have the '_6' devices that aren't being used
> stopped/disconnected, otherwise nothing works, not even IP4.
>
> So currently I have just the WAN_Huawei_E3372h & WAN_Huawei_E3372h_6
> interfaces connected, but the results are as the same as before ...

I think we're missing a lot of details:

1. Does the mobile network support IPv6?
2. How are addresses handed out?
3. What address ranges do they allocate you?
4. Does the stick support IPv6?
5. How does the stick convey those addresses to the host?
6. Is the network addressing different from the address for the router

For a traditional wired ISP the answers would be:
1. Yes or no, depending on the ISP
2. Depends on the connection to the modem, eg ethernet (DHCPv6 or SLAAC) or
PPPoE (PPP address allocation)
3. At least a /64 for the router, and an additional /56 or larger range is
common
4. Most modern routers have IPv6 support
5. Either SLAAC or DHCPv6
6. Often the router gets its own IP via SLAAC and then is able to DHCPv6 to
get the subnet range(s)

But I have no idea of the answers for specific mobile networks, and I have
even less of an idea how random LTE sticks choose to mangle them, with their
own kinds of weird implementations like pretending to be a dialup modem or
pretending to be an ethernet card or whatever - which may and often are
buggy and broken.

If it 'doesn't work' then we don't have anything to go on, and some analysis
of logs and interaction with the connection is going to be needed to
understand what is actually going on.

As a first step, I'd be looking to make sure the stick's interface on the
router can get a global IPv6 address, as if that isn't working there is no
v6 connectivity and nothing will work. Once there is a global address, then
you need to find out whether there is a prefix being delegated (and if so,
you can apply that to the LAN), or doing something else if you only get a
single address.

Theo

On 10/07/2023 17:58, Theo wrote:
>
> I think we're missing a lot of details:

Fair point, I was in a bit of a hurry earlier ...

> 1. Does the mobile network support IPv6?

Can't find a definitive pronouncement, but I'm beginning to suspect not,
at least not here out in the sticks, for example this report dates from
2020 ...

https://www.ispreview.co.uk/talk/threads/three-ipv6-rollout.36873/

"We’ve started to migrate traffic onto our new core network. These
customers are currently using our new core network intermittently
resulting in some browsing occurring on IPv6. This will gradually
increase as we migrate more traffic"

.... and when I was first on Three here in early 2021 I could barely get
4G, connections usually defaulted to 3G. However, for some while now
they have been and are nearly always 4G, and one might have thought that
upgrading to 4G might be the obvious time to upgrade to IP6 as well.

However, against that supposition, in support of 'No IP6':

:-( The mobile phone is Android 7.0, several versions later than the
beginning of IP6 support, but it doesn't have an IP6 address listed
alongside its IP4 address.

:-( I don't know if the dongle supports IP6 or not, but in its web
interface it too has no IP6 address listed with its IP4 address.

:-( Ditto in the interfaces section of the router, the IP4 connection
shows an IP4 address, but the IP6 connection shows no IP6 address.

So I guess that's it, unless I can find a test SIM from another network
that supports IP6 in this area.

> 2. How are addresses handed out?
> 3. What address ranges do they allocate you?
> 4. Does the stick support IPv6?
> 5. How does the stick convey those addresses to the host?
> 6. Is the network addressing different from the address for the router

--

Fake news kills!

I may be contacted via the contact address given on my website:
www.macfh.co.uk

On 10/07/2023 22:43, Java Jive wrote:
> On 10/07/2023 17:58, Theo wrote:
>>
>> I think we're missing a lot of details:
>
> Fair point, I was in a bit of a hurry earlier ...
>
>> 1. Does the mobile network support IPv6?
>
> Can't find a definitive pronouncement, but I'm beginning to suspect not,
> at least not here out in the sticks, for example this report dates from
> 2020 ...
>
> https://www.ispreview.co.uk/talk/threads/three-ipv6-rollout.36873/
>
> "We’ve started to migrate traffic onto our new core network. These
> customers are currently using our new core network intermittently
> resulting in some browsing occurring on IPv6. This will gradually
> increase as we migrate more traffic"
>
> ... and when I was first on Three here in early 2021 I could barely get
> 4G, connections usually defaulted to 3G.  However, for some while now
> they have been and are nearly always 4G, and one might have thought that
> upgrading to 4G might be the obvious time to upgrade to IP6 as well.
>
> However, against that supposition, in support of 'No IP6':
>
>  :-( The mobile phone is Android 7.0, several versions later than the
> beginning of IP6 support, but it doesn't have an IP6 address listed
> alongside its IP4 address.
>
>  :-( I don't know if the dongle supports IP6 or not, but in its web
> interface it too has no IP6 address listed with its IP4 address.

Apparently it does (in apparently machine translated in English):

https://consumer.huawei.com/en/community/details/E3372h-320-IPV6-support-4gLTE-access-and-issues-with-microsoft-KB5003637/topicId_157767/

"Regarding your inquiry, please be informed 4G LTE and IPV6 do supported
by it. Besides, IPV6 will be supported by default and you are not
required to enable it manually."

>  :-( Ditto in the interfaces section of the router, the IP4 connection
> shows an IP4 address, but the IP6 connection shows no IP6 address.
>
> So I guess that's it, unless I can find a test SIM from another network
> that supports IP6 in this area.
>
>> 2. How are addresses handed out?
>> 3. What address ranges do they allocate you?
>> 4. Does the stick support IPv6?
>> 5. How does the stick convey those addresses to the host?
>> 6. Is the network addressing different from the address for the router

--

Fake news kills!

I may be contacted via the contact address given on my website:
www.macfh.co.uk

On 2023-07-10 23:43, Java Jive wrote:
> On 10/07/2023 17:58, Theo wrote:

> However, against that supposition, in support of 'No IP6':
>
>  :-( The mobile phone is Android 7.0, several versions later than the
> beginning of IP6 support, but it doesn't have an IP6 address listed
> alongside its IP4 address.
>
>  :-( I don't know if the dongle supports IP6 or not, but in its web
> interface it too has no IP6 address listed with its IP4 address.
>
>  :-( Ditto in the interfaces section of the router, the IP4 connection
> shows an IP4 address, but the IP6 connection shows no IP6 address.
>
> So I guess that's it, unless I can find a test SIM from another network
> that supports IP6 in this area.

For example, with my mobile provider (Movistar, Spain), I had to do a
config change. I had to select an alternate APN or edit it.

https://www.xataka.com/basics/como-activar-protocolo-ipv6-tu-movil-eres-cliente-movistar-u-o2

Android only at the date of publication of the article; iPhone needed an
iOS update first, adding APN dual stack as used by Telefónica/Movistar.

--
Cheers, Carlos.

On Tuesday, July 11, 2023 at 11:53:45 PM UTC+5, Carlos E.R. wrote:
> On 2023-07-10 23:43, Java Jive wrote:
> > On 10/07/2023 17:58, Theo wrote:
>
>
> > However, against that supposition, in support of 'No IP6':
> >
> > :-( The mobile phone is Android 7.0, several versions later than the
> > beginning of IP6 support, but it doesn't have an IP6 address listed
> > alongside its IP4 address.
> >
> > :-( I don't know if the dongle supports IP6 or not, but in its web
> > interface it too has no IP6 address listed with its IP4 address.
> >
> > :-( Ditto in the interfaces section of the router, the IP4 connection
> > shows an IP4 address, but the IP6 connection shows no IP6 address.
> >
> > So I guess that's it, unless I can find a test SIM from another network
> > that supports IP6 in this area.
> For example, with my mobile provider (Movistar, Spain), I had to do a
> config change. I had to select an alternate APN or edit it.
>
> https://www.xataka.com/basics/como-activar-protocolo-ipv6-tu-movil-eres-cliente-movistar-u-o2
>
> Android only at the date of publication of the article; iPhone needed an
> iOS update first, adding APN dual stack as used by Telefónica/Movistar.
>
>
>
> --
> Cheers, Carlos.
https://rk-77-rk.blogspot.com/