Always changing IPv6. How to set up firewall rule?

Installing and Using OpenWrt
1

How do you set up ipv6 firewall rules if the ipv6 prefix changing every day or so?

2

You set them based on the suffix, not the prefix.

2 Likes
3

If the full IPv6 address you want to use in a rule was (for example) 2001:db80:0:110:a00:27ff:fe67:cd9, then you'd use ::a00:27ff:fe67:cd9/-64 as the IP address in the rule.

2 Likes
4

Thanks

How do you fix the end tail of the IPv6 address in Luci per mac address?
Firewall also working with destination mac addresses?

5

No idea. If I want a device to have a static IPv6 address I set it on the device.

Probably. Have you tried?

6

Read about DUID.

DUID Level 3 is based on the mac but in practical terms mac is not used in IPv6 like in IPv4. Usually Level 1 and 2 are used with more complex DUID than mac.

1 Like
7

The DUID of your LAN clients can be seen on the Status > Overview page under Active DHCPv6 Leases

You can just click the Static lease button in that page or setup a manual static lease which looks like this:
/etc/config/dhcp

config host
	option dns '1'
	option name 'EA8500'
	option mac 'C0:56:27:xx:xx:xx'
	option ip '192.168.0.6'
	option leasetime '6h'
	option duid '00030001c05627xxxxxx'
	option hostid '06'

This is a router doing VPN which gets the IPv6 address prefix::6

I noticed that even with only the MAC address and without DUID it seems to work

Open Up the firewall for this router with:
/etc/config/firewall:

config rule
	option name 'wg-server6-6'
	list proto 'udp'
	option src 'wan'
	option dest 'lan'
	option dest_port '51810'
	option target 'ACCEPT'
	option family 'ipv6'
	list dest_ip '::6/-64'
3 Likes
8

Thanks! This 'hostid' looks good.