I am trying to get ipv6 working on my openwrt router and I have found a disturbing problem with the ipv6 access. When I access the router from an external ip address using its [router:ipv6:address], it connects. With Ipv4, it doesn’t. I don’t want anyone to be able to connect to the router itself from the outside.
Also, I want both ipv4 and ipv6 connects to the router from the external internet to be port forwarded to the web server on another machine. External connects should never connect to the router luci page. This was working with port forwarding with ipv4 and I created another rule that port forwards ipv6 traffic on port 80 to the web server.
So is there an easy way to block all external public traffic to luci, but still allow port forwards to local machines on the lan? But still allow access to luci from internal local lan ip addresses?
From inside the network, this may be possible, but it will not be from outside... at least assuming you haven't changed things from their defaults with respect to the wan/wan6 interfaces and the firewall.
Did you test from outside your network (using a mobile phone on cellular, for example)?
Please connect to your OpenWrt device using ssh and copy the output of the following commands and post it here using the "Preformatted text </> " button:
Remember to redact passwords, VPN keys, MAC addresses and any public IP addresses you may have:
ubus call system board
cat /etc/config/network
cat /etc/config/firewall
I tried to use the preformatted thing, but it wasn't working right. Here are the requested files. I tried to redact everything,
Yes, I used my cell phone data interface to try to test the web server's ipv6 connection using the router's [::ip6::] direct address. I put in a rule to port forward ip6 port 80 traffic to the web server. The apache web server is a different machine and not on the router. I admit being ipv6 illiterate. Anyhow, instead of port forwarding the packet, it connected to LUCI on the router. That should not be allowed. I have not tried to see if SSH is also exposed, but it shouldn't be ether. With the exception of apache and asterisk, nothing else should be exposed to the web. Remote access is still possible, but only through wireguard. At least that's the way its supposed to work.
Requested data follows. Sorry if its not preformatted right.
I'm using apache not nginx and its located on a separate machine. I still want IPv6 and IPv4 to work for everything its supposed to work on. There is also a camera server and cameras on the same network that are connected to a vlan that are blocked from all internet access (both directions), but accessible from wireguard and local addresses. At least that is the intention.
It seems that IPv6 is giving all my local devices a public IPv6 which is distressing. I want everything to go through the router without exception and nothing goes to a local device without the router explicitly allowing it.
I also ran an external port scan from a web site. I don't know what is going on here. This morning I'm getting all ports closed. Yesterday, http was open. So at least this says that ssh is closed.
I tried the web server's prefixed IPv6 address also and it also says everything is closed. But it shouldn't be. The web server should show port 80 open because there is a port forwarding rule for that.
Starting Nmap 7.80 ( https://nmap.org ) at 2025-10-15 11:37 UTC
Nmap scan report for 2001:558:zzzz:zzz:zzzz:wwww:wwww:wwww
Host is up (0.036s latency).
PORT STATE SERVICE VERSION
21/tcp closed ftp
22/tcp closed ssh
23/tcp closed telnet
80/tcp closed http
110/tcp closed pop3
143/tcp closed imap
443/tcp closed https
3389/tcp closed ms-wbt-server
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 0.75 seconds
Dude, thats the whole point. It was even so with IPv4. Rfc1918 and nat was only invented like 15 years later because the experiment escaped the universities lab.
Since IPv6 (configured as you have, which is the best way) does not NAT, access to a v6 web server on the LAN is simply a traffic rule forward, not a port forward.
config rule
option name 'Allow_v6_http_servers'
option family ipv6
option src wan
option dest lan
option dest_port 80
option proto tcp
SInce this does not filter dest_ip, any and every LAN device listening on port 80 will be reachable from outside. You probably don't want that, so if the web server is at a constant IP you can add option dest_ip to constrain the rule to that one device. In many cases the ISP will change the first 64 bits of your line's V6 address on you, so there is the '/-64' syntax to filter on only the last 64 bits which you control.
However, the online port scanner still shows the same IPv6 address as closed. I can live with it as long as nobody can access my router from the outside.
