# IPv6 and port forwarding **URL:** \ **Category:** Network and Wireless Configuration\ **Created:** [December 27, 2018, 2:38am UTC](https://forum.openwrt.org/t/ipv6-and-port-forwarding/27770 "2018-12-27T02:38:33Z")\ **Posts on this page:** 14\ **Page:** 1
**Author:** ![asguard](https://forum.openwrt.org/letter_avatar/asguard/32/5_5575768a8748004e209b776fc1b2916d.png) [@asguard](https://forum.openwrt.org/u/asguard)\ **Post date:** [December 27, 2018, 2:38am UTC](https://forum.openwrt.org/t/ipv6-and-port-forwarding/27770/1 "2018-12-27T02:38:33Z")
Hi, I'm running Lede/Openwrt 17.01.4 and have port forwarding set up for ports 22, 80 and 443 to a server. IPv4 addresses are appropriately forwarded to the server but not IPv6 addresses. I.e., running tcpdump on both the router and the server, I see requests hit the router but only IPv4 requests hit the server. What do I need to do to get port forwarding to work under IPv6? Thanks! ---
**Author:** ![Sparks](https://forum.openwrt.org/user_avatar/forum.openwrt.org/sparks/32/8563_2.png) [@Sparks](https://forum.openwrt.org/u/Sparks)\ **Post date:** [December 27, 2018, 3:06am UTC](https://forum.openwrt.org/t/ipv6-and-port-forwarding/27770/2 "2018-12-27T03:06:44Z")
What does iptables -vL show? Are you seeing drops counters increasing ? ---
**Author:** ![dlakelan](https://forum.openwrt.org/user_avatar/forum.openwrt.org/dlakelan/32/2320_2.png) [@dlakelan](https://forum.openwrt.org/u/dlakelan)\ **Post date:** [December 27, 2018, 4:13am UTC](https://forum.openwrt.org/t/ipv6-and-port-forwarding/27770/3 "2018-12-27T04:13:04Z")
Port "forwarding" where packets destined _for the router's IP_ are instead rewritten and forwarded to a private IP on the LAN side is not necessary under ipv6, what is needed is simply to open up the firewall to allow forwarding traffic to the _public_ IP of the server as there are plenty of public addresses to go around for everyone (times several thousand trillion) Suppose 2002::1 is your router, and 2002::2 is the server on your LAN you want to make available to the world, then create a new forwarding rule in LuCI, from WAN to LAN, click add and edit, select ipv6 family, allow any address in WAN to access 2002::2 on the destination port you choose with action "accept" voila. Now it's likely that you have issues with your _prefix_ changing, hopefully not too often, but maybe if your power goes out for a day when your internet comes back up you have a new ipv6 prefix, so you'll want to check and edit this rule after such events. Some people have ISPs that haven't a clue or are actually malicious and change the prefix on a regular basis, if you have that your connection isn't suitable for hosting your own server, or you should use a tunnel. ---
**Author:** ![lleachii](https://forum.openwrt.org/letter_avatar/lleachii/32/5_5575768a8748004e209b776fc1b2916d.png) [@lleachii](https://forum.openwrt.org/u/lleachii)\ **Post date:** [December 27, 2018, 8:38am UTC](https://forum.openwrt.org/t/ipv6-and-port-forwarding/27770/4 "2018-12-27T08:38:09Z")
IPv6 isn't NATed, so you would use **Traffic Rules** to allow 22, 80 and 443/tcp traffic to the IP. Otherwise, it is identical to setting up a port forward for an IPv4 NATed address. ---
**Author:** ![asguard](https://forum.openwrt.org/letter_avatar/asguard/32/5_5575768a8748004e209b776fc1b2916d.png) [@asguard](https://forum.openwrt.org/u/asguard)\ **Post date:** [December 27, 2018, 4:46pm UTC](https://forum.openwrt.org/t/ipv6-and-port-forwarding/27770/5 "2018-12-27T16:46:41Z")
Thanks for all the replies. After playing around, the most restrictive traffic rule that seems to work is to forward all IPv6 requests from wan to the lan IPv6 address. If I try to restrict it to particular ports, it doesn't get forwarded. ---
**Author:** ![Sparks](https://forum.openwrt.org/user_avatar/forum.openwrt.org/sparks/32/8563_2.png) [@Sparks](https://forum.openwrt.org/u/Sparks)\ **Post date:** [December 27, 2018, 7:48pm UTC](https://forum.openwrt.org/t/ipv6-and-port-forwarding/27770/6 "2018-12-27T19:48:16Z")
Can you post an example of a rule that works and one that doesnt? ---
**Author:** ![asguard](https://forum.openwrt.org/letter_avatar/asguard/32/5_5575768a8748004e209b776fc1b2916d.png) [@asguard](https://forum.openwrt.org/u/asguard)\ **Post date:** [December 27, 2018, 8:12pm UTC](https://forum.openwrt.org/t/ipv6-and-port-forwarding/27770/7 "2018-12-27T20:12:45Z")
This works: IPv6-traffic From any host in wan To IP xxxx:xxx:xxxx:xxxx:xxx:xxxx:xxxx:xxxx in lan This does not: IPv6-traffic From any host in wan To IP xxxx:xxx:xxxx:xxxx:xxx:xxxx:xxxx:xxxx in lan at port 80 ---
**Author:** ![dlakelan](https://forum.openwrt.org/user_avatar/forum.openwrt.org/dlakelan/32/2320_2.png) [@dlakelan](https://forum.openwrt.org/u/dlakelan)\ **Post date:** [December 27, 2018, 9:13pm UTC](https://forum.openwrt.org/t/ipv6-and-port-forwarding/27770/8 "2018-12-27T21:13:56Z")
Can you post the actual config that doesn't work from /etc/config/firewall ---
**Author:** ![asguard](https://forum.openwrt.org/letter_avatar/asguard/32/5_5575768a8748004e209b776fc1b2916d.png) [@asguard](https://forum.openwrt.org/u/asguard)\ **Post date:** [December 27, 2018, 10:31pm UTC](https://forum.openwrt.org/t/ipv6-and-port-forwarding/27770/9 "2018-12-27T22:31:17Z")
The relevant part of /etc/config/firewall is: ``` config rule option target 'ACCEPT' option src 'wan' option dest 'lan' option dest_ip 'xxxx:xxx:xxxx:xxxx:xxx:xxxx:xxxx:xxxx' option family 'ipv6' option dest_port '80' option name 'kandinky-80' option src_port '80' ``` ---
**Author:** ![Sparks](https://forum.openwrt.org/user_avatar/forum.openwrt.org/sparks/32/8563_2.png) [@Sparks](https://forum.openwrt.org/u/Sparks)\ **Post date:** [December 27, 2018, 10:51pm UTC](https://forum.openwrt.org/t/ipv6-and-port-forwarding/27770/10 "2018-12-27T22:51:01Z")
Try dropping the sourcePort restriction from your rule. Clients will be using a random high port (30000+) not 80 when they connect inbound to your webserver ---
**Author:** ![asguard](https://forum.openwrt.org/letter_avatar/asguard/32/5_5575768a8748004e209b776fc1b2916d.png) [@asguard](https://forum.openwrt.org/u/asguard)\ **Post date:** [December 27, 2018, 10:55pm UTC](https://forum.openwrt.org/t/ipv6-and-port-forwarding/27770/11 "2018-12-27T22:55:49Z")
That works but the question is how do I configure it for ports 22 and 443? ``` config rule option target 'ACCEPT' option src 'wan' option dest 'lan' option dest_ip '2601:14d:4101:380b:208:9bff:fed0:65af' option family 'ipv6' option dest_port '80' option name 'kandinsky-80' ``` ---
**Author:** ![Sparks](https://forum.openwrt.org/user_avatar/forum.openwrt.org/sparks/32/8563_2.png) [@Sparks](https://forum.openwrt.org/u/Sparks)\ **Post date:** [December 27, 2018, 10:58pm UTC](https://forum.openwrt.org/t/ipv6-and-port-forwarding/27770/12 "2018-12-27T22:58:03Z")
Nice 👍. Just make additional rules substituting the destPort as needed. Im not in front of my pc at the moment, but uci config might support a list of ports if you want to be fancy ---
**Author:** ![asguard](https://forum.openwrt.org/letter_avatar/asguard/32/5_5575768a8748004e209b776fc1b2916d.png) [@asguard](https://forum.openwrt.org/u/asguard)\ **Post date:** [December 27, 2018, 11:27pm UTC](https://forum.openwrt.org/t/ipv6-and-port-forwarding/27770/13 "2018-12-27T23:27:02Z")
Great! I'm puzzled with how it works since everything gets forwarded to each of these ports. So does it try each one in turn until it gets an accept and then reject if it gets through all of them without an accept? ---
**Author:** ![Sparks](https://forum.openwrt.org/user_avatar/forum.openwrt.org/sparks/32/8563_2.png) [@Sparks](https://forum.openwrt.org/u/Sparks)\ **Post date:** [December 27, 2018, 11:30pm UTC](https://forum.openwrt.org/t/ipv6-and-port-forwarding/27770/14 "2018-12-27T23:30:12Z")
yep pretty much - in a nut shell its like a giant if/then/else structure. And keeps trying the next rule in a chain until it finds one that matches.