IPv6 to Router Blocked except for SSH/22

Installing and Using OpenWrt Network and Wireless Configuration
1

Appreciate any help in advance ...

I have IPv6 on the br-lan side and it seems to work fine except connecting to the openWRT device. On that router ssh/22 works ok with IPv6 but other ports that are open do not.

Some info follows:

netstat -peanut | grep 53
tcp        0      0 192.168.1.1:53          0.0.0.0:*               LISTEN      
tcp        0      0 127.0.0.1:53            0.0.0.0:*               LISTEN      
tcp        0      0 fd7a:6dbb:8129::1:53    :::*                    LISTEN      
tcp        0      0 ::1:53                  :::*                    LISTEN      
udp        0      0 192.168.1.1:53          0.0.0.0:*                           
udp        0      0 127.0.0.1:53            0.0.0.0:*                           
udp        0      0 ::1:53                  :::*                                
udp        0      0 fd7a:6dbb:8129::1:53    :::*

Trying DNS resolution on the router to it's IPv6 works
Trying DNS resolution from a lan device on IPv4 to router works, IPv6 fails with Connection refused.

In fact all open ports respond with connection refused except SSH/22 on IPv6

Add'l info:
WAN IPv6 is disabled.

ubus call system board
{
        "kernel": "5.15.150",
        "hostname": "MochaEdge",
        "system": "ARMv8 Processor rev 1",
        "model": "Globalscale MOCHAbin",
        "board_name": "globalscale,mochabin",
        "rootfs_type": "squashfs",
        "release": {
                "distribution": "OpenWrt",
                "version": "23.05.3",
                "revision": "r23809-234f1a2efa",
                "target": "mvebu/cortexa72",
                "description": "OpenWrt 23.05.3 r23809-234f1a2efa"
        }
}

cat /etc/config/network

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 'fd7a:6dbb:8129::/48'

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'lan0'
        list ports 'lan1'
        list ports 'lan2'
        list ports 'lan3'

config interface 'lan'
        option device 'br-lan'
        option proto 'static'
        option ipaddr '192.168.1.1'
        option netmask '255.255.255.0'
        option ip6assign '60'
        list dns '192.168.1.1'
        option delegate '0'

config device
        option name 'br-wan'
        option type 'bridge'
        list ports 'eth0'
        list ports 'eth2'

config interface 'wan'
        option device 'br-wan'
        option proto 'dhcp'
        option hostname '*'
        option peerdns '0'
        list dns '192.168.1.1'
        option broadcast '1'

config interface 'wan6'
        option device 'br-wan'
        option proto 'dhcpv6'
        option reqaddress 'try'
        option reqprefix 'auto'
        option auto '0'

/etc/config/firewall

config defaults
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option flow_offloading '1'
	option drop_invalid '1'
	option synflood_protect '1'

config zone
	option name 'lan'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'ACCEPT'
	list network 'lan'

config zone
	option name 'wan'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option masq '1'
	option mtu_fix '1'
	list network 'wan'
	list network 'wan6'

config rule
	option name 'Allow-DHCP-Renew'
	option src 'wan'
	option proto 'udp'
	option dest_port '68'
	option target 'ACCEPT'
	option family 'ipv4'

config rule
	option name 'Allow-Ping'
	option src 'wan'
	option proto 'icmp'
	option icmp_type 'echo-request'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-IGMP'
	option src 'wan'
	option proto 'igmp'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-DHCPv6'
	option src 'wan'
	option proto 'udp'
	option dest_port '546'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-MLD'
	option src 'wan'
	option proto 'icmp'
	option src_ip 'fe80::/10'
	list icmp_type '130/0'
	list icmp_type '131/0'
	list icmp_type '132/0'
	list icmp_type '143/0'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Input'
	option src 'wan'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	list icmp_type 'router-solicitation'
	list icmp_type 'neighbour-solicitation'
	list icmp_type 'router-advertisement'
	list icmp_type 'neighbour-advertisement'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Forward'
	option src 'wan'
	option dest '*'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-IPSec-ESP'
	option src 'wan'
	option dest 'lan'
	option proto 'esp'
	option target 'ACCEPT'

config rule
	option name 'Allow-ISAKMP'
	option src 'wan'
	option dest 'lan'
	option dest_port '500'
	option proto 'udp'
	option target 'ACCEPT'

config redirect
	option dest 'lan'
	option target 'DNAT'
	option name 'HTTPS'
	option src 'wan'
	option src_dport '443'
	option dest_ip '192.168.1.2'
	option dest_port '443'
	list proto 'tcp'

config zone
	option name 'iot'
	option output 'ACCEPT'
	option forward 'REJECT'
	option input 'REJECT'
	list network 'iot'

config rule
	option name 'Allow-IOT-DNS'
	option src 'iot'
	option dest_port '53'
	option target 'ACCEPT'

config rule
	option name 'Allow-IOT-DHCP'
	list proto 'udp'
	option src 'iot'
	option dest_port '67-68'
	option target 'ACCEPT'

config rule
	option name 'Allow-Ping-IOT'
	list proto 'icmp'
	list icmp_type 'echo-request'
	option src 'lan'
	option dest 'iot'
	option target 'ACCEPT'

config forwarding
	option src 'lan'
	option dest 'wan'

config redirect
	option dest 'lan'
	option target 'DNAT'
	option name 'All DNS Internal IoT'
	option src 'iot'
	option src_dport '53'
	option dest_port '53'
	option dest_ip '192.168.1.1'
	option src_ip '!192.168.1.1'

config forwarding
	option src 'iot'
	option dest 'wan'

I'm also using PBR

2

We'll need to see this configuration, in addition to the firewall config.

3

Firewall added above.
I've also disabled PBR while I work through this - thanks again.

4

Found this issue which was outside of openwrt. Thanks for all that looked at it.

5

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.