Hi again,
there are two observations:
- Comparing the recent data to the data you posted some time ago it turns out that the LAN prefix you get delegated via DHCP-PD is not fixed but obviously changes - probably every time a new PPPoE session is established (previous LAN prefix was 2a02:2f08:30e7::/64, present LAN prefix is 2a02:2f08:30d1:8900::/64).
Hence, your original request to configure IPv6 firewall rules that allow Internet access for a subset of your LAN clients only (identified by their source IPv6 address derived from a changing prefix) is not feasible because the ruleset does not adjust to changing LAN prefixes.
There are IPv6 firewall implementations in home routers on the market (e.g. the products of a well known German manufacturer) which allow this because they only use the host identifier (the last 64 bits of an IPv6 address) within firewall rules which may be kept constant while the (irrelevant) prefix (the first 64 bits of an IPv6 address) might change.
Using a D-Link firewall you must ask your ISP for a fixed prefix in order to put your firewall needs into practice. Otherwise within firewall rules you can only use source address ranges that cover any LAN prefixes you might ever get delegated, e.g. :: - ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff or your ISP's address block he got delegated from RIPE, in case of your ISP RCS&RDS the block 2a02:2f00::/28 which corresponds to the range 2a02:2f00:: - 2a02:2f0f:ffff:ffff:ffff:ffff:ffff:ffff.
- Your ISP obviously doesn't assign a global IPv6 prefix to the PPPoE link that connects your router to your ISP's edge router. Instead the link local prefix fe80::/64 is used for this only. Although unusual this is allowed and works as you can see from the fact that you have IPv6 Internet access - at least when your IPv6 firewall is switched off.
Looking at your IPv6 routing table:
Entries without a gateway (denoted as "::") might specify one of following:
- A directly attached network, e.g. your LAN 2a02:2f08:30d1:8900::/64
- An IPv6 address assigned to a local interface - no example available in your table
- An IPv6 address of another device reachable via the interface listed in the entry, e.g. your LAN PC 2a02:2f08:30d1:8900::4 reachable via the LAN interface or 2a02:2f08:30df:ffff::bc1b:1aca which is your ISP's edge router reachable via INTERNET interface.
And of course you have a default gateway fe80::1 which obviously is the link local address of your ISP's edge router reachable via INTERNET interface.
It is interesting now that the entry for your LAN client 2a02:2f08:30d1:8900::4 disappears as soon as you switch on the IPv6 firewall. This looks as if the router is no more able to discover your LAN clients because the IPv6 firewall seems to block Neighbor Discovery packets (a special type of ICMPv6 packets e.g. used to resolve IPv6 addresses of neighboring nodes to MAC addresses).
Hence I draw the conclusion (but this is a wild guess only) that D-Link's firewall implementation gets confused from the situation that it does not have a global IPv6 address assigned to its WAN interface, and maybe instead of applying rules to the WAN interface it erroneously applies them to the LAN interface (e.g. blocking ICMPv6 ND) because it can't differentiate between them if the WAN interface has been assigned a link local IPv6 address only.
You might perhaps test if my assumption is right by not using the native IPv6 access offered by your ISP but by temporarily configuring a 6to4 tunnel and check if your IPv6 firewall works properly in this case (of course your ISP must not block IPv4 packets that contain IPv6 packets - so called type 41 packets - as is the case with 6to4).
In any case you might ask your ISP if he could assign a global prefix to your PPPoE WAN link - hoping that this might solve your IPv6 firewall problem.
PacketTracer
Author
Topic: ipv6 firewall rules / fv: 2.17 / hv: bx / b5 (Read 19105 times)