• Blaster M@lemmy.world
    link
    fedilink
    English
    arrow-up
    0
    ·
    5 months ago

    You shouldn’t be forwarding anything - lan devices are directly accessible from the internet with ipv6. The router’s job now is to firewall inbound ipv6 packets. You should be able to simply open the inbound port for that device in particular.

    • henfredemars@infosec.pub
      link
      fedilink
      English
      arrow-up
      0
      ·
      edit-2
      5 months ago

      Right, that’s how it should work. Unfortunately that’s not how it actually works most of the time in consumer.

      Many devices don’t provide an option in the UI to open an inbound port on IPv6. For example, the latest and most expensive Linksys gaming router blocks all inbound connections and there are no options for different behavior. It doesn’t support opening any ports for v6.

      The most recent TP link device I tested for my dad doesn’t even have a firewall. If you know the global IP, you can connect to any port you want.

      • Blaster M@lemmy.world
        link
        fedilink
        English
        arrow-up
        0
        ·
        5 months ago

        And that’s why I abandoned cheap consumer routers many years ago… closest devices to implement ipv6 port management firewalling even half good was/is the ASUS devices. I got fed up and went pfsense and/or unifi one day and never looked back.

        UDM handles ipv6 real good, and pfsense can even get /64 subs from an ATT router for all its lan interfaces.