Ik zie het hier even niet meer, wat standaard firewall/port forward problematiek:
Setup hiervoor: Ubiquiti UXG-Lite router. Werkt op zich prima, zowel IPv4 als IPv6 probleemloos. Enkel een beetje begrensd qua snelheid omdat de UXG waarschijnlijk moeite heeft met PPPoE en 1Gb/s up/download.
Dus wat probeer ik aan de praat te krijgen: een Odroid H3 mini-PC met OpenWrt 5.15.150 er op.
Waar loop ik tegenaan:
Ik kan probleemloos het internet op, snelheid is prima. Echter, ik heb een server in huis draaien voor o.a. webserver, mailserver en SSH toegang. Via IPv4 kan ik zonder moeite de port forwards instellen, maar via IPv6 lijkt de server nog niet bereikbaar te zijn (zowel via
https://port.tools/port-checker-ipv6/ als via
https://internet.nl/ getest).
Nou is port forwarden voor IPv6 denk ik niet zo zinnig en moet ik het waarschijnlijk meer zoeken in firewall rules, maar dat wil niet lukken.
cat /etc/config/firewall (met wat edit-werk om IP-adressen te verbergen):
code:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
| config defaults
option syn_flood '1'
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
config zone
option name 'lan'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'ACCEPT'
list network 'lan'
config zone
option name 'wan'
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
option masq '1'
option mtu_fix '1'
list network 'wan'
config forwarding
option src 'lan'
option dest 'wan'
config rule
option name 'Allow-DHCP-Renew'
option src 'wan'
option proto 'udp'
option dest_port '68'
option target 'ACCEPT'
option family 'ipv4'
config rule
option name 'Allow-Ping'
option src 'wan'
option proto 'icmp'
option icmp_type 'echo-request'
option family 'ipv4'
option target 'ACCEPT'
config rule
option name 'Allow-IGMP'
option src 'wan'
option proto 'igmp'
option family 'ipv4'
option target 'ACCEPT'
config rule
option name 'Allow-DHCPv6'
option src 'wan'
option proto 'udp'
option dest_port '546'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-MLD'
option src 'wan'
option proto 'icmp'
option src_ip 'fe80::/10'
list icmp_type '130/0'
list icmp_type '131/0'
list icmp_type '132/0'
list icmp_type '143/0'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-ICMPv6-Input'
option src 'wan'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
list icmp_type 'router-solicitation'
list icmp_type 'neighbour-solicitation'
list icmp_type 'router-advertisement'
list icmp_type 'neighbour-advertisement'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-ICMPv6-Forward'
option src 'wan'
option dest '*'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-IPSec-ESP'
option src 'wan'
option dest 'lan'
option proto 'esp'
option target 'ACCEPT'
config rule
option name 'Allow-ISAKMP'
option src 'wan'
option dest 'lan'
option dest_port '500'
option proto 'udp'
option target 'ACCEPT'
config redirect
option dest 'lan'
option target 'DNAT'
option name 'HTTP'
option src 'wan'
option src_dport '80'
option dest_ip '192.168.1.2'
config redirect
option dest 'lan'
option target 'DNAT'
option name 'HTTPS'
option src 'wan'
option src_dport '443'
option dest_ip '192.168.x.x'
config redirect
option dest 'lan'
option target 'DNAT'
option name 'SMTP'
option src 'wan'
option src_dport '25'
option dest_ip '192.168.x.x'
config redirect
option dest 'lan'
option target 'DNAT'
option name 'SSH'
option src 'wan'
option src_dport '22'
option dest_ip '192.168.x.x'
config rule
option name 'SMTP'
option src_port '25'
option dest 'lan'
list dest_ip '2a10:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx'
option dest_port '25'
option target 'ACCEPT'
option src 'wan' |
cat /etc/config/network (met vergelijkbare edits):
code:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
| config interface 'loopback'
option device 'lo'
option proto 'static'
option ipaddr '127.0.0.1'
option netmask '255.0.0.0'
config globals 'globals'
option ula_prefix 'fdad:63ba:3d5e::/48'
config device
option name 'br-lan'
option type 'bridge'
list ports 'eth1'
config interface 'lan'
option device 'br-lan'
option proto 'static'
option ipaddr '192.168.x.x'
option netmask '255.255.255.0'
option ip6assign '60'
list dns '192.168.x.x'
config interface 'wan'
option device 'eth0.6'
option proto 'pppoe'
option username 'fake@freedom.nl'
option password '1234'
option ipv6 'auto'
option peerdns '0'
list dns '192.168.x.x'
config device
option type '8021q'
option ifname 'eth0'
option vid '6'
option name 'eth0.6'
option mtu '1508' |
Ik ben nog onbekend met OpenWRT, niet enorm ervaren met firewalls en IPv6. Op dit moment weet ik gewoon even niet welke richting ik op moet zoeken: in de firewall regels? In de network setup met PPPoE, VLAN en andere dingen?
Iemand tips?