IPv6 discussions

[firesong]

@Mach3.2

Please add SIMBA -- as of now they do not provide IPv6 for their 2.5G Fibre Internet plan. They also use CGNAT.

I haven't been following. New job keeping me super busy.

This confirmed already ah?

 

[Mach3.2]

I haven't been following. New job keeping me super busy.

This confirmed already ah?

I don't think anyone tested. It's still early in their trials so I'd expect good news regarding IPv6 support.

 

[xiaofan]

I don't think anyone tested. It's still early in their trials so I'd expect good news regarding IPv6 support.

I think only CGNAT is confirmed (and expected). IPv6 is not confirmed. By right they have IPv6 for the mobile network so they should have IPv6 for the Fibre broadband as well.

 

[trenzterra]

Hmm I've been using Singtel for my mobile and as long as I can remember I've always been able to get IPv6 on my connection at least for the past ten years or so. But yeah no go on home broadband (on ADSL at least, previously, before I switched to StarHub)

 

[Mach3.2]

Hmm I've been using Singtel for my mobile and as long as I can remember I've always been able to get IPv6 on my connection at least for the past ten years or so. But yeah no go on home broadband (on ADSL at least, previously, before I switched to StarHub)

I don't doubt you can get IPv6 on Singtel Mobile, at least on Singtel proper (not MVNOs), but highly unlikely it's enabled by default for the masses if we look at APNIC's stats.

 

[xiaofan]

I don't doubt you can get IPv6 on Singtel Mobile, at least on Singtel proper (not MVNOs), but highly unlikely it's enabled by default for the masses if we look at APNIC's stats.

I am on Singtel Mobile for 10 years+ (since 2013), first with Singtel Combo 2 and now with Singtel SIM Only Plus 30, I have never seen IPv6 on my mobile phones (main Android phones except using iPhone 6S between 2015-2018).

As per @bert64, one needs to go through the loop to request Singtel to enable IPv6 for mobile.

 

[xiaofan]

One thing I do not quite understand is how pfSense/OPNsense work with IPv6 but without any firewall rules allowing ICMPv6 on the WAN interface.

Asus: drop a few ICMPv6 requests/reply but accept many others.

Chain ICMP_V6 (2 references)
target     prot opt source               destination
ACCEPT     ipv6-icmp    anywhere             anywhere             ipv6-icmp echo-request limit: avg 1/sec burst 5
ACCEPT     ipv6-icmp    anywhere             anywhere             ipv6-icmp destination-unreachable
ACCEPT     ipv6-icmp    anywhere             anywhere             ipv6-icmp packet-too-big
ACCEPT     ipv6-icmp    anywhere             anywhere             ipv6-icmp time-exceeded
ACCEPT     ipv6-icmp    anywhere             anywhere             ipv6-icmp parameter-problem
ACCEPT     ipv6-icmp    anywhere             anywhere             ipv6-icmp echo-reply [this can be enabled or disabled]
DROP       all      anywhere             anywhere

Chain ICMP_V6_LOCAL (1 references)
target     prot opt source               destination
ACCEPT     ipv6-icmp    anywhere             anywhere             ipv6-icmptype 130
ACCEPT     ipv6-icmp    anywhere             anywhere             ipv6-icmptype 131
ACCEPT     ipv6-icmp    anywhere             anywhere             ipv6-icmptype 132
ACCEPT     ipv6-icmp    anywhere             anywhere             ipv6-icmp router-solicitation
ACCEPT     ipv6-icmp    anywhere             anywhere             ipv6-icmp router-advertisement
ACCEPT     ipv6-icmp    anywhere             anywhere             ipv6-icmp neighbour-solicitation
ACCEPT     ipv6-icmp    anywhere             anywhere             ipv6-icmp neighbour-advertisement
ACCEPT     ipv6-icmp    anywhere             anywhere             ipv6-icmptype 141
ACCEPT     ipv6-icmp    anywhere             anywhere             ipv6-icmptype 142
ACCEPT     ipv6-icmp    anywhere             anywhere             ipv6-icmptype 143
ACCEPT     ipv6-icmp    anywhere             anywhere             ipv6-icmptype 148
ACCEPT     ipv6-icmp    anywhere             anywhere             ipv6-icmptype 149
ACCEPT     ipv6-icmp    anywhere             anywhere             ipv6-icmptype 151
ACCEPT     ipv6-icmp    anywhere             anywhere             ipv6-icmptype 152
ACCEPT     ipv6-icmp    anywhere             anywhere             ipv6-icmptype 153
RETURN     all      anywhere             anywhere

OpenWRT

config rule
        option name 'Allow-DHCPv6'
        option src 'wan'
        option proto 'udp'
        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-MLD'
        option src 'wan'
        option proto 'icmp'
        option src_ip 'fe80::/10'
        list icmp_type '130/0'
        list icmp_type '131/0'
        list icmp_type '132/0'
        list icmp_type '143/0'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Input'
        option src 'wan'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        list icmp_type 'router-solicitation'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'router-advertisement'
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Forward'
        option src 'wan'
        option dest '*'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

 

[xiaofan]

One thing I do not quite understand is how pfSense/OPNsense work with IPv6 but without any firewall rules allowing ICMPv6 on the WAN interface.

Okay, there are many hidden rules.

[2.7.1-RELEASE][admin@pfSense271n100vm.home.arpa]/root: pfctl -sa | grep dhcpv6
pass in quick on vtnet1 inet6 proto udp from fe80::/10 port = dhcpv6-client to fe80::/10 port = dhcpv6-client keep state label "allow dhcpv6 client in WAN" ridentifier 1000000463
pass in quick on vtnet1 proto udp from any port = dhcpv6-server to any port = dhcpv6-client keep state label "allow dhcpv6 client in WAN" ridentifier 1000000464
pass out quick on vtnet1 proto udp from any port = dhcpv6-client to any port = dhcpv6-server keep state label "allow dhcpv6 client out WAN" ridentifier 1000000465
allow dhcpv6 client in WAN 6920 0 0 0 0 0 0 0
allow dhcpv6 client in WAN 3136 10 1120 10 1120 0 0 4
allow dhcpv6 client out WAN 6913 10 1160 0 0 10 1160 4

[2.7.1-RELEASE][admin@pfSense271n100vm.home.arpa]/root: pfctl -sa | grep icmp6
pass quick inet6 proto ipv6-icmp all icmp6-type unreach keep state ridentifier 1000000107
pass quick inet6 proto ipv6-icmp all icmp6-type toobig keep state ridentifier 1000000107
pass quick inet6 proto ipv6-icmp all icmp6-type neighbrsol keep state ridentifier 1000000107
pass quick inet6 proto ipv6-icmp all icmp6-type neighbradv keep state ridentifier 1000000107
pass out quick inet6 proto ipv6-icmp from fe80::/10 to fe80::/10 icmp6-type echorep keep state ridentifier 1000000108
pass out quick inet6 proto ipv6-icmp from fe80::/10 to fe80::/10 icmp6-type routersol keep state ridentifier 1000000108
pass out quick inet6 proto ipv6-icmp from fe80::/10 to fe80::/10 icmp6-type routeradv keep state ridentifier 1000000108
pass out quick inet6 proto ipv6-icmp from fe80::/10 to fe80::/10 icmp6-type neighbrsol keep state ridentifier 1000000108
pass out quick inet6 proto ipv6-icmp from fe80::/10 to fe80::/10 icmp6-type neighbradv keep state ridentifier 1000000108
pass out quick inet6 proto ipv6-icmp from fe80::/10 to ff02::/16 icmp6-type echorep keep state ridentifier 1000000109
pass out quick inet6 proto ipv6-icmp from fe80::/10 to ff02::/16 icmp6-type routersol keep state ridentifier 1000000109
pass out quick inet6 proto ipv6-icmp from fe80::/10 to ff02::/16 icmp6-type routeradv keep state ridentifier 1000000109
pass out quick inet6 proto ipv6-icmp from fe80::/10 to ff02::/16 icmp6-type neighbrsol keep state ridentifier 1000000109
pass out quick inet6 proto ipv6-icmp from fe80::/10 to ff02::/16 icmp6-type neighbradv keep state ridentifier 1000000109
pass in quick inet6 proto ipv6-icmp from fe80::/10 to fe80::/10 icmp6-type echoreq keep state ridentifier 1000000110
pass in quick inet6 proto ipv6-icmp from fe80::/10 to fe80::/10 icmp6-type routersol keep state ridentifier 1000000110
pass in quick inet6 proto ipv6-icmp from fe80::/10 to fe80::/10 icmp6-type routeradv keep state ridentifier 1000000110
pass in quick inet6 proto ipv6-icmp from fe80::/10 to fe80::/10 icmp6-type neighbrsol keep state ridentifier 1000000110
pass in quick inet6 proto ipv6-icmp from fe80::/10 to fe80::/10 icmp6-type neighbradv keep state ridentifier 1000000110
pass in quick inet6 proto ipv6-icmp from ff02::/16 to fe80::/10 icmp6-type echoreq keep state ridentifier 1000000111
pass in quick inet6 proto ipv6-icmp from ff02::/16 to fe80::/10 icmp6-type routersol keep state ridentifier 1000000111
pass in quick inet6 proto ipv6-icmp from ff02::/16 to fe80::/10 icmp6-type routeradv keep state ridentifier 1000000111
pass in quick inet6 proto ipv6-icmp from ff02::/16 to fe80::/10 icmp6-type neighbrsol keep state ridentifier 1000000111
pass in quick inet6 proto ipv6-icmp from ff02::/16 to fe80::/10 icmp6-type neighbradv keep state ridentifier 1000000111
pass in quick inet6 proto ipv6-icmp from fe80::/10 to ff02::/16 icmp6-type echoreq keep state ridentifier 1000000112
pass in quick inet6 proto ipv6-icmp from fe80::/10 to ff02::/16 icmp6-type routersol keep state ridentifier 1000000112
pass in quick inet6 proto ipv6-icmp from fe80::/10 to ff02::/16 icmp6-type routeradv keep state ridentifier 1000000112
pass in quick inet6 proto ipv6-icmp from fe80::/10 to ff02::/16 icmp6-type neighbrsol keep state ridentifier 1000000112
pass in quick inet6 proto ipv6-icmp from fe80::/10 to ff02::/16 icmp6-type neighbradv keep state ridentifier 1000000112
pass in quick inet6 proto ipv6-icmp from :: to ff02::/16 icmp6-type echoreq keep state ridentifier 1000000113
pass in quick inet6 proto ipv6-icmp from :: to ff02::/16 icmp6-type routersol keep state ridentifier 1000000113
pass in quick inet6 proto ipv6-icmp from :: to ff02::/16 icmp6-type routeradv keep state ridentifier 1000000113
pass in quick inet6 proto ipv6-icmp from :: to ff02::/16 icmp6-type neighbrsol keep state ridentifier 1000000113
pass in quick inet6 proto ipv6-icmp from :: to ff02::/16 icmp6-type neighbradv keep state ridentifier 1000000113

Reference:
https://forum.netgate.com/topic/129725/what-hidden-rules-are-created-for-icmpv6-and-dhcpv6/18
https://docs.netgate.com/pfsense/en/latest/firewall/pf-ruleset.html

 

[trenzterra]

I don't doubt you can get IPv6 on Singtel Mobile, at least on Singtel proper (not MVNOs), but highly unlikely it's enabled by default for the masses if we look at APNIC's stats.

Interesting cos I never wrote in to Singtel before at least for mobile haha.

 

[bert64]

Interesting cos I never wrote in to Singtel before at least for mobile haha.

Are you sure it's working? Do you get 10/10 on test-ipv6.com when on mobile data, the address actually belongs to singtel and you're not using some kind of vpn which provides ipv6?

 

[trenzterra]

Are you sure it's working? Do you get 10/10 on test-ipv6.com when on mobile data, the address actually belongs to singtel and you're not using some kind of vpn which provides ipv6?

Yup using Firefox android without VPN and the IP address shows that it's from Singtel.

Funny thing is I tried again just now in order to take a screenshot and now it says no IPv6... Wonder if it depends on location

 

[bert64]

Yup using Firefox android without VPN and the IP address shows that it's from Singtel.

Funny thing is I tried again just now in order to take a screenshot and now it says no IPv6... Wonder if it depends on location

It won't depend on location unless you're roaming... It may depend on signal, some networks (eg M1) only support IPv6 on 4G/5G whereas 2G/3G presumably uses legacy equipment.
On android IPv6 needs to be turned on under the APN settings, it is enabled by default in many devices - and you also need it enabled at the network side which singtel don't do by default. Doesn't make sense really, since the more traffic flows over v6 instead of legacy ip, the less the provider need to spend on nat gateways.

 

[xiaofan]

Just want to report that Singtel Native IPv6 works fine for both my Asus RT-AX86U and OpenWRT 23.05 installation. I did not touch the routers for more than one weeks as I was travelling.

 

[xiaofan]

Singtel native IPv6 seems to be stable. Both are still working fine.

1) Asus RT-AX86U

System Time	Fri, Jan 12 07:06:48 2024
Uptime	27 days 8 hour(s) 17 minute(s) 40 seconds

2) OpenWRT virtual router (Intel J4105, Proxmox PVE 7.4)

Hostname	OpenWrt
Model	QEMU Standard PC (i440FX + PIIX, 1996)
Architecture	Common KVM processor
Target Platform	x86/64
Firmware Version	OpenWrt 23.05.0 r23497-6637af95aa / LuCI openwrt-23.05 branch git-23.306.39416-c86c256
Kernel Version	5.15.134
Local Time	2024-01-11 23:08:25
Uptime	39d 22h 55m 14s

 

[firesong]

Singtel native IPv6 seems to be stable. Both are still working fine.

1) Asus RT-AX86U

​

System Time	Fri, Jan 12 07:06:48 2024
Uptime	27 days 8 hour(s) 17 minute(s) 40 seconds

2) OpenWRT virtual router (Intel J4105, Proxmox PVE 7.4)

Hostname	OpenWrt
Model	QEMU Standard PC (i440FX + PIIX, 1996)
Architecture	Common KVM processor
Target Platform	x86/64
Firmware Version	OpenWrt 23.05.0 r23497-6637af95aa / LuCI openwrt-23.05 branch git-23.306.39416-c86c256
Kernel Version	5.15.134
Local Time	2024-01-11 23:08:25
Uptime	39d 22h 55m 14s

Took really long for them. But glad to hear it's doing well =)

 

[Thunderlip]

Just want to report that Singtel Native IPv6 works fine for both my Asus RT-AX86U and OpenWRT 23.05 installation. I did not touch the routers for more than one weeks as I was travelling.

I turned on IPv6 setting (Native) on Asus RT-AX86U. Router’s GUI gives me IPv6 lan address (/56). However, tests at ipv6-test.com and test-ipv6.com are failing. Is there something else that I should do before it works?

My internet plan is Singtel 1+1 gamer. Bridged port of ONR is in use and connected to Asus router.

Thanks.

 

[xiaofan]

I turned on IPv6 setting (Native) on Asus RT-AX86U. Router’s GUI gives me IPv6 lan address (/56). However, tests at ipv6-test.com and test-ipv6.com are failing. Is there something else that I should do before it works?

My internet plan is Singtel 1+1 gamer. Bridged port of ONR is in use and connected to Asus router.

Thanks.

Strange. By right it should work.

Did you check the DNS server using "nslookup"?
Did you client device get a proper IPv6 address?

PS C:\work> nslookup ipv6.google.com
Server:  RT-AX86U-2D40
Address:  2400:d802:1cxx:xx00::1

Non-authoritative answer:
Name:    ipv6.l.google.com
Addresses:  2404:6800:4003:c04::71
          2404:6800:4003:c04::65
          2404:6800:4003:c04::8b
          2404:6800:4003:c04::66
Aliases:  ipv6.google.com

PS C:\work> ping ipv6.google.com

Pinging ipv6.l.google.com [2404:6800:4003:c04::71] with 32 bytes of data:
Reply from 2404:6800:4003:c04::71: time=4ms
Reply from 2404:6800:4003:c04::71: time=8ms
Reply from 2404:6800:4003:c04::71: time=7ms
Reply from 2404:6800:4003:c04::71: time=7ms

Ping statistics for 2404:6800:4003:c04::71:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 4ms, Maximum = 8ms, Average = 6ms

 

[Thunderlip]

Yes, I tried nslookup and ping. Not sure what is causing this. I'm looking into switching to MR 10Gbps plan soon as my Singtel 1+1 Gamer contract expires end of March. So I would lose IPv6 anyway.

nslookup ipv6.google.com
DNS request timed out.
timeout was 2 seconds.
Server: UnKnown
Address: 2001:4860:4860::8888

DNS request timed out.
timeout was 2 seconds.
DNS request timed out.
timeout was 2 seconds.
DNS request timed out.
timeout was 2 seconds.
DNS request timed out.
timeout was 2 seconds.
*** Request to UnKnown timed-out

ping ipv6.google.com

Pinging ipv6.l.google.com [2404:6800:4003:c06::64] with 32 bytes of data:
Destination net unreachable.
Destination net unreachable.
Destination net unreachable.
Destination net unreachable.

Ping statistics for 2404:6800:4003:c06::64:
Packets: Sent = 4, Received = 0, Lost = 4 (100% loss)

 

[xiaofan]

Yes, I tried nslookup and ping. Not sure what is causing this. I'm looking into switching to MR 10Gbps plan soon as my Singtel 1+1 Gamer contract expires end of March. So I would lose IPv6 anyway.

nslookup ipv6.google.com
DNS request timed out.
timeout was 2 seconds.
Server: UnKnown
Address: 2001:4860:4860::8888

DNS request timed out.
timeout was 2 seconds.
DNS request timed out.
timeout was 2 seconds.
DNS request timed out.
timeout was 2 seconds.
DNS request timed out.
timeout was 2 seconds.
*** Request to UnKnown timed-out

ping ipv6.google.com

Pinging ipv6.l.google.com [2404:6800:4003:c06::64] with 32 bytes of data:
Destination net unreachable.
Destination net unreachable.
Destination net unreachable.
Destination net unreachable.

Ping statistics for 2404:6800:4003:c06::64:
Packets: Sent = 4, Received = 0, Lost = 4 (100% loss)

I see. Try the following settings to see if it works for you or not.

If not, I guess it is not important to troubleshoot as you are going to MR anyway.

 

[Thunderlip]

Interesting. I don’t have IPv6 WAN Setting available. Are you running different firmware? Mine is 3.0.0.4.388_24231-gbc11d13.