IPv6 discussions

[liangtam]

IMHO.
How can i like, temporarily disable ipv4 on my PC and see if ipv6 works properly ?

Untick IPv4 and tick IPv6
Happy Eyeballs isn't always useful

 

[keenklee]

Untick IPv4 and tick IPv6
Happy Eyeballs isn't always useful

IMHO.
Thanks. I will check it out.

 

[it_geek]

One interesting topic for Singtel IPv6

Updated post with the config images.

 

[alvin9211]

Hi guys would like to check if anyone experienced the below:-
Singtel unbridged ONR and WAN has 2xxx ipv6 addresses the laptop has as well, but no matter how many times restarted the wifi router as well as the ONR as well as the laptop
the ipv6 still failed (failed IPV6 Dns)
Would like to have some kind advice and thanks in advance

 

[xiaofan]

Hi guys would like to check if anyone experienced the below:-
Singtel unbridged ONR and WAN has 2xxx ipv6 addresses the laptop has as well, but no matter how many times restarted the wifi router as well as the ONR as well as the laptop
the ipv6 still failed (failed IPV6 Dns)
Would like to have some kind advice and thanks in advance

Have you requested Singtel to enable ONR on the backend?

This can be a frustrating experience based on the past reports. Please check out the following thread.
https://forums.hardwarezone.com.sg/threads/singtel-5gbps-ipv6.7053976/

 

[alvin9211]

On site troubleshooting tomorrow
lets see how it goes
lolx

 

[xiaofan]

On site troubleshooting tomorrow
lets see how it goes
lolx

Tell the tech that he needs to contact the backend team to provision the IPv6 in order to sort out the issue.

If not it will be just a waste of your time and his time.

Based on my own experience and previous reports from other Singtel users, there is nothing in the Singtel XGS-PON ONR which can be configured to support Singtel native IPv6 without backend team intervention.

 

[alvin9211]

Tell the tech that he needs to contact the backend team to provision the IPv6 in order to sort out the issue.

If not it will be just a waste of your time and his time.

Based on my own experience and previous reports from other Singtel users, there is nothing in the Singtel XGS-PON ONR which can be configured to support Singtel native IPv6 without backend team intervention.

Yea their Whatsapp mentioned twice that ipv6 was provision by their back end team,
And i can see 2400 xxxx address on ONR>Status>WAN Status IPv6 page
But the v6 ping just failed... Weird

 

[alvin9211]

As predicted, problems persist after onsite troubleshoot....lolz...change another ONR change iIP also no use....suspect some BRAS/BNG backend network routing issue?
Out of curiosity anyone here able to use native ipv6 with router-mode-Nokia XS-240X-A？

 

[alvin9211]

took approx 10 days to get my ipv6 works...
and another mystery resolved:
I just realized my ipv6 Primary DNS was assigned to 2405:d180:2::2 for some reason previously, this DNS origin registrant is AS135600 Whiz Communications Pte Ltd....LOL............no wonder ipv6 can't ping

 

[Ickart]

An update on my home network, after losing my IPv6 functionality for almost a year plus while upgrading to XGS PON from my ISP due to upgraded bandwidth (from the old 2Gbps where they actually used 1G+1G FTP setup). I decided to randomly enable IPv6 function on my router - and surprisingly it's online for me!

Currently on Singtel 3Gbps network, running on a bridged XGS-PON, Asus ROG Rapture GT6 mesh router x2.
I set the IPv6 settings to Native, and enabled DHCP-PD, Auto Config set to Stateless. Custom DNS settings set to Cloudflare IPv6 with Malware Filtering (for my family's cyber safety reasons).

End result: IP allocated, LAN prefix length 56 (I think that's a /56 network assigned). DNS check indicates both IPv4 and IPv6 detection.

 

[allanleesysu]

With the help of AI, managed to build my own openwrt-based router using SIMBA 4G SIM as uplink WAN, instead of continue using the old Huawei B311 series as router. Actually I'm mostly sure that the ipv6 lease from SIMBA/TPG indeed did not filter/firewall inbound traffic.
Previously I also though the inbound traffic was firewalled by SIMBA, however it was actually the 4G LTE router's filter (which nowhere to disable via WebUI).
Below summarized by AI and I've manually checked, and confirm it describes the test results pretty well. The 2 test endpoints are Starhub & 8ight home fibre bb.

Did some digging into SIMBA/TPG 4G IPv6 using a ZTE USB LTE modem on OpenWrt/Linux. Interesting finding: at least on the session I tested, SIMBA gives a native globally routed IPv6 /64, and unsolicited inbound IPv6 is actually delivered all the way to the subscriber — I couldn't find evidence of a carrier-side stateful firewall.

The IPv6 setup is basically this:

SIM inserted / LTE registered
|
v
IPV4V6 PDP context
APN: TPG
|
v
LTE data active
|
v
CDC-ECM Ethernet (eth1)
|
| Router Solicitation
| -------------------->
|
| <--------------------
| Router Advertisement
|
| Prefix:
| 2400:79e0:9072:c1ee::/64
| A (SLAAC) flag = 1
|
v
Configure global IPv6 from /64
|
v
Default route via modem's
link-local IPv6 gateway
|
v
Native IPv6 Internet

The important bit is that this was RA/SLAAC provisioning rather than a DHCPv6 lease. odhcp6c sent DHCPv6 SOLICITs requesting IA_NA/IA_PD, but I didn't see a DHCPv6 Advertise/Reply. The useful information instead came from the modem's RA:

fe80::21b:fcff:fe9a:a400 > ff02::1:
ICMP6, router advertisement
router lifetime 65535s

prefix info:
2400:79e0:9072:c1ee::/64
Flags [auto]

After configuring an address from that /64 and routing through the advertised link-local gateway, normal outbound IPv6 worked, e.g. Cloudflare:

PING 2606:4700:4700::1111
64 bytes from 2606:4700:4700::1111
...
5 packets transmitted, 5 received, 0% packet loss

The more interesting test was inbound IPv6. I used two independent IPv6-connected machines elsewhere on the Internet and pinged the SIMBA address. tcpdump on the LTE interface showed the unsolicited requests arriving:

2406:3003:2001:34ee::yyy >
2400:79e0:9072:c1ee:xxx:
ICMP6, echo request

2406:3003:2006:c93d:zzz >
2400:79e0:9072:c1ee:xxx:
ICMP6, echo request

Initially the remote machines got Destination unreachable: Port unreachable. This turned out not to be SIMBA filtering anything — my OpenWrt firewall simply didn't yet classify the new LTE eth1 interface as WAN, so fw4's generic reject caught the packets. tcpdump actually showed the incoming request followed by the locally generated reject.

For confirmation I temporarily added:

nft insert rule inet fw4 input \
iifname "eth1" \
meta nfproto ipv6 \
icmpv6 type echo-request \
counter accept

Both remote machines could then ping the SIMBA IPv6 successfully. The counter reached:

counter packets 9 bytes 936 accept

I also tested something other than ICMP. Two remote hosts sent unsolicited UDP packets to port 51820, without the SIMBA connection initiating anything towards them first:

2406:3003:2001:34ee::yyy.51556 >
2400:79e0:9072:c1ee:xxx.51820:
UDP, length 20

2406:3003:2006:c93d:zzz.35494 >
2400:79e0:9072:c1ee:xxx.51820:
UDP, length 20

So the tested path is effectively:

Remote IPv6 PC #1 ─┐
│
Remote IPv6 PC #2 ─┼── Internet
│
v
SIMBA / TPG
LTE network
|
no observed
inbound state filter
|
v
2400:79e0:9072:c1ee::/64
|
v
LTE modem
|
eth1
|
v
OpenWrt firewall
< actual filter >
|
v
local services

So my conclusion is: SIMBA's IPv4 side may be behind CGNAT, but its IPv6 behaves like proper end-to-end Internet connectivity. The tested subscriber got a global /64, outbound IPv6 worked, and unsolicited inbound ICMPv6 and UDP from independent Internet hosts reached the LTE interface.

This could be quite useful for hosting a WireGuard endpoint or similar service directly over mobile IPv6 — no CGNAT traversal or port forwarding required.

The flip side is equally important: don't assume mobile IPv6 has the same implicit isolation as CGNAT IPv4. On this connection the OpenWrt IPv6 firewall is the actual security boundary, so WAN input/forwarding should default to reject/drop and only explicitly required services should be opened.

Obviously this is one experimentally verified SIMBA/TPG LTE session, not a promise that every SIM plan/APN/location/RAT or future SIMBA configuration behaves identically. Would be interesting if anyone else on SIMBA can reproduce it.