Archer AX10/1500 Blocks ALL incoming IPv6 connections
This thread has been locked for further replies. You can start a new thread to share your ideas or ask questions.
Hello guys,
I'm using archer ax10 since March and I have some problems with IPv6. At home, I have a personal web server/cloud, sometimes I need to use it over IPV6 but ax10 blocks all ipv6 incoming connections, I tried all available firmware builds, I disabled the SPI firewall but nothing happens. In traceroute last ip accessible is always the ax 10 and then nothing. My server can connect to ipv6 servers so outgoing works. I tried another old ASUS router with openwrt installed and ipv6 incoming connections works so my ISP isn't blocking any ports.
Why a IPv6 advertised router has no settings for ipv6 port forwarding, ipv6 subnet config, (ipv6 local ip does not appear in lan connected devices) or any in depth settings for ipv6? Looks like ipv6 is just a side project on this router...
Anyone has any ideas, maybe in the next update, I mean is the new generation of routers so incompatible with next gen internet??
I understand that in some situations allowing incoming ipv6 is a security problem, but all I need is a check box somewhere in the menu with "allow incoming ipv6, I understand the risk".
Fist of all you need a linux enviroment.
You can also use linux subsystem on windows. open terminal or ssh and:
1. sudo apt update && sudo apt install golang
2. download this somewhere on your linux. link https://github.com/knownunown/tpl-c900-openwrt-install
3. download your router config and save it as "backup.bin"
4. backup.bin put it in the folder "tpl-c900-openwrt-install-master"
5. rename .encryption_params.sample into .encryption_params. Paste the key and the IV in .encryption_params
(export KEY="2EB38F7EC41D4B8E1422805BCD5F740BC3B95BE163E39D67579EB344427F7836" export IV="360028C9064242F81074F4C127D299F6")
6.run extract.sh from that folder. now you sould have a new created by the script "data" folder. open that folder.
7. open config.xml, go to firewall tag and add your custom ipv6 rules inside firewall tags. example to open port 80 on ipv6:
<rule>
<proto>tcp</proto>
<dest_port>80</dest_port>
<name>Forward-IPv6-80</name>
<target>ACCEPT</target>
<dest>lan</dest>
<family>ipv6</family>
<src>wan</src>
</rule>
8. save modified config.xml
9. run package.sh
10. now you have a new file created "backup_final.bin"
11. restore that config file done. now your router supports ipv6 incoming traffic.
if you want to gain root access, you can edit the dropbear section to look like this
<dropbear>
<dropbear>
<RootPasswordAuth>on</RootPasswordAuth>
<SysAccountLogin>on</SysAccountLogin>
<Port>22</Port>
<PasswordAuth>on</PasswordAuth>
</dropbear>
</dropbear>
and after you can connect with putty with user root and your router interface password and you can add firewall rules directly via ssh, no need to edit the config for every change.
Fist of all you need a linux enviroment.
You can also use linux subsystem on windows. open terminal or ssh and:
1. sudo apt update && sudo apt install golang
2. download this somewhere on your linux. link https://github.com/knownunown/tpl-c900-openwrt-install
3. download your router config and save it as "backup.bin"
4. backup.bin put it in the folder "tpl-c900-openwrt-install-master"
5. rename .encryption_params.sample into .encryption_params. Paste the key and the IV in .encryption_params
(export KEY="2EB38F7EC41D4B8E1422805BCD5F740BC3B95BE163E39D67579EB344427F7836" export IV="360028C9064242F81074F4C127D299F6")
6.run extract.sh from that folder. now you sould have a new created by the script "data" folder. open that folder.
7. open config.xml, go to firewall tag and add your custom ipv6 rules inside firewall tags. example to open port 80 on ipv6:
<rule>
<proto>tcp</proto>
<dest_port>80</dest_port>
<name>Forward-IPv6-80</name>
<target>ACCEPT</target>
<dest>lan</dest>
<family>ipv6</family>
<src>wan</src>
</rule>
8. save modified config.xml
9. run package.sh
10. now you have a new file created "backup_final.bin"
11. restore that config file done. now your router supports ipv6 incoming traffic.
if you want to gain root access, you can edit the dropbear section to look like this
<dropbear>
<dropbear>
<RootPasswordAuth>on</RootPasswordAuth>
<SysAccountLogin>on</SysAccountLogin>
<Port>22</Port>
<PasswordAuth>on</PasswordAuth>
</dropbear>
</dropbear>
and after you can connect with putty with user root and your router interface password and you can add firewall rules directly via ssh, no need to edit the config for every change.
