Hi @paderijk 

Thanks for posting in our business forum.

Where will this prefix come from? WAN or LAN?

LAN can do it. ACL supports IPv6 LAN. The IPv6 Group will change to the WAN v6 prefix if the WAN prefix changes.

Hi @paderijk 

Thanks for posting in our business forum.

paderijk wrote

 Hi @Clive_A,

 

The IPv6 prefix will come from the WAN (via the ISP) and "pushed" to the LAN, the LAN is configured this way:

 

 

 

I indeed found the IPv6 group for ACLs applicable to the whole subnet (2001:c0ff:ee:5838::/64), but I have not found a solution whereby I can have an ACL for a specific IPv6 address, that takes into count a potential prefix change.

 

In my case I want to have one system (2001:c0ff:ee:5838::1:241/128) over SSH accessible from the Internet over SSH (TCP/22) and all the other systems that do offer SSH should not be accessible. So I currently have an ACL that blocks everything incoming and another one that only allows inbound SSH to that specific system.

 

The system Berrystone is the one that should be accessible from the Internet using SSH.

 

 

 

The IPv6 Group:IPv6 berrystone looks like:

 

 

So if the provider pushes a new prefix to me (for example) 2001:b4b4:aa:1234::/64, the IPv6 Group:IPv6 berrystone needs to be changed.

 

Hope I clarified the feature request more, if not, please let me know.

 

I looked if there was already something in place, but was not able to find it.

 

DISCLAIMER: The IPv6 prefixes showed are not the actual ones I have in use due to privacy.

Got you. Our dev also took a look at this request.

So, it does not seem to be a mainstream request yet. We will keep an eye on this request if they are more feedback on this, we let the PM take a look and evaluate this feature.

BTW, is this for the business environment or home? If this is for business, how many users do you have requesting this feature?

Hi @paderijk 

Thanks for posting in our business forum.

paderijk wrote

  @Clive_A 

 

This is in my home-lab (as professional IT Engineer, I would like to have good stuff).

 

Understand it's not a mainstream request, at my work at a big international company IPv6 is unfortunately not yet on the roadmap to be deployed in the Datacenters/Office LAN. 

Understand that. If others vote on this, our dev can pull this to the request pool for further evaluation.

Hi @paderijk 

Thanks for posting in our business forum.

paderijk wrote

 @Clive_A Curious if there are any updates from the TP-Link side?

 

I was considering to utilize the OpenAPI, although got with the last update an alert that it will be deprecated on (at least) the OC200.

I submitted for a response last week and today. I have not received a comment regarding this feature so far.