Reply
Highlighted
Luminary

R-7000 and IPv6 Test.

Just hooked up the R-7000 and ran the ipv6 test and it came back 17/20 with this message.

Your router or firewall is filtering ICMPv6 messages sent to your computer. An IPv6 host that cannot receive ICMP messages may encounter problems like some web pages loading partially or not at all.

I dont seem to have any issues with IPv6 sites loading. When i had my Asus router always got 19/20 witch from what i understand is the desired result. Anybody have any idea why the R-7000 shows the above error ?? I have not changed anything in the firewall on my computers and i dont see any options in the router GUI to change anything.

Other then that this router seems to work well at least for one day up time. Smiley Happy

Message 1 of 13
Highlighted
Luminary
Luminary

Re: R-7000 and IPv6 Test.

disable the firewall and the ddos protection and u wull get a 20/20 and pass
Message 2 of 13
Highlighted
Virtuoso

Re: R-7000 and IPv6 Test.

Yes, the IPv6 firewall on the R7000 using stock firmware filters out the ICMPv6 packets that are directed to you. This is not supposed to happen, and RMerlin has configured the ip6tables rules for his Asus firmware so that these packets are not filtered. Tomato ARM on the R7000 also filters out these ICMPv6 packets, so 17/20. DD-WRT, back when I could get IPv6 to work on Comcast also filters out the ICMPv6 packets, again 17/20. Some people who are more expert with IPv6 than I have configured their dd-wrt IPv6 specifically to avoid this problem.

So really, of the firmware that I've used, the only IPv6 firewall that works correctly (according to the IPv6 specs) is RMerlin's at this time.

On the other hand, Babylon5 has reported this problem to Netgear. I don't know whether or when this will be fixed, but Netgear should know about it.

Hopefully you're not going to be leaving firewalls disabled to get a higher score on an IPv6 test *smile*.
Message 3 of 13
Highlighted
Master

Re: R-7000 and IPv6 Test.

RogerSC wrote:
Yes, the IPv6 firewall on the R7000 using stock firmware filters out the ICMPv6 packets that are directed to you. This is not supposed to happen, and RMerlin has configured the ip6tables rules for his Asus firmware so that these packets are not filtered. Tomato ARM on the R7000 also filters out these ICMPv6 packets, so 17/20. DD-WRT, back when I could get IPv6 to work on Comcast also filters out the ICMPv6 packets, again 17/20. Some people who are more expert with IPv6 than I have configured their dd-wrt IPv6 specifically to avoid this problem.

So really, of the firmware that I've used, the only IPv6 firewall that works correctly (according to the IPv6 specs) is RMerlin's at this time.

On the other hand, Babylon5 has reported this problem to Netgear. I don't know whether or when this will be fixed, but Netgear should know about it.

Hopefully you're not going to be leaving firewalls disabled to get a higher score on an IPv6 test *smile*.


I have contacted NETGEAR support myself and did quite a few testing, including wireshark captures as they asked for them and screenshots of the two test sites that report problems

Granted, it was not for native ipv6 but for a 6to4 tunnel but it doesn't matter. The support was very cooperative and reported back to the devs with all collected data I provided

I wanted to look myself at the ipv6 iptables but when you telnet into the router and run iptables or ip6tables, it exists with a missing library. This also got reported along with the above
Routing: NETGEAR R7800 - Voxel Firmware 1.0.2.80SF
Switching: 2x NETGEAR 8-ports (GS108v4) / 1x NETGEAR 16-ports (JGS516v2)
Desktop: AMD Ryzen 7 3700X - Server: Intel Core i7-7700K - NAS: Intel Pentium G4400
Message 4 of 13
Highlighted
Luminary

Re: R-7000 and IPv6 Test.

Thanks all. I understand whats going on now question is what real affect does this bug have ? I seem to be able to reach IPv6 sites with no issues. Any thoughts ?
Message 5 of 13
Highlighted
Virtuoso

Re: R-7000 and IPv6 Test.

I haven't run into any visible problems with it, either, but I'd guess that we're both using dual-stack IPv4 and IPv6. If we only had IPv6 available, then we'd see some problems from having ICMPv6 packet filtering not implemented according to the specs.

Take a look at:

http://www.ietf.org/rfc/rfc4890.txt

It talks about ICMPv6, and can provide some insight.
Message 6 of 13
Highlighted
Virtuoso

Re: R-7000 and IPv6 Test.

And there's this one, that I forgot to include above:

http://tools.ietf.org/html/rfc4443

that talks more about the ICMPv6 protocol itself, rather than filtering as the one in my previous message does.
Message 7 of 13
Highlighted
Luminary

Re: R-7000 and IPv6 Test.

Thanks Roger your knowledge is always a huge help. I have always been a Asus guy but after trying the 87U hoping for a kick butt router i was very disappointed with the random disconnects and the 5 ghz radio shutting down over night requiring a reboot to get a connection back so i returned it to try the R-7000 and i have to say i like it, the little IPv6 bug is the only thing i can find thats not working perfect for me. I also picked up the SB-6183 modem and works excellent !! Smiley Happy Jim !
Message 8 of 13
Highlighted
Luminary

Re: R-7000 and IPv6 Test.

I am not sure how this forum is moderated but waiting hours for a simple text post to post is ridiculous. No disrespect intended just a observation. There is no need for this, posts can be changed or deleted later if they don't follow forum rules and guidelines. :rolleyes: Jim!
Message 9 of 13
Highlighted
Virtuoso

Re: R-7000 and IPv6 Test.

Jim769 wrote:
I am not sure how this forum is moderated but waiting hours for a simple text post to post is ridiculous.


Yes it is a little hard to get used to, but I've been using the forum a lot since I got the R7000 almost 1.5 years ago now. I've kind of gotten used to trying to help people in slow motion. I'll never get used to not being able to edit a post to correct a typo, so am as careful as I can be with my postings. However, I still manage to look ignorant a good percentage of the time with all my typos *smile*.

The other thing that is difficult is that you never know if you're providing duplicate information; or how many postings there will be between the one that you're responding to and yours. So you may need more or less context than you think so that a response is associated with the right question *smile*. Given that, one of the things that the moderators do is remove extra context that posters put in because they're not sure if their reply will come right after the posting they're responding to, or 5 or 10 posts down.

It's a different world here.
Message 10 of 13
Highlighted
Guide

Re: R-7000 and IPv6 Test.

Just FYI, I have "disable the firewall and the ddos protection" (im guessing they mean "Disable Port Scan and DoS Protection" since there is no "firewall" option) and still the result is filtered.

Hopefully Netgear corrects the issue, otherwise we might have some problems as the web moves to IPv6...
Message 11 of 13
Highlighted
Guide

Re: R-7000 and IPv6 Test.

Just set the R7000 IPV6 to Auto Config and you will get 19/20.

If you can set up a host name reverse DNS you will get 20/20.

Depending on your browser you may get 18/20 first time you run the rest, run it again and you will get 19/20.
Message 12 of 13
Highlighted
Luminary

Re: R-7000 and IPv6 Test.

I have it set to auto config and so do many others and its filtering ICMP IPv6 packets. All my Asus routers show 19/20 pass. 

Message 13 of 13
Top Contributors
Discussion stats
  • 12 replies
  • 17991 views
  • 4 kudos
  • 6 in conversation
Announcements