RT-AC68U can't ping IPv6 but clients can?

[bengalih]

Can anyone explain, or tell me where I could look, to figure out why my router doesn't seem to have reachability to IPv6 addresses, even though the clients off the router can?

For instance, from my machine connected to the RT-AC68U over wifi I can:

Pinging www.google.com [2607:f8b0:4000:819::2004] with 32 bytes of data:
Reply from 2607:f8b0:4000:819::2004: time=7ms
Reply from 2607:f8b0:4000:819::2004: time=7ms
Reply from 2607:f8b0:4000:819::2004: time=7ms
Reply from 2607:f8b0:4000:819::2004: time=7ms

But when I try this SSH into the router I can't get any response.

I have IPv6 native configured and according to the various ipv6 testing websites they all say I'm perfectly connectable.
Is there a reason/issue with the fact that I can't actually test the connectivity from the router itself?

 

[Dabombber]

It could be a dns issue, are you unable to ping google.com, or [2607:f8b0:4000:819::2004]?

 

[bengalih]

I can't even ping the v6 IP:

root@asus:/tmp/home/root# ping -c1 -4 www.google.com
PING www.google.com (142.250.114.147): 56 data bytes
64 bytes from 142.250.114.147: seq=0 ttl=105 time=6.948 ms

--- www.google.com ping statistics ---
1 packets transmitted, 1 packets received, 0% packet loss
round-trip min/avg/max = 6.948/6.948/6.948 ms
root@asus:/tmp/home/root# ping -c1 -6 www.google.com
PING www.google.com (2607:f8b0:4000:819::2004): 56 data bytes

--- www.google.com ping statistics ---
1 packets transmitted, 0 packets received, 100% packet loss
root@asus:/tmp/home/root# ping -c1 2607:f8b0:4000:819::2004
PING 2607:f8b0:4000:819::2004 (2607:f8b0:4000:819::2004): 56 data bytes

--- 2607:f8b0:4000:819::2004 ping statistics ---
1 packets transmitted, 0 packets received, 100% packet loss
root@asus:/tmp/home/root#

 

[asmopul]

what commands are you using in your SSH session.

 

[bengalih]

what commands are you using in your SSH session.

Shown in the post directly above. What else do you need?

 

[ColinTaylor]

Presumably you're running the current stock or Merlin firmware and not the 384.19 shown in your signature?

Does the output of ifconfig -a on the router show anything unusual regarding IPv6?

 

[asmopul]

use
ping6 google.com
or
ping ipv6.google.com

 

[bengalih]

use
ping6 google.com
or
ping ipv6.google.com

View attachment 37048

Not sure why you think that is necessary, you can clearly see from what I posted above:

root@asus:/tmp/home/root# ping -c1 -6 www.google.com
PING www.google.com (2607:f8b0:4000:819::2004): 56 data bytes

The "-6" already makes it use IPV6 as you can see the name resolution works fine, it just doesn't route.
For the heck of it I tried your commands as well, but same negative result.

 

[bengalih]

Presumably you're running the current stock or Merlin firmware and not the 384.19 shown in your signature?

Does the output of ifconfig -a on the router show anything unusual regarding IPv6?

I am still running 384.19. It's not that old though, probably upgraded early summer of this year.
I'll go ahead and work on getting the latest installed just to ensure there isn't some fix that might deal with it.
ifconfig-a looks ok, the interfaces have IPs. I'm able to ping internally to the IPv6 address of my workstation, but not out to google or other internet destinations.

 

[ColinTaylor]

How about:

ip -6 route show

Are you using any VPN clients?

 

[bengalih]

How about:

ip -6 route show

Are you using any VPN clients?

I do have one configured that I very occasionally enable if I want all the devices in my network to go out over VPN, but 99.9% of the time (like now) the client is OFF.

 

[bengalih]

How about:

ip -6 route show

Are you using any VPN clients?

Yeah, it doesn't look like the routes are there maybe? (I'm not great with IPv6):

keymaster@router-asus:/tmp/home/root# ip route show
99.101.XXX.1 dev eth0  proto kernel  scope link
10.16.0.0/24 dev tun22  proto kernel  scope link  src 10.16.0.1
10.10.20.0/24 dev wl0.2  proto kernel  scope link  src 10.10.20.1
172.20.20.0/24 dev wl0.1  proto kernel  scope link  src 172.20.20.1
10.8.0.0/24 dev tun21  proto kernel  scope link  src 10.8.0.1
172.20.30.0/24 dev wl1.1  proto kernel  scope link  src 172.20.30.1
10.10.10.0/24 dev br0  proto kernel  scope link  src 10.10.10.1
99.101.XXX.0/23 dev eth0  proto kernel  scope link  src 99.101.XXX.XXX
127.0.0.0/8 dev lo  scope link
default via 99.101.XXX.1 dev eth0

keymaster@router-asus:/tmp/home/root# ip -6 route show
2001:506:7ae0:1230::1 dev eth0  proto kernel  metric 256  mtu 1500 advmss 1440 hoplimit 0
2600:1700:ae00:c080::/60 dev br0  proto kernel  metric 256  mtu 1500 advmss 1440 hoplimit 0
fe80::/64 dev eth1  proto kernel  metric 256  mtu 1500 advmss 1440 hoplimit 0
fe80::/64 dev eth2  proto kernel  metric 256  mtu 1500 advmss 1440 hoplimit 0
fe80::/64 dev br0  proto kernel  metric 256  mtu 1500 advmss 1440 hoplimit 0
fe80::/64 dev wl0.1  proto kernel  metric 256  mtu 1500 advmss 1440 hoplimit 0
fe80::/64 dev wl0.2  proto kernel  metric 256  mtu 1500 advmss 1440 hoplimit 0
fe80::/64 dev wl1.1  proto kernel  metric 256  mtu 1500 advmss 1440 hoplimit 0
fe80::/64 dev ifb0  proto kernel  metric 256  mtu 1500 advmss 1440 hoplimit 0
fe80::/64 dev ifb1  proto kernel  metric 256  mtu 1500 advmss 1440 hoplimit 0
fe80::/64 dev dpsta  proto kernel  metric 256  mtu 1500 advmss 1440 hoplimit 0
fe80::/64 dev vlan2  proto kernel  metric 256  mtu 1500 advmss 1440 hoplimit 0
fe80::/64 dev eth0  proto kernel  metric 256  mtu 1500 advmss 1440 hoplimit 0
fe80::/64 dev vlan1  proto kernel  metric 256  mtu 1500 advmss 1440 hoplimit 0
default via fe80::2d0:f6ff:fee3:4580 dev eth0  proto kernel  metric 1024  expires 4131sec mtu 1500 advmss 1440 hoplimit 64

(v4 info commented out)

 

[ColinTaylor]

Yeah, I don't have an IPv6 connection so I'm not sure what it's meant to look like on the router. The default IPv6 route seems to be using the eth0 link local address. I don't know whether that's normal.

Try this (random guess):

/bin/ping -6 -I 2001:506:7ae0:1230::1  2607:f8b0:4000:819::2004

If 2001:506:7ae0:1230::1 isn't your WAN IPv6 address change the command to use whatever address it is.

I think @dave14305 has an IPv6 connection.

 

[asmopul]

was a fix for IPv6 ping in a later fw:
386.2_2 (13-Apr-2021)
- FIXED: IPv6 pings were blocked if sent below the rate limit
instead of above (issue introduced in 42095)

 

[ColinTaylor]

was a fix for IPv6 ping in a later fw:
386.2_2 (13-Apr-2021)
- FIXED: IPv6 pings were blocked if sent below the rate limit
instead of above (issue introduced in 42095)

That wouldn't be applicable to his router's firmware as it doesn't rate limit pings. It also only effects incoming and forwarded packets, not outgoing packets from the router.

 

[heysoundude]

(I'm not great with IPv6)

perhaps some time at https://ipv6.he.net/certification/ will help you change that for the better

 

[asmopul]

perhaps some time at https://ipv6.he.net/certification/ will help you change that for the better

Done in 2009. Great place.

 

[asmopul]

Did you look at the usual suspects?
Firewall tab
Ping enabled
IPv6 Firewall disabled.

 

[tramchamploo]

Same problem here with 386.3_2

 

[learning_curve]

Can anyone explain, or tell me where I could look, to figure out why my router doesn't seem to have reachability to IPv6 addresses, even though the clients off the router can?

For instance, from my machine connected to the RT-AC68U over wifi I can:

Pinging www.google.com [2607:f8b0:4000:819::2004] with 32 bytes of data:
Reply from 2607:f8b0:4000:819::2004: time=7ms
Reply from 2607:f8b0:4000:819::2004: time=7ms
Reply from 2607:f8b0:4000:819::2004: time=7ms
Reply from 2607:f8b0:4000:819::2004: time=7ms

But when I try this SSH into the router I can't get any response.

I have IPv6 native configured and according to the various ipv6 testing websites they all say I'm perfectly connectable.
Is there a reason/issue with the fact that I can't actually test the connectivity from the router itself?

FWIW I also have RT-AC68U with IPv6 and there is an quirk, but it's not exactly the same as yours and it's not a serious problem (for me) either. It might help you trace / identify a similar quirk that your Router has.

I can ping and/or ping6 ANY domain / IP address either from any Client on the router AND from the Router itself (via SSH) without ANY problems, apart from... Google... That's because the actual oddity is this: Both www.google.com and other variants of it e.g. google.com can be pinged i.e. IPv4) from either Client or Router, but none of them can be pinged via ping6 i.e. IPv6 from either Client or Router.

In summary, it's ONLY Google that has this IPv6 ping limitation (for me) and this applies to both Client and Router. Yours, if I've understood correctly, applies only to your Router though?

The two related questions that I have, are...

Did you try to ping6 other domains besides Google, directly from your Router and if so, what happened?

Are the IPv6 DNS settings identical on both your Client (s) and your Router?
Mine are (but none of them include Google, which, possibly... (I'm just guessing here, as I have no need or inclination to alter the DNS setups that I have, just to test Google IPv6...) is why it's a common quirk for me.