wan dhcpv6 blocked by firewall

[M4tt]

I'm using a GT-AX11000 with Merlin version 3004.388.7.

After updating my modem's firmware, my router suddenly stopped getting an IPv6 address. Initially, I thought the modem was to blame, but I have now found out that the built in IPv6 firewall of my asus router is blocking the DHCP request.

In the log, I see that odhcp6c doesn't get a response to the very first request and gets stuck at "Starting SOLICIT transaction (timeout 4294967295s, max rc 0)." As soon as I disable the IPv6 firewall and trigger a WAN reconnect, the router receives an IPv6 address via DHCP-PD (dynamic /64 network).

When I enable the firewall again, odhcp6c stops receiving an IP address, so the firewall obviously blocks the dhcp-request. Strangely, as mentioned this started with the last firmeware update of my Modem, before that IPv6 worked fine for a long time; I suspect that the responses to the dhcpv6-request no longer come from a Link-Local address or something other changed about the dhcp traffic. However, I don't want to leave the firewall disabled. I tried opening port 546 using ip6tables, but that didn't work. Maybe it's not enough, or I'm doing something wrong.

I would appreciate any tips!

 

[heysoundude]

I would suggest you open the same ports in the v6 firewall as you have open on the v4 firewall.

 

[M4tt]

By using tcpdump and setting the firewall dropped packages and odhcpd6c to verbose logging, I was able to fix the issue by putting the following two rules into /jffs/scripts/firewall-start:

ip6tables -I INPUT 1 -i eth0 -p udp --sport 546 --dport 547 -s fe80::/10 -d ff02::1:2 -j ACCEPT
ip6tables -I INPUT 1 -i eth0 -p udp --dport 546 -s fe80::/10 -d fe80::/10 -j ACCEPT

I need to put the rules to position 1 of the input chain, as otherwise the regarding traffic is obviously blocked by one of the "stock" firmware rules.

Shouldn't sending dhcpv6 requests to multicast and receiving the answer packets work on WAN without that rules? I haven't changed anything else re the firewall except of the both rules above.