How to block IPV6 from ISP
Although I do not have the IPV6 package installed (or to better put it I have it disabled) my cell phone when connected to the WiFi gets an IPV6 address from the ISP. Is there a way to block the phone from receiving one ? My ISP also offers me an IPV4 address and would like to use that one only . On the modem side the area where I can choose between IPV4 or IPV4/IPV6 is grayed out and both are displayed .
Re: How to block IPV6 from ISP
Are you "talking" to yourself?
Only you know the details and you talk to yourself, who wins among you?
You don't provide any useful information, such as device used, routeros version, etc.
Only you know the details and you talk to yourself, who wins among you?
You don't provide any useful information, such as device used, routeros version, etc.
-
-
jvanhambelgium
Forum Guru
- Posts: 1086
- Joined:
- Location: Belgium
Re: How to block IPV6 from ISP
Nope, on Android for example only a rooted phone can be change only to use IPv4 I've read somewhere.
Otherwise, if an IPv6 is available it will gladly receive on.
Don't know for iOS but I guess the same.
On APN's you can control it better and and use IPv4 only. I used that also on my Android.
Otherwise, if an IPv6 is available it will gladly receive on.
Don't know for iOS but I guess the same.
On APN's you can control it better and and use IPv4 only. I used that also on my Android.
Re: How to block IPV6 from ISP
Cell phone is a Xiaomi 9T pro , router OS is 6.48.2 on a RB751G-2HnD. What else do you need ?Are you "talking" to yourself?
Only you know the details and you talk to yourself, who wins among you?
You don't provide any useful information, such as device used, routerOS version, etc.
Thank you jvanhambelgium . I run a VPN between 2 locations and use location's (A) IPV4 from/for location (B) as well, but like you said as the provider in location (B) offers IPV6 and Android devices prefer the IPV6 over IPV4 .On APN's you can control it better and and use IPv4 only. I used that also on my Android.
Re: How to block IPV6 from ISP
What else do you need ?
Where the following information are written on the first post?
You thought it and you said it to yourself?
I run a VPN between 2 locations and use location's (A) IPV4 from/for location (B) as well,
but like you said as the provider in location (B) offers IPV6 and Android devices prefer the IPV6 over IPV4
If it is not the smartphone that instaurates the VPN connection, but
if it is the RouterBOARD that instaurates the VPN connection,
enable the IPv6 packet on the RouterBOARD, reboot, and on the /ipv6 firewall filter add a rule to drop all on forward chain
Last edited by rextended on Fri Aug 06, 2021 8:11 pm, edited 4 times in total.
Re: How to block IPV6 from ISP
I am sure that are better ways to phrase the above...You thought it and you said it to yourself?
As I don't understand the grammar of this : "If is not the smartphone than instaurate the VPN connection, but is the RouterBOARD, "
Do you mean : "if it's not the smartphone (I assume, the problem?), then instaurate the VPN connection (disable and then enable?), and then enable on RouterBoard IPv6 packet, reboot, and on /ipv6 firewall filter add a rule to drop all on forward chain " ?
Re: How to block IPV6 from ISP
No.I am sure that are better ways to phrase the above...You thought it and you said it to yourself?
Ah, is something missing? I probably just thought and told myself ...As I don't understand the grammar of this : "If is not the smartphone than instaurate the VPN connection, but is the RouterBOARD, "
What I mean is clear, "it" & "the" or not.
If it is not the smartphone that instaurates the VPN connection, but
if it is the RouterBOARD that instaurates the VPN connection,
enable the IPv6 packet on the RouterBOARD, reboot, and on the /ipv6 firewall filter add a rule to drop all on forward chain
Re: How to block IPV6 from ISP
chain=forward action=drop connection-state=established,related log=no log-prefix=""
is this above correct ?
is this above correct ?
Re: How to block IPV6 from ISP
I do not see any "connection-state" (or "log-prefix") on what I wrote, did you imagine it with yourself?chain=forward action=drop connection-state=established,related log=no log-prefix=""
is this above correct ?
Code: Select all
/ipv6 firewall filter
add chain=forward action=drop
Re: How to block IPV6 from ISP
tried this first :
and didn't see any counters (they are at 0) . From my android phone an IPV6 check still comes positive .
Code: Select all
/ipv6 firewall filter
add chain=forward action=dropRe: How to block IPV6 from ISP
if this other rules do not drop all IPv6 traffic on the smartphone,
the IPv6 traffic directed to the phone can't be blocked from routerboard.
Paste this on terminal
the IPv6 traffic directed to the phone can't be blocked from routerboard.
Paste this on terminal
Code: Select all
/ipv6 firewall raw
add chain=prerouting action=drop
add chain=output action=drop
/ipv6 firewall filter
remove [find]
add chain=input action=drop
add chain=forward action=drop
add chain=output action=drop
Last edited by rextended on Sat Aug 07, 2021 11:05 am, edited 2 times in total.
-
-
jvanhambelgium
Forum Guru
- Posts: 1086
- Joined:
- Location: Belgium
Re: How to block IPV6 from ISP
Your phone is connected to the Wifi of the ISP modem, so its received indeed (also) a IPv6 and will go out to Internet via the ISP-device right ?
This IPv6 traffic is not passing through your Routerboard I guess, it would not be possible anyway since the IPv6 package is disabled. So you will not see anything in the "connection" table on the Mikrotik.
Please make a simple schematic WHAT IS CONNECTED WHERE because your post is very confusing to say the least, especially with the "VPN" on top of this all.
This IPv6 traffic is not passing through your Routerboard I guess, it would not be possible anyway since the IPv6 package is disabled. So you will not see anything in the "connection" table on the Mikrotik.
Please make a simple schematic WHAT IS CONNECTED WHERE because your post is very confusing to say the least, especially with the "VPN" on top of this all.
Re: How to block IPV6 from ISP
On what basis do you write such a thing?This IPv6 traffic is not passing through your Routerboard I guess
it would not be possible anyway since the IPv6 package is disabled.
Disabling the IPv6 packet does not disable IPv6 traffic passing through the RouterBOARD.
Has just set and used a rule, and the package is disabled?the IPv6 package is disabled
Re: How to block IPV6 from ISP
This rule :
Did return counters but none of the others, so probably IPV6 like you said cannot be blocked towards the phone . I appreciate the input ! ! !
Code: Select all
/ipv6 firewall raw
add chain=prerouting action=drop-
-
jvanhambelgium
Forum Guru
- Posts: 1086
- Joined:
- Location: Belgium
Re: How to block IPV6 from ISP
Ah did not know that. I was under the impression that if you disable your IPv6 package there would not be any IPv6 communications possible through the router.On what basis do you write such a thing?This IPv6 traffic is not passing through your Routerboard I guess
it would not be possible anyway since the IPv6 package is disabled.
Disabling the IPv6 packet does not disable IPv6 traffic passing through the RouterBOARD.Has just set and used a rule, and the package is disabled?the IPv6 package is disabled
I have a RB3011 here with the IPv6 package installed but disabled and also under IPv6/Settings unchecked "IPv6 forwarding". I think its safe to say no IPv6 should/would be allowed to "passthrough" ? Because that would be a serious security issue ?!
Apart from all the postings, all is still very confusing, especially when the phone receives an IP directly from the ISP apparently in my understanding.
A simple schematic would help.
Re: How to block IPV6 from ISP
For disable IPv6 traffic, also you can paste last set of firewall rule I posted.
But if you disable IPv6 packet, how can you access to "IPv6 forwarding" settings?
But if you disable IPv6 packet, how can you access to "IPv6 forwarding" settings?
Last edited by rextended on Sat Aug 07, 2021 11:35 am, edited 1 time in total.
Re: How to block IPV6 from ISP
At this point, if IPv6 are not dropped, disable IPv6 package and reboot.Did return counters but none of the others, so probably IPV6 like you said cannot be blocked towards the phone . I appreciate the input ! ! !
-
-
jvanhambelgium
Forum Guru
- Posts: 1086
- Joined:
- Location: Belgium
Re: How to block IPV6 from ISP
In my case I might have explained it incorrect. My RB3011 has the IPV6 package installed & enabled.For disable IPv6 traffic, also you can paste last set of firewall rule I posted.
But if you disable IPv6 packet, how can you access to "IPv6 forwarding" settings?
IPv6/Settings => IPv6 "forwarding" is not ticked , so I assume no IPv6 packets could get through my RB3011 (not from the outside>in, not from the inside>out)
Re: How to block IPV6 from ISP
How about we start with a config from that device?
And a network diagram.
And a network diagram.
Re: How to block IPV6 from ISP
The IPv6 forward simply enable or disable the automatic forwarding of packet between internal lan/ vlan, etc.IPv6/Settings => IPv6 "forwarding" is not ticked , so I assume no IPv6 packets could get through my RB3011 (not from the outside>in, not from the inside>out)
Can be used to separate internal networks without the use of firewall rules.
BUT it still permit the IPv6 traffic from WAN to the LANs
-
-
jvanhambelgium
Forum Guru
- Posts: 1086
- Joined:
- Location: Belgium
Re: How to block IPV6 from ISP
Really ? I'm learning new things on RouterOS every day stillThe IPv6 forward simply enable or disable the automatic forwarding of packet between internal lan/ vlan, etc.IPv6/Settings => IPv6 "forwarding" is not ticked , so I assume no IPv6 packets could get through my RB3011 (not from the outside>in, not from the inside>out)
Can be used to separate internal networks without the use of firewall rules.
BUT it still permit the IPv6 traffic from WAN to the LANs
Thanks for pointing that out.
Now I have an extensive IPv6 FW-policy anyway on input and forward chains so I'm never too concerned.
(eg. I drop any IPv6 in ingress not originated from the LAN/Bridge side)
Re: How to block IPV6 from ISP
I have a question, but not completely sure is this correct topic.Code: Select all/ipv6 firewall filter add chain=forward action=drop
How can I disable ipv6 on MT with ROS 7.3 ? I want to block it totally (in, out, forwarding packets).
Re: How to block IPV6 from ISP
You have simply used the forum search function?
/ipv6 settings set disable-ipv6=yes
/ipv6 settings set disable-ipv6=yes
Re: How to block IPV6 from ISP
Every advice here is missleading and gives the impression to the reader that by disabling ipv6 in mikrotik or by dropping the packets in firewall you are blocking the ipv6 = WRONG.
If there is a connected router in then network OTHER than mikrotik and this rogue router has enabled RA advertising all the capaple ipv6 devices will "get" a public ipv6 from this router and go to internet by this rogue router.
This is a terrible security threat and it has been handled by Cisco with the "ipv6 RA guard" blocking RA traffic in Layer 2 level per interface port.
In windows and linux you mostly have ipv6 disabled that why you dont face this problem but every mobile device has ipv6 enabled by default and of cource there is no easy way to closed it. Even if you could you can't inform every possible client to block ipv6 "because im running on mikrotik" and i can't secure you.
A good read: https://www.rfc-editor.org/rfc/rfc6105
If there is a connected router in then network OTHER than mikrotik and this rogue router has enabled RA advertising all the capaple ipv6 devices will "get" a public ipv6 from this router and go to internet by this rogue router.
This is a terrible security threat and it has been handled by Cisco with the "ipv6 RA guard" blocking RA traffic in Layer 2 level per interface port.
In windows and linux you mostly have ipv6 disabled that why you dont face this problem but every mobile device has ipv6 enabled by default and of cource there is no easy way to closed it. Even if you could you can't inform every possible client to block ipv6 "because im running on mikrotik" and i can't secure you.
A good read: https://www.rfc-editor.org/rfc/rfc6105
-
-
jvanhambelgium
Forum Guru
- Posts: 1086
- Joined:
- Location: Belgium
Re: How to block IPV6 from ISP
Euh .... if you introduce ROUGE routers on your network with their own Internet connectivty offcourse there is a huge issue! Nothing to do with Mikrotik itself.Every advice here is missleading and gives the impression to the reader that by disabling ipv6 in mikrotik or by dropping the packets in firewall you are blocking the ipv6 = WRONG.
If there is a connected router in then network OTHER than mikrotik and this rogue router has enabled RA advertising all the capaple ipv6 devices will "get" a public ipv6 from this router and go to internet by this rogue router.
This is a terrible security threat and it has been handled by Cisco with the "ipv6 RA guard" blocking RA traffic in Layer 2 level per interface port.
A good read: https://www.rfc-editor.org/rfc/rfc6105
However, IF your Mikrotik is the only device with ISP-connectivity AND you disable "IPv6 forwarding" & configuration I would be very , very surprised if some public IPv6 could creep into your network.
THAT would be a big Mikrotik security issue.
Re: How to block IPV6 from ISP
It can always be that any device on your network sets up a IPv6-over-IPv4 tunnel and uses it to access IPv6. It can even forward IPv6 traffic for others.
-
-
jvanhambelgium
Forum Guru
- Posts: 1086
- Joined:
- Location: Belgium
Re: How to block IPV6 from ISP
Sure, dozens of possibilities to still slip/sneek through since no Mikrotik has no true UTM/IDP-capabilities that could detect & block various tunneling/evasive tooling/protocols (eg. Teredo or other 6-in-4)It can always be that any device on your network sets up a IPv6-over-IPv4 tunnel and uses it to access IPv6. It can even forward IPv6 traffic for others.
But I think it is important to state that IF you disable IPv6 on your Mikrotik (forwarding,package) no native IPv6 will sneek through! and no single endpoint on your network will ever be able to access (or be accessed!) using native IPv6.
Re: How to block IPV6 from ISP
That is only true when you run the router in a routing configuration. When it is bridging, it will happily pass IPv6 without IPv6 support installed or -enabled.
-
-
StubArea51
Trainer
- Posts: 1741
- Joined:
- Location: stubarea51.net
- Contact:
Re: How to block IPV6 from ISP
my cell phone when connected to the WiFi gets an IPV6 address from the ISP. Is there a way to block the phone from receiving one ?
Why do you want to disable IPv6?
Re: How to block IPV6 from ISP
A better question, what can i do with IPv6 that are so good that I need to enable it?Why do you want to disable IPv6?
I have an ISP with IPv6, but does not use it. From how I do see it:
No faster internet.
More complex firewall setup.
Re: How to block IPV6 from ISP
You will be able to use ipv6 only services….
Re: How to block IPV6 from ISP
That gives me what? (as a normal user)
Faster internet?
More websites?
Faster internet?
More websites?
Re: How to block IPV6 from ISP
You can solve some problems that occur due to NAT.
The firewall is not more complicated, the default settings are about the same (allow established/related, allow new traffic going outside).
The firewall is not more complicated, the default settings are about the same (allow established/related, allow new traffic going outside).