This topic

Smarthub 2 creates pinhole for wrong IPv6 address

DavidH7 — Thu, 30 May 2024 13:53:40 GMT

My Linux box configures two IPv6 addresses - one appears to be always the same and has the "noprefixroute" flag, and therefore cannot be accessed externally; the other is new every boot-up and is the one intended to be externally accessible. The Smarthub 2 should create a pinhole for the second, but most often creates it for the first, which means it is not accessible from outside.

This is a problem when I need to use certbot to renew certificates, because port 80 (or 443) must be accessible from outside to respond to the ACME challenge.

The Smarthub 2's interface is dumbed down to the point of unusability - I can't change the address of an IPv6 device, nor can I add a device with an IPv6 address that I choose.

Does anyone know a solution?

Re: Smarthub 2 creates pinhole for wrong IPv6 address

naylor2006 — Thu, 30 May 2024 14:06:59 GMT

I cant answer the original question but surely with that sort of requirement you would be better off using your own router so you can see what is actually going on whilst also completely open configuration. I cant imagine when the Hub2 was put together the concern was around folks utilizing IPV6, more like just folks switching it on and forgetting about it.

Anyway, surely if an IP you want to access externally keeps changing thats problematic anyway, you cant forward ports to an internal IP that keep changing, is that what you are saying, that you cannot set a static IP in the Router for IPV6?

If so why dont you just set the IP address on the linux box manually and take it out of the DHCP range on the router?

Re: Smarthub 2 creates pinhole for wrong IPv6 address

DavidH7 — Thu, 30 May 2024 14:11:25 GMT

I don't need a static IPv6 address; I have dynamic DNS (free) which I can update on every boot-up of the Linux box. So all I need is the Smarthub to either respond to only the correct one (preferably), or to allow me to add a device with the other address (less desirable because it requires manual intervention on every boot-up of the Linux box).

Re: Smarthub 2 creates pinhole for wrong IPv6 address

naylor2006 — Thu, 30 May 2024 14:29:53 GMT

Sorry, I'm lost.

Are the IPV6 addresses internal (LAN) or external?

I use dynamic DNS for my PPPOE IP4 address, just to update an A record when BT ever give me a different address, so I can always find my LAN from an external DNS record, then my router will port forward based on what I tell it to to fixed local addresses.

So I just dont think I understand your scenario or setup or expectation.

Re: Smarthub 2 creates pinhole for wrong IPv6 address

DavidH7 — Thu, 30 May 2024 14:40:07 GMT

The internal IPv6 address is irrelevant; it would never be accessible from the outside world.
The addresses I'm concerned with are external ones.
To update SSH/TLS certificates, I have to run certbot, which makes Let's Encrypt issue ACME challenges to verify that I own the domain in question. These challenges come in from several sites in the outside world. Hence certbot must be accessible from the outside world via port 80 or 443 for a few seconds while it responds to the challenges. The easiest way is to leave the chosen pinhole permanently open; certbot is only invoked for a few seconds while doing the update.
For more context, maybe it would help if you search the Internet for certbot, ACME challenge, and Let's Encrypt. The trouble is that I know how it works, so I probably take some particular knowledge for granted, i.e. I don't know what you don't know!

Re: Smarthub 2 creates pinhole for wrong IPv6 address

naylor2006 — Thu, 30 May 2024 14:48:36 GMT

Mate your first paragraph is about IPV6 addressing and how it can or cannot be accessed externally, you go on to mention pinhole, another name for port forwarding right? Sounds like a typical external IP to internal IP port forward question at that point.

But youre right, the rest I do not know and I wont know more than you it seems so will leave it there.

Re: Smarthub 2 creates pinhole for wrong IPv6 address

DavidH7 — Thu, 30 May 2024 14:55:04 GMT

Thanks for trying. Port forwarding is really an IPv4 concept. IPv6 means each device can have an externally accessible IPv6 address, and the firewall opens a pinhole for a port (or a range of ports) for that IPv6 address, which are forwarded without translation. So IPv6 is in some ways simpler than IPv4.

Re: Smarthub 2 creates pinhole for wrong IPv6 address

naylor2006 — Thu, 30 May 2024 15:07:01 GMT

Now that is a very simple way of explaining IPV6.

Re: Smarthub 2 creates pinhole for wrong IPv6 address

licquorice — Thu, 30 May 2024 15:10:37 GMT

Presumably as the publicly routeable IPv6 address is dynamic, the Hub pinhole has to track it from the device name rather than being able to enter an IP address.

I'm not sufficiently familiar with Linux, but can you give the publicly routeable address a unique name so the hub doesn't get confused.

Re: Smarthub 2 creates pinhole for wrong IPv6 address

licquorice — Thu, 30 May 2024 15:21:53 GMT

Are you using Stateful or Stateless addressing.

Re: Smarthub 2 creates pinhole for wrong IPv6 address

DavidH7 — Thu, 30 May 2024 20:41:28 GMT

Currently Stateless, but I haven't noticed any difference. What difference should it make?

Re: Smarthub 2 creates pinhole for wrong IPv6 address

licquorice — Thu, 30 May 2024 20:57:40 GMT

It might as the hub will be allocating the address rather than the device self-allocating.

Re: Smarthub 2 creates pinhole for wrong IPv6 address

DavidH7 — Thu, 30 May 2024 21:07:30 GMT

As far as I can see, the Smarthub assigns the Linux box's name (or sometimes a name based on its MAC address, and I don't know why it does one or the other) to an IPv6 address. Which party assigns the address, though? As I understand it, the router assigns the prefix (the top 64 bits) and the client assigns the rest (the bottom 64 bits), and then performs Duplicate Address Detection to ensure that the address really is unique. At some stage, the router accepts the address. The Smarthub lists the client in "My devices" with the hostname. But there is only one entry, which can be either of the two addresses that the Linux box asks for,

Re: Smarthub 2 creates pinhole for wrong IPv6 address

licquorice — Thu, 30 May 2024 21:29:13 GMT

For IPv4, you can forward ports based on either device name, or IP address if the device has a static address. For IPv6, you can only create a pinhole to the device name as the IPv6 address is dynamic.

If stateful, the hub allocates the address based on the prefix using DHCP, for stateless the device self configures the address based on the prefix.

Are you sure you are correctly creating the pinhole?

Re: Smarthub 2 creates pinhole for wrong IPv6 address

DavidH7 — Fri, 31 May 2024 19:57:41 GMT

To create a pinhole, all anyone can do is pick a device from the list that Smarthub gives, specify a port range, and specify the protocol (TCP, UDP or both). I don't see how anyone can do it incorrectly.

Re: Smarthub 2 creates pinhole for wrong IPv6 address

DavidH7 — Fri, 31 May 2024 19:59:34 GMT

I have to set the Smarthub to do either stateless or both, as I have another device on the LAN that can only use SLAAC.

Re: Smarthub 2 creates pinhole for wrong IPv6 address

jmcd-tf1 — Sun, 25 Aug 2024 11:59:00 GMT

also interested to get an answer to this as I'm trying to do something similar.

setting a pinhole to an internal device does not let traffic through the router.

I'm using ssh to test the port, so created an ipv6 pinhole to the device on the lan side. But no joy in trying to ssh to the device.

SSH to the device ipv6 GUA permanent address on the lan side does work.

I'm no networking professional, but this seems like the BT HUB pinhole doesn't work.

by the way DavidH7 in case it is of help, I use a cron shell script running on a pi that emails me when the router IP address gets changed by BT. This is v helpful so I can update access to the pi from external services manually.

Re: Smarthub 2 creates pinhole for wrong IPv6 address

DavidH7 — Mon, 26 Aug 2024 21:48:51 GMT

I don't think you've given quite enough information to work out what's going wrong.

Is this a Linux box that you're trying to create a pinhole for? If so, what does "ip -6 addr" show? Are you trying to create a pinhole for an IPv6 address that has the "noprefixroute" attribute? If so, that's not going to work, and it's not the fault of the Smarthub; such an address is not routable from the outside world.

If that's not what you're doing, then I think we need some more detail from you.

If you're using Windows, then I'm sorry, I can't help.