Smart Hub 7 Plus: IPv6 pinholes do not forward inbound traffic

[patters]

Once IPv6 LAN is working (see separate Router Advertisement problem):

• My NAS has a global IPv6 address (GUA).
• Outbound IPv6 works:

ping -6 www.google.com

returns successful replies.

• The SSH service is listening:

netstat -lnpt | grep 202

shows:

tcp6       0      0 :::202       :::*       LISTEN

• Dynamic DNS has updated correctly:

example.synology.me AAAA 2a00:1234:5678:9abc:0211:32ff:fe2d:750f

• Hub Manager pinhole configured:

IPv6 address:
2a00:1234:5678:9abc:0211:32ff:fe2d:750f

Protocol:
TCP

Port:
202

However, an external IPv6 SSH attempt:

ssh -6 [email protected] -p 202

times out.

Even ruling out DNS:

ssh -6 user@2a00:1234:5678:9abc:0211:32ff:fe2d:750f -p 202

A tcpdump on the NAS:

tcpdump -i eth0 -nn 'ip6 and tcp port 202'

shows no incoming TCP SYN packets.

I also tested ICMPv6 and saw no inbound echo requests arriving at the NAS.

This suggests the Hub is not forwarding permitted inbound IPv6 traffic through the pinhole/firewall, even when the LAN IPv6 configuration is otherwise working. This has been reported before but remains an issue.

Firmware version: r4.27.1-R-1862254-PROD-84001

App version: 3.14.5

[patters]

I understand that ISP-supplied routers are not full featured, but when the TCP/IP stack doesn't even work properly: that's a major concern. I am paying to rent this equipment after all.

Please can a moderator forward this information to the appropriate people in EE. I would raise a support request, but there is no way to include this level of technical information and their remit is mainly resolving issues with basic connectivity.

[bobpullen]

@patters - it's been reported in the past elsewhere round these parts e.g. here. I believe the problem is acknowledged and the necessary teams are aware.

[patters]

I have spent several hours this evening performing a factory reset, and reconfiguring all my wifi settings as I had before. Unfortunately it hasn't made the slightest difference.

The IPv6 pinhole I have configured is not working. If I test it from the LAN side from a MacBook with IPv6, it works using the GUA:

ssh -6 myuser@2a00:1234:8765:9abc:0211:32ff:fe2d:750f -p 202

If I test using an Amazon EC2 instance outside my network it does not. It's as if the configured pinhole is being ignored completely.

And it's not an AWS port restriction either because the exact same port when launched over IPv4 (with -4) is fine.

[JimM11]

@patters The factory reset did not work which was a bit off a hope more than anything, and is a pure pain just to get back to were you need to be if you have made changes, not many will be trying to iPv6 PF at the best off times and the 7+ has a few iPv4 PF issues along with your findings. 

[bobpullen]

@patters - I wouldn't expect it to be working as per my earlier comment. Whatever the issue, it seemingly needs fixing with a firmware update.