*This article presumes you have IPv6 setup on your BGW-320, prefix delegation setup for your internal network using an internal firewall, or very simply a device setup on the AT&T provided network to open a port to.*
After recently receiving AT&T’s newer modem/router/firewall, the BGW-320 (at least newer than what I’ve had for many years) I struggled with how to open up IPv6 firewall rules to my internal servers and ports. I asked Gemeni and Grok and the same answer came back from users that it wasn’t really possible using this model router.
But after dinking around with the rules, turns out it is possible. First of all, I knew this much, but for others’ info, you don’t set it up in the normal NAT/Gaming area of the firewall tab in the admin console, which only applies to IPv4 NAT port forwarding. Because IPv6 doesn’t need to use NAT, you use the Packet Filter tab instead. Within here, I wound up getting rid of all the default rules that were setup to clear out the junk and just have my rules.
I initially created the rules with only the IP version, protocol, dest port and dest IPv6 address. That didn’t work. And forums (as well as AI) seemed to indicate it wouldn’t work and so I was resigned to just not have it setup anymore.
But then I started dinking more a little at a time and discovered you had to also add ingress and egress rules as well because I could see users were attempting to hit the ports but the AT&T router was still blocking them.
Before deleting the default rules, I noticed some they had ingress and egress rules set. So for the heck of it I threw those in there as well (Ingress WAN, Egress LAN) and low and behold, traffic started passing through.
Fully formed rule:
IPv6 access hits from the outside:
Hope this helps someone else out there.
I’m not sure at what point, but some time over the past week or two, my 2Wire 3800 HGV-B router was upgraded to new firmware (by AT&T of course), version 6.1.9.24 or rather 6.1.9.23-enh.tm. I’m not positive this fixed it or if AT&T upgraded their firewall policy, but for whatever reason, my NAT loopback works now. This has been a major complaint by both tech-ey customers and AT&T tech’s on various forums I’ve read ever since U-Verse started it’s roll-out a couple of years ago. It’s a pain to work around if you’re doing any port-forwarding on the outside of the firewall and then attempt to access those open ports from the inside of the network outward. Well, if you get upgraded to the latest version or get the latest firewall rules from AT&T, you should be good now.