Airtel Fiber Port forwarding over IPv6

I have the basic Airtel Fiber 499 plan in Pune. I wanted to forward port 3389 but my IPv4 address is behind CGNAT, and I thought since the IPv6 address is public that would be possible, but it's not reachable from outside the home network. I emailed Airtel support, and the technician called me and told me port forwarding is not possible without buying a static IP, but with a public IPv6 address that should not be the case. Has anyone successfully forwarded ports on their default airtel ont without getting a static IP? I don't want to pay an additional 200-300 per month for that, so I'm temporarily using Tailscale but I want faster speeds.

jayanttyagi said:

Just allow inbound connections in firewall? No need to port forward if router gets assigned ipv6.

Click to expand...

I've turned off both router and windows firewalls but still have pings from outside timing out

superczar said:

you can forward ipv4 on airtel without static ip with the exception of 80, 443.
these 2 ports are available only on static ip plans

ipv6 without a proper firewall doesnt need port forwarding - you can access your client devices directly from the WAN side without any further setup since consumer grade routers dont have a ipv6 firewall to begin with

Click to expand...

The IPv4 address in my router's dashboard and the IP address from https://whatismyipaddress.com/ are different, and I've tried port forwarding in the past and it worked but I'm no longer getting dynamic public ipv4

DBot said:

Based on this, I think your connection is NATted. You can’t do it without static IP or them opening up specific ports and forwarding traffic to your router. Your best bet is CloudFlare tunnels / Tailscale as you mentioned in your case.

I’ve tried with my ISP previously but none of my solutions worked, finally purchased static IP and used my own router.

Click to expand...

That's why I wanted to get IPv6 working, but it looks like it's behind some kind of NAT too, which is just stupid. I haven't looked into cloudflare tunnels yet, are their speeds faster than tailscale?

superczar said:

ipv6 on airtel does not use NAT - but may vary depending on location.
Jus check if your client devices are getting an ipv6 address and post it here (the starting numbers)
typically fe80 is link local only while public ipv6 (on airtel) starts with 2401:

Click to expand...

I'm definitely getting a public IPv6 as far as I can tell
From test-ipv6.com

From ipconfig /all

I've resolved the issue if anyone else is trying to achieve this but have no idea how insecure my network has become in the process, so follow this at your own risk. I did 3 things
1) Changed DNS to Google DNS
On the remote PC (PC you want to connect to) open start and type ncpa.cpl to open the Network Connections window, choose your adapter (ethernet in my case) and right click and open properties, scroll down to Internet Protocol version 6 and select it and click properties, then click "Use the following DNS server addresses" and enter google's dns server addresses. Click ok. and close the adapter properties tab. Might not be necessary for everyone but it helped me because my remote PC intermittently kept showing up as having no ipv6 on test-ipv6.com

2) Login to the Airtel Router, Go to security, firewall and set default action for interface br0 for IPv6 direction In to "Permit". This probably will be different depending on your location and Airtel provided router, and I'm not sure how unsafe this is from a security standpoint to set it to Permit everything received on this interface by default, but without it I don't get an IPv6 address at all.

3) Go to the rules tab in the Firewall and select Packet direction ppp111InIPv6, click on add and add a rule to permit tcp packets on port 3389. This will also vary by router and probably can be made more secure by specifying source and destination address to limit vulnerability. "Select a service" dropdown has a bunch of different pre-configured options to select ports to whitelist, other ports can be whitelisted by selecting custom service, selecting protocol as "TCP or UDP" if you're unsure which protocol your service uses and entering in "Destination Port" textbox the port used by the service on the remote PC (can also be made more secure by specifying specific source and destination port)

After this I copied my remote PC's IPv6 address from test-ipv6.com and was able to use it to remote into it from my laptop.

YeAhx said:

So I was going to email them but decided to raise a complaint from their app instead. First I had to convince the chat bot I needed a human, Then I had to convince the human I needed a human with tech understanding as he couldn't figure out that ipv6 can be enabled even if its locked in router, just needs to be enabled by a technician from their side, he said if I can't enable it then he can't as well lol. Told him to get me technician so he raised a proper complaint with technician and the technician called me in 10 mins. I thought my problem would end here and the technician will understand but nope, had to convince him as well that it's locked/greyed out because he kept saying sir it should be auto-enabled, we don't disable it etc. In the end he came and enabled it by calling someone (customer support) from his side.

It seems like even now the customer support agents have no clue how to deal with unusual requests or they intentionally try to act dumb to reduce the amount of complaints raised from their end. Also Airtel either don't trust on-site technicians with these kind of work (a locked router which needs a call to their department IT guy or whatever to change settings seriously?) or they feel like dividing such work can speed up their process. Not sure which is true but don't care since I got what I wanted.

In the end I may have exaggerated some things because they did managed to fix my issue in 1-1.5 hours which from Indian standards is quite fast.

Click to expand...

If you email them they'll directly assign a technician, no need to go through customer support. I emailed at around 11 AM and got a call from technician by 2 PM. Granted the technician didn't know what ipv6 was and told me to buy a static IP instead, but at least the turnaround time is good enough

YeAhx said:

I assumed I would have had to wait for their reply as communication over email is usually slower than their App. Of couse emails (or any solid proof of communication) is best when dealing with anything not F2F.

Click to expand...

When you email them they won't respond over email, instead they'll lodge a complaint in the Airtel app that requires a technician to call you. I tried lodging a complaint through the app but the bot is very limited. Once the complaint is lodged in the app they'll contact you themselves