Airtel Fiber Port forwarding over IPv6

M

mayank0623

Forerunner
I have the basic Airtel Fiber 499 plan in Pune. I wanted to forward port 3389 but my IPv4 address is behind CGNAT, and I thought since the IPv6 address is public that would be possible, but it's not reachable from outside the home network. I emailed Airtel support, and the technician called me and told me port forwarding is not possible without buying a static IP, but with a public IPv6 address that should not be the case. Has anyone successfully forwarded ports on their default airtel ont without getting a static IP? I don't want to pay an additional 200-300 per month for that, so I'm temporarily using Tailscale but I want faster speeds.
 
mayank0623 said:
I have the basic Airtel Fiber 499 plan in Pune. I wanted to forward port 3389 but my IPv4 address is behind CGNAT, and I thought since the IPv6 address is public that would be possible, but it's not reachable from outside the home network. I emailed Airtel support, and the technician called me and told me port forwarding is not possible without buying a static IP, but with a public IPv6 address that should not be the case. Has anyone successfully forwarded ports on their default airtel ont without getting a static IP? I don't want to pay an additional 200-300 per month for that, so I'm temporarily using Tailscale but I want faster speeds.
Click to expand...
you can forward ipv4 on airtel without static ip with the exception of 80, 443.
these 2 ports are available only on static ip plans

ipv6 without a proper firewall doesnt need port forwarding - you can access your client devices directly from the WAN side without any further setup since consumer grade routers dont have a ipv6 firewall to begin with
 
jayanttyagi said:
Just allow inbound connections in firewall? No need to port forward if router gets assigned ipv6.
Click to expand...
I've turned off both router and windows firewalls but still have pings from outside timing out
superczar said:
you can forward ipv4 on airtel without static ip with the exception of 80, 443.
these 2 ports are available only on static ip plans

ipv6 without a proper firewall doesnt need port forwarding - you can access your client devices directly from the WAN side without any further setup since consumer grade routers dont have a ipv6 firewall to begin with
Click to expand...
The IPv4 address in my router's dashboard and the IP address from https://whatismyipaddress.com/ are different, and I've tried port forwarding in the past and it worked but I'm no longer getting dynamic public ipv4
 
mayank0623 said:
The IPv4 address in my router's dashboard and the IP address from https://whatismyipaddress.com/ are different
Click to expand...
Based on this, I think your connection is NATted. You can’t do it without static IP or them opening up specific ports and forwarding traffic to your router. Your best bet is CloudFlare tunnels / Tailscale as you mentioned in your case.

I’ve tried with my ISP previously but none of my solutions worked, finally purchased static IP and used my own router.
 
DBot said:
Based on this, I think your connection is NATted. You can’t do it without static IP or them opening up specific ports and forwarding traffic to your router. Your best bet is CloudFlare tunnels / Tailscale as you mentioned in your case.

I’ve tried with my ISP previously but none of my solutions worked, finally purchased static IP and used my own router.
Click to expand...
That's why I wanted to get IPv6 working, but it looks like it's behind some kind of NAT too, which is just stupid. I haven't looked into cloudflare tunnels yet, are their speeds faster than tailscale?
 
mayank0623 said:
That's why I wanted to get IPv6 working, but it looks like it's behind some kind of NAT too, which is just stupid. I haven't looked into cloudflare tunnels yet, are their speeds faster than tailscale?
Click to expand...
ipv6 on airtel does not use NAT - but may vary depending on location.
Jus check if your client devices are getting an ipv6 address and post it here (the starting numbers)
typically fe80 is link local only while public ipv6 (on airtel) starts with 2401:
 
superczar said:
ipv6 on airtel does not use NAT - but may vary depending on location.
Jus check if your client devices are getting an ipv6 address and post it here (the starting numbers)
typically fe80 is link local only while public ipv6 (on airtel) starts with 2401:
Click to expand...
I'm definitely getting a public IPv6 as far as I can tell
From test-ipv6.com
1000017632.png

From ipconfig /all
1000017630.png
 

Attachments

  • 1000017631.png
    1000017631.png
    68.4 KB · Views: 16
I've resolved the issue if anyone else is trying to achieve this but have no idea how insecure my network has become in the process, so follow this at your own risk. I did 3 things
1) Changed DNS to Google DNS
On the remote PC (PC you want to connect to) open start and type ncpa.cpl to open the Network Connections window, choose your adapter (ethernet in my case) and right click and open properties, scroll down to Internet Protocol version 6 and select it and click properties, then click "Use the following DNS server addresses" and enter google's dns server addresses. Click ok. and close the adapter properties tab. Might not be necessary for everyone but it helped me because my remote PC intermittently kept showing up as having no ipv6 on test-ipv6.com
1743235882779.png


2) Login to the Airtel Router, Go to security, firewall and set default action for interface br0 for IPv6 direction In to "Permit". This probably will be different depending on your location and Airtel provided router, and I'm not sure how unsafe this is from a security standpoint to set it to Permit everything received on this interface by default, but without it I don't get an IPv6 address at all.
1743236225691.png


3) Go to the rules tab in the Firewall and select Packet direction ppp111InIPv6, click on add and add a rule to permit tcp packets on port 3389. This will also vary by router and probably can be made more secure by specifying source and destination address to limit vulnerability. "Select a service" dropdown has a bunch of different pre-configured options to select ports to whitelist, other ports can be whitelisted by selecting custom service, selecting protocol as "TCP or UDP" if you're unsure which protocol your service uses and entering in "Destination Port" textbox the port used by the service on the remote PC (can also be made more secure by specifying specific source and destination port)
1743236525744.png


After this I copied my remote PC's IPv6 address from test-ipv6.com and was able to use it to remote into it from my laptop.
 
I'm kinda in the same spot here. These greedy basterds want 200 INR per month extra for a static IP. For my use case IPv6 might work but it seems like IPv6 on my router side is disabled and the setting is greyed out as well (locked). How do I go with enabling it? Do I contact Airtel for this or can I do it myself?
 
YeAhx said:
I'm kinda in the same spot here. These greedy basterds want 200 INR per month extra for a static IP. For my use case IPv6 might work but it seems like IPv6 on my router side is disabled and the setting is greyed out as well (locked). How do I go with enabling it? Do I contact Airtel for this or can I do it myself?
Click to expand...
Yes email net@airtel.com and ask them to enable ipv6
 
  • Like
Reactions: YeAhx
Top Bottom