Introduction
A story of woe, a Belkin wireless router and IPv6.
Brief History
I was looking to replace my able but rather old 3com access point. The 3com was an enterprise grade access point (bought when I had more money than sense) and had served very well, but was just too old to support the modern N standard.
So I looked at web reviews, and made my selection. The Belkin Double N+ wireless router (F6D6230-4 v1000) received some mixed reviews, but claims had been made that this was a good performer. It is a high-end consumer level product, Belkin’s flagship but also one of few to support the 5 Ghz N band, which I particularly wanted. As it is a consumer product, you don’t get VLANs, RADIUS mac authentication etc. But it does support multiple SSIDs. I can live without the VLANs and RADIUS.
On checking the manual on line, I was also pleased to see that it supported an “Access Point” mode, where by all the routing functions are disabled, and it acts purely as an access point. This suited me exactly, as I have never been too happy with the router/access point model. If you change your internet connection (cable – adsl) then you have to replace a more expensive box than if you have a dedicated piece of kit for both. Also if your router is compromised, then the cracker has access, both to your LAN and to your internet connection. Far better for security to have separate devices on very different parts of network.
IPv6, the way forward…?
A couple of months before, I had configured my network to work with IPv6. The way the internet will work in the future. I am using Hurricane Electric’s tunnel broker service (http://tunnelbroker.net/) which is generally excellent. The only problem I have with it is that they don’t protect your account password with https. It was all working very well. (debian systems actually default to IPv6 in preference, if it is available).
IPv6 Broken 
However, shortly after installing by Belkin Double N+ router, although it took me a month or two to realise the connection, the IPv6 has been intermittent, or downright broken.
The reason I did not suspect the Belkin router, was that no where in it documentation, nor any review that I had read did it mention anything about IPv6.
Noone supports IPv6
To me, this lack of IPv6 is a bizarre state of affairs. IPv6 is an established standard, Microsoft, Apple, unix/linux, cisco, juniper and HP have all supported IPv6 for ages, yet in the UK, no major ISP (that I know of) natively supports IPv6, and it is almost impossible to buy a router or an access point which supports IPv6. IPv6 is great for the consumer too. You truly could give every electrical item in you house a unique internet routable address and have billions of billions of addresses free in your allocated subnet. In addition, it is very easy to set up an ad-hoc network with IPv6. You don’t need any DHCP or similar as all IPv6 routers can provide clients with addresses.
Investigation
I do not profess to be an IPv6 expert, so the following may not be totally accurate.
IPv6: Billions and billions of addresses
A quick summary on the format of IPv6 addresses and how to write them:
IPv6 has 128 bits which represent the IP address. These are written as 8 16 bit hexadecimal numbers separated with colons:
2001:0db8:0001:AC10:0000:0000:0000:0001
However, as this is long winded, and 0 is common in IPv6 addresses, the example above can be written with a short hand:
2001:db8:1:AC10::1
Here, leading zeros are omitted, and the sequential run of 3 0000s can be replaces with a double colon. You can only have one double colon in an address though. Interestingly, though not really relevant to this discussion if you need to specify a port on an IPv6 host, you use square brackets around the IP address. This prevents the colon to specify the port being interpreted as part of the address:
[2001:db8:1:AC10::1]:80
Wikipedia has a useful article on IPv6.
What no DHCP?
IPv6, on your LAN works very differently from IPv4. Especially how they learn about the local network configuration. A DHCP client uses a broadcast packet to locate a DHCP server. The server then responds with information on what IP address, what name server, default route etc. IPv6 doesn’t work like this. Instead of broadcasts, IPv6 uses multicasts to do this. As well as responding to multi cast packets, the client generates itself a unique “local” address within a particular range of the form fe80::/64 This address is generated from the MAC address of the host, but is only visible within the LAN. (there are mechanisms to check that this is a unique address, before it uses it)
eg:
mac address: 00:22:75:34:e2:77
link address: fe80::222:75ff:fe34:e277
The strong numbers are taken directly from the MAC address.
These addresses will ping, but they will not route. On an automatically configured IPv6 network, the route is advertised as one of these addresses.
This is not a tutorial on how to configure an IPv6 LAN. There are several available: Here is a good one for debian.
What went wrong
When my network doesn’t have the Belkin router connected:
On a typical IPv6 client:
# ifconfig eth0 eth0 Link encap:Ethernet HWaddr 00:16:3e:a0:38:67 inet addr:172.30.0.67 Bcast:172.30.0.255 Mask:255.255.255.0 inet6 addr: 2001:XXXX:XXXX:XXXX:216:3eff:fea0:3867/64 Scope:Global inet6 addr: fe80::216:3eff:fea0:3867/64 Scope:Link UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:317 errors:0 dropped:0 overruns:0 frame:0 TX packets:135 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:28381 (27.7 KiB) TX bytes:22706 (22.1 KiB)
and
# route -6 Kernel IPv6 routing table Destination Next Hop Flag Met Ref Use If 2001:XXXX:XXXX:XXXX::43/128 :: U 256 0 0 eth0 2001:XXXX:XXXX:XXXX::/64 :: UAe 256 0 1 eth0 fe80::/64 :: U 256 0 0 eth0 ::/0 fe80::216:3eff:fe19:4d15 UGDAe 1024 0 1 eth0 ::/0 :: !n -1 1 34700 lo ::1/128 :: Un 0 1 269 lo 2001:XXXX:XXXX:XXXX::43/128 :: Un 0 1 0 lo fe80::216:3eff:fea0:3867/128 :: Un 0 1 3 lo ff00::/8 :: U 256 0 0 eth0 ::/0 :: !n -1 1 34700 lo
The ::/0 is the default route (except where a ! appears in the flags). And finally:
# ping6 -c 4 ipv6.google.com PING ipv6.google.com(2a00:1450:8002::67) 56 data bytes 64 bytes from 2a00:1450:8002::67: icmp_seq=1 ttl=56 time=44.0 ms 64 bytes from 2a00:1450:8002::67: icmp_seq=2 ttl=56 time=36.0 ms 64 bytes from 2a00:1450:8002::67: icmp_seq=3 ttl=56 time=36.0 ms 64 bytes from 2a00:1450:8002::67: icmp_seq=4 ttl=56 time=32.0 ms ^C --- ipv6.google.com ping statistics --- 4 packets transmitted, 4 received, 0% packet loss, time 3012ms rtt min/avg/max/mdev = 32.000/37.000/44.000/4.358 ms
Everything working as it should.
When I add the access point: (The following have been abridged)
# ifconfig eth0 Link encap:Ethernet HWaddr 00:16:3e:a0:38:67 inet addr:172.30.0.67 Bcast:172.30.0.255 Mask:255.255.255.0 inet6 addr: 2001:db8:1:0:216:3eff:fea0:3867/64 Scope:Global inet6 addr: 2001:XXXX:XXXX:XXXX:216:3eff:fea0:3867/64 Scope:Global inet6 addr: fe80::216:3eff:fea0:3867/64 Scope:Link ...
The interface now has an additional address (shown in strong), and it also has an additional route:
# route -6 ... ::/0 fe80::216:3eff:fe19:4d15 UGDAe 1024 0 13 eth0 ::/0 fe80::222:75ff:fe34:e277 UGDAe 1024 0 0 eth0 ...
The new route is shown in strong. That IPv6 address is a Link scope address which matches the MAC address of my Belkin router. So how is the ping looking now?
# ping6 -c 4 ipv6.google.com PING ipv6.google.com(2a00:1450:8002::63) 56 data bytes From fe80::222:75ff:fe34:e277 icmp_seq=1 Destination unreachable: No route From fe80::222:75ff:fe34:e277 icmp_seq=2 Destination unreachable: No route From fe80::222:75ff:fe34:e277 icmp_seq=3 Destination unreachable: No route From fe80::222:75ff:fe34:e277 icmp_seq=4 Destination unreachable: No route --- ipv6.google.com ping statistics --- 4 packets transmitted, 0 received, +4 errors, 100% packet loss, time 3004ms
Not so good. So for a device that “doesn’t support” IPv6, my belkin router is having a big effect on my IPv6 configuration. Finally, if it responds to an IPv6 ping, I can be pretty sure that it is talking IPv6:
# ping6 -c 4 -I eth0 fe80::222:75ff:fe34:e277 PING fe80::222:75ff:fe34:e277(fe80::222:75ff:fe34:e277) from fe80::216:3eff:fea0:3867 eth0: 56 data bytes 64 bytes from fe80::222:75ff:fe34:e277: icmp_seq=1 ttl=64 time=0.000 ms 64 bytes from fe80::222:75ff:fe34:e277: icmp_seq=2 ttl=64 time=0.000 ms 64 bytes from fe80::222:75ff:fe34:e277: icmp_seq=3 ttl=64 time=0.000 ms 64 bytes from fe80::222:75ff:fe34:e277: icmp_seq=4 ttl=64 time=0.000 ms --- fe80::222:75ff:fe34:e277 ping statistics --- 4 packets transmitted, 4 received, 0% packet loss, time 3000ms rtt min/avg/max/mdev = 0.000/0.000/0.000/0.000 ms
Yes. It seems it does. But hold on, what is this address that the router has given me?
# whois 2001:db8:1:0:216:3eff:fea0:3867/64 % [whois.apnic.net node-4] % Whois data copyright terms http://www.apnic.net/db/dbcopyright.html %WARNING:905: fixed lookup key % % The key "2001:DB8:1:0:216:3EFF:FEA0:3867/64" has been changed to "2001:db8:1::/64" for lookup. inet6num: 2001:0DB8::/32 netname: IPV6-DOC-AP descr: IPv6 prefix for documentation purpose country: AP admin-c: HM20-AP tech-c: HM20-AP status: ALLOCATED PORTABLE remarks: This address range is to be used for documentation remarks: purpose only. For more information please see remarks: http://www.apnic.net/info/faq/ipv6-documentation-prefix-faq.html ...
It seems that the Belkin has given me an IPv6 address in a range that should only ever be used as an example in documentation. And if we look at that URL:
… it has been decided to set aside a range of addresses that operators will know should never be routed to the public Internet. The documentation prefix is the IPv6 address range that has been set aside for this purpose.
The 2001:0db8::/32 range should never be allocated to a client! It will never route properly.
Proof!
radvdump is a program that queries IPv6 routers and prints out their configuration. This is the output of radvdump when run on my LAN. You can see the Belkin router’s Link scope IPv6 address in the comments at the beginning, and the bogus 2001:db8::/32 subnet in the prefix section below.
# radvdump -e
#
# radvd configuration generated by radvdump 1.1
# based on Router Advertisement from fe80::222:75ff:fe34:e277
# received by interface eth0
#
interface eth0
{
AdvSendAdvert on;
# Note: {Min,Max}RtrAdvInterval cannot be obtained with radvdump
AdvOtherConfigFlag on;
AdvDefaultPreference low;
prefix 2001:db8:1::/64
{
}; # End of prefix definition
}; # End of interface definition
Unfortunately in the “shout loudest” stakes, the Belkin router wins over my proper IPv6 router. For every response from my legitimate IPv6 router, the Belkin sent five. The real router seems to send them less frequently the longer it has run too, where as the Belkin sends about one every two seconds.
Conclusion
Therefore, if you are using, or are ever planning to use IPv6 on your LAN, I strongly recommend that you do not buy a Belkin Double N+ router. At best, it will interfere with your IPv6 configuration, at worst, it will totally break it. Belkin do not understand IPv6, and have created a product (possibly a range or products) that will never be useful on an IPv6 network. As it is part of the core network of a LAN, it is impossible to work round it with firewalls or similar.
The specifications of the device makes no mention IPv6 at all, so it should not. Worse, as I personally am using it as an Access point, it should be a pure layer 2 device and not be sending or receiving any layer 3 traffic at all, except for management. There is no work round, no way of disabling this broken IPv6 functionallity.
Belkin’s support
After a few days of exchanging messages with Belkin’s technical support and a few “It doesn’t support IPv6″ denials, I did get a confirmation that there is some IPv6 functionality in the router:
The router does not support IPv6 for WAN connections. However, it does support IPv6 for internal LAN connectivity. There is no option to block this protocol for LAN connectivity.
So that confirms that there is no way to disable this broken implementation. Looks like I shall be getting myself a new access point.
April 26, 2011 at 9:18 am |
thanks for sharing. i have bookmarked for future referrence !
December 23, 2011 at 12:51 am |
thank you…
[...]Belkin Double N+ Wireless Router Review (and IPv6) « Taskme's Blog[...]…
January 24, 2012 at 4:23 am |
Maybe this is why I can’t ping a local host using ipv6 even with the firewalls disabled and ipv6 enabled. I think it is preventing me from setting up a Windows 7 homegroup. I’m going to try that radvdump from my Backtrack VM and see what it can tell me. Thank you.