Telenet's firewall at your home

Default Firewall

• To allow your internal network to reach the outside IPv4- or IPv6 Internet.
• To protect your internal network(s) against access from the outside IPv4- or IPv6 Internet.

Rumors

1. Ports 0-1024 are blocked one cannot e.g. setup a ssh server at home, unless one connects it to e.g. port 2022.
   (both for IPv4 and IPv6 )
2. IPv6 has its own set of ICMP messages. Telenet blocks most of these except those necessary for the correct operation of your computers. E.g. "host unreachable , ...)
   
   
3. The ICMP6 messages which are not blocked are "rate limited" to avoid denial attacks.

Changing IPv4 firewall

Changing IPv6 Firewall

1. Most implementation on IPv6 on desktiops and laptops use "Privacy extensions". These computers will use more or less random addresses when connecting to the outside world.
   To allow these computers one has to specify an address range (CIDR range) in a firewall rule source address.
2. Even when using "privacy extensions" each computer has one global Ipv6 address, This address should be used in the target address of the firewall rule.

• The information in this URL  treats the IPv4 addresses  and the IPv6 addresses as similar. They are not:; a computer, e.g. with IPv6 privacy extensions uses several IPv6 addresses.
  In the firewall rules it is important to select the correct address (or address range) and this address is probably not shown by the Telenet Web site
•  Moreover there is no syntax description for some fields required by the IPv6 firewall ( e.g. "CIDR prefix", "Poort of range", ...)
  

1. Source can be host / Cidr /Any:
   for Cidr is accepts network ranges e.g. 2a02:2c40:0:a007::/64   (this is a subrange range of Computerwtenschappen)
   You need CIDR to accept connections from a computer with privacy extensions.
   
2. Poort  of range:
   Even when 1. is ANY you need to specify a port or range.
   By some experimenting I did find out that e.g. 2000:2256 is an accepted syntax for a range
3. When you click "firewall rule toevoegen"  some syntax? checking seems to be done. Invallid or missing field are marked in red.
4. When the Firewall rule is syntactically? accepted you still need to store the changes (indicated with a green tekst) by clicking "wijzigingen opslaan". (see below)
   

Tests (20140314)

1. "Error"
2. "wijziging tijdelijk niet mogelijk" After a few hours this did change into "error"
3. A pop up "server error" window from my browser (Iceweasel/debian or Firefox/ubuntu.)

• the source port range should be larger e.g.  1025:64000
  but this did result in "error"   Why ???
• the target port should probably be >1024
  But I did want to try if lower IPv6 ports are allowed.
  The instability of the webinterface did prevent this....
  

Tests (20140317)

1. The source address is for all hosts at 2a02:2c40:0:a007::/64  (network with dellzebub and friends).
2. The port range 1025:65000 is used to allow all ports set up by users processes (1025:65535 would be better).
3. The destination address is the global dynamic adress of my home ssh server. Found under Linux with :
   

   hastierre:~$ ip address show
   1: lo: <LOOPBACK,UP,LOWER_UP> mtu 16436 qdisc noqueue state UNKNOWN 
       link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
       inet 127.0.0.1/8 scope host lo
       inet6 ::1/128 scope host 
          valid_lft forever preferred_lft forever
   ...
   4: ...0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
       link/ether 00:14:c1:22:50:96 brd ff:ff:ff:ff:ff:ff
       inet 192.168.0.163/24 brd 192.168.0.255 scope global wlan0
       inet6 2a02:1810:b80b:4100:51ad:2483:6a14:ea88/64 scope global temporary dynamic 
          valid_lft 566766sec preferred_lft 48366sec
       inet6 2a02:1810:b80b:4100:214:c1ff:fe22:5096/64 scope global dynamic 
          valid_lft 566766sec preferred_lft 48366sec
       inet6 fe80::214:c1ff:fe22:5096/64 scope link 
          valid_lft forever preferred_lft forever
   
   

4. The target port range includes two ports on which the ssh server listens 20 and 2022.
   This is used for a test which shows that lower ports (0-1024?) are allways blocked. (same for IPv4)