Airport Extreme and Cox Internet IPv6 Problem

starhopper, yes, enable "Block Incoming IPv6 Connections." That turns on the IPv6 stateful firewall.

Since IPv6 no longer uses NAT, it uses a stateful firewall to block unauthorized requests from the WAN (Internet) side. It also keeps track of requests from your LAN (computers/devices) so when an answer comes back from the Internet (WAN) it knows which computer/device to direct the answer back to.

OK - I have no idea what that means😕, but I will take your advice and enable it.

When I enabled "Block Incoming IPv6 connections", I now get a "Allow incoming IPsec authentication" button that is enabled. Should I leave it enabled?

Yes, "Allow incoming IPsec authentication" should also remain enabled.

starhopper - are you running all 3 browsers on one machine? one thing I've noticed is that firewall settings can affect the test results. If you have Mac OS X firewall On, and in Stealth mode, Stealth mode prevents one of the IPv6 messages from getting through, and will lower the score.

That's good information to share sunjon.

Stealth mode prevented a reply from ICMP ECHO_REQUESTs. People used stealth mode to try to hide their computers/networks on the Internet. It was considered security by obscurity but in truth it wasn't very effect and caused more problems then it solved.

For IPv6 to work properly it requires ICMPv6 ECHO_REQUESTs to receive a reply. So devices/computers that have a stealth mode option, it should be disable if you want IPv6 to work properly.

No, I generally only use "EDGE", but thought I'd try both "CHROME" and "FIREFOX" to see if I got different results. I'm using a Windows 10 machine.

After installing the firmware update last week I decided to return the Airport Extreme factory default settings with iPv6 today. Was running the Google settings listed previously. I ran the test below before and after (the screen shot is after). My initial score was 4/20. After resetting my score is what you see below; 19/20.

We will see if the system stays up and running for any length of time with the firmware upgrade and factory defaults.

Bingo! ipv6 down again after ~13 hours.

ping6 -c 10 ipv6.google.com

PING6(56=40+8+8 bytes) 2600:8802:4100:d9:954b:1cd6:4db:9ff6 --> 2607:f8b0:4000:803::200e

--- ipv6.l.google.com ping6 statistics ---

10 packets transmitted, 0 packets received, 100.0% packet loss

traceroute6 ipv6.google.com

traceroute6 to ipv6.l.google.com (2607:f8b0:4000:803::200e) from 2600:8802:4100:d9:954b:1cd6:4db:9ff6, 64 hops max, 12 byte packets

1 2600:8802:4100:d9:8a1f:a1ff:fe2a:5d51 0.527 ms 0.855 ms 1.364 ms

2 * * *

3 * * *

4 * * *

5 * * *

6 * * *

7 * * *

8 * * *

9 * * *

10 * * *

11 * * *

12 * * *

13 * * *

14 * * *

15 * * *

16 * * *

17 * * *

18 * * *

19 * * *

20 * * *

(still running)

Test with IPv4 DNS record

ok (0.068s) using ipv4

Test with IPv6 DNS record

timeout (15.008s)

Test with Dual Stack DNS record

timeout (15.008s)

Test for Dual Stack DNS and large packet

timeout (15.008s)

Test IPv4 without DNS

ok (0.063s) using ipv4

Test IPv6 without DNS

timeout (15.010s)

Test IPv6 large packet

timeout (15.006s)

Test if your ISP's DNS server uses IPv6

timeout (15.012s)

Find IPv4 Service Provider

ok (0.247s) using ipv4 ASN 22773

Find IPv6 Service Provider

timeout (15.021s)

Test for buggy DNS

undefined (5.005s)

If this posts, ipv4 is working as a fallback...

OCRamon - Thanks for posting w/time window, and the more accurate the time window of failure, the better. ~13 hours is awfully close to 12 hours, which is when your IPv6 lease will renew (we have 24-hr leases and DHCPv6 clients renew every 1/2 lease lifetime). Incidentally, lease renewal was the primary failure condition we found and worked with Apple to fix. So I don't THINK that is the problem but who knows.

Couple things if you don't mind:

1. Post your cable modem MAC address, don't worry it's not a private piece of info, in fact its a L2 address so it's only reachable by you and our next-hop network equipment (CMTS in this case).

2. Post the IPv6 address of your Airport from when its working and then once it fails. As Gino stated, assuming you have "Block incoming IPv6 connections" enabled, this is also not exposing you to anything malicious.

askin6305B wrote:

OCRamon - Thanks for posting w/time window, and the more accurate the time window of failure, the better. ~13 hours is awfully close to 12 hours, which is when your IPv6 lease will renew (we have 24-hr leases and DHCPv6 clients renew every 1/2 lease lifetime). Incidentally, lease renewal was the primary failure condition we found and worked with Apple to fix. So I don't THINK that is the problem but who knows.

Couple things if you don't mind:

1. Post your cable modem MAC address, don't worry it's not a private piece of info, in fact its a L2 address so it's only reachable by you and our next-hop network equipment (CMTS in this case).

2. Post the IPv6 address of your Airport from when its working and then once it fails. As Gino stated, assuming you have "Block incoming IPv6 connections" enabled, this is also not exposing you to anything malicious.

askin6305B, you'll want the IPv6 WAN address from his AirPort router is that correct?

NOTE: the image below does not show OCRamón's IPv6 address so don't use that one.

So that is a complete failure. traceroute6 doesn't even get past the first hop.

Hopefully this is a little more info that Cox engineering can use to help figure out what is going on.

SB6182 has MAC address 84 61 A0 7D 3C AF. I assume that's the one you want. It also reports a "learned" MAC address.

Let me know if this is safe to transmit.

ipv6 WAN address (when it's working) is 2600:8802:7f80:100:a497:6f81:2e6f:3631. No idea why Apple goes with lower case hex digits! I do have incoming connections blocked.

I'll have to wait for another failure to check the WAN address when the AEBS has failed.

Tom380 wrote:

Since 8 pm PDT last night have intermittently lost the IPv6 connection. Location is Orange County CA. IPv4 connection continues to work with normal internet speeds. Re-setting the cable modem temporarily restores the IPv6 connection, however, it is lost within minutes. Problem continues this morning.

Tom what's your cable modem MAC address?

Cable Modem Mac address: D4:0A:A9:00:3F:51 The modem is an Arris SB6190.

Let me add recent observations for your use. I am located in Orange County, CA. Last night about 8pm PDT I lost IPv6 connectivity, however, I did maintain IPv4 connectivity, download/upload speeds were not affected. This morning about 8am PDT, I still had IPv4 connectivity, however, speeds were approximately half of normal value. Around 1pm PDT today IPv6 connectivity was re-esablished and has continued. I did not have to re-set the modem or the Airport Extreme. However, download/upload speed continues to be about half normal value.

Since I upgraded the Airport Extreme to the new firmware, the modem and Airport do not need to be re-set to regain internet access when IPv6 connectivity is lost. It appears it defaults to IPv4 with no action on my part. Likewise, when IPv6 is regained, the modem and airport automatically re-establish the connection with no action on my part. The firmware update appears to have corrected the problem where I had to re-set the modem or Airport manually, which I had been experiencing since April.

Hope this is useful information.