Q: Airport Extreme and Cox Internet IPv6 Problem

I_Dont_Want_A_Username, ICMPv6 filtering can be caused by a setting on the Netgear router or a setting in the personal firewall on the computer.

I post earlier how to disable "Stealth mode" on the Mac Firewall so you might want to check that setting and make sure it is turned off (unchecked.) If the setting on the Mac is unchecked the it is probably on the Netgear router.

The NAT filtering setting (which should only affect IPv4) on the Netgear router shouldn't cause ICMPv6 failure but you can try setting it to "Open" to make sure. Of course, I highly recommend having an active firewall so, reset it to "Secured" after the test. Again, if the Mac is set correctly, there is probably a setting on the router that enables "Stealth mode" although they may call it something different.

I found this in the Netgear community forums, it may help.

https://community.netgear.com/t5/General-WiFi-Routers/How-to-enable-ping-on-WAN- and-where-is-the-firewall/td-p/391235

Hi Gino, Personal firewall on Mac was/is off - no stealth mode.  Netgear Router was configured with:

a.  Disable port scan and DDOS protection (default Unchecked, meaning Port Scan and DDOS protection are ON by default)

b.  Respond to ping on Internet port (default Unchecked)

c.  NAT Filtering (default Secured, other option is Open)

Got 17/20 with these three settings in default mode.  Ran tests with a. changed to checked, so Port Scan and DDOS were off.  Still 17/20.

Next test was a. off and b checked, so Internet Port ping was also enabled.  Still 17/20.

Next test was a. off, b. checked, and c. Open, so NAT filtering was set off.  Still 17/20, showing ICMP being filtered.

Next test was returning back to these three settings in default mode.  Still 17/20, showing ICMP being filtered.

It appears the Netgear is doing some ICMP filtering  regardless, but since we don't know what the ipv6-test is actually testing, it would be shooting in the dark to play with port forwarding content rules, etc, to make it pass the test.  Perhaps this is something Cox will need to work with customers and/or Netgear on if it creates issues in the future.  Extra credit reading: https://community.netgear.com/t5/Nighthawk-WiFi-Routers/IPv6-ICMP-Filtered/m-p/1 088538#U1088538

I_Dont_Want_A_Username, I would have thought that a or b (or both) would have fixed it.

a.  Disable port scan and DDOS protection (default Unchecked, meaning Port Scan and DDOS protection are ON by default)

b.  Respond to ping on Internet port (default Unchecked)

It seems from reading that post in the Netgear community forums that Netgear has decided to filter ICMPv6 ECHO_REQUESTS  regardless of what the IPv6 standard says about it. So there is noting you can do other than wait for Netgear to change their mind and issue a firmware update that does not filter ICMPv6 or you exchange the router for one that sticks to the standard.

To answer your question, "It appears the Netgear is doing some ICMP filtering  regardless, but since we don't know what the ipv6-test is actually testing, it would be shooting in the dark to play with port forwarding content rules, etc, to make it pass the test."

Here is a wikipedia article. https://en.wikipedia.org/wiki/Internet_Control_Message_Protocol_version_6

CromeYellow wrote:

 

Mine was the first post in response to askin6305B

 

 

askin6305B

 

what say ye?

 

I wish I had a silver bullet for you.  I did see your original reply and because your network is a bit more complex than most, and your issues (iMacs quit, iOS keeps working) is so unusual I did not weigh in.  Was trying to get a gauge from some users with simpler networks and more "common" problems - not that yours isn't equally frustrating.  What's your CM MAC address?

MacProblemsInSoCal wrote:

 

I have this version of the AEBS and as of today I have still been experiencing issues for the past two weeks.  I upgraded to 7.6.7 on June 3rd, but it has been no help.  I've been following this thread the past two days hoping that someone else might still be experiencing the same issues even after the updates and might have a solution. What I have been doing is when the connection goes out, I alternate between local-link only or native in the internet options and it resumes working for a few hours. I'm in Orange County as well.  Today was the longest it worked without an interruption going pretty much the whole day, but about an hour ago my connection became really slow while on native.  I've done that test when my settings are on native and I've received 19/20.

Sounds like several issues in Orange County specifically.  What's your CM MAC address?  It is not impossible that there's an IPv6 routing issue there.

A4:7A:A4:6E:76:18

I've now had 3 ipv6 failures today, by far the most since I turned it on Friday.  They appear to be at  random times. 

Yes, there is a problem in Orange County.  I've gone back to "link-local" mode until Cox comes up with a solution or more diagnostics to try.  I suggest you find one that does continuous testing and logging if you need to pin the timing down.

Thanks, I agree I don't see a solution for me at this time, and anyway, link local works for me fine right now.  Plus when it goes down for me, I have no web browsing capability at all on my iMacs - no ipv4, no ipv6, nothing.

Here is my cable modem MAC address, posted image here:

http://i67.tinypic.com/173lag.jpg

Please view it because in 24 hours I will delete the image that is hosted.  Go to the above URL you will see the image.

i also reverted to link-local, tired of all the experimenting only to have it fail, once I read on this forum that a solution has been found and everything is working as it should and does for other cable providers I will then try the ipv6 again, unfortunately I am in contract with Cox.

OCRamón wrote:

 

I've now had 3 ipv6 failures today, by far the most since I turned it on Friday.  They appear to be at  random times.

Yes, there is a problem in Orange County.  I've gone back to "link-local" mode until Cox comes up with a solution or more diagnostics to try.  I suggest you find one that does continuous testing and logging if you need to pin the timing down.

OCRamon - how are you able to tell that you've had 3 IPv6 failures?  I'm asking not because I doubt it but because the Airport's fallback to IPv4 has been improved, such that it should be transparent to you unless you check an IPv6 test web site.

CromeYellow wrote:

 

Thanks, I agree I don't see a solution for me at this time, and anyway, link local works for me fine right now.  Plus when it goes down for me, I have no web browsing capability at all on my iMacs - no ipv4, no ipv6, nothing.

 

Here is my cable modem MAC address, posted image here:

 

http://i67.tinypic.com/173lag.jpg

 

Please view it because in 24 hours I will delete the image that is hosted.  Go to the above URL you will see the image.

Got it, thanks.

Is it failing just the IPv6 test or is the AirPort back to disconnecting and requiring a restart?

I'm out in San Diego and noticed that after about 12:30am mine passed the IPv6 test 10/10 after it had been failing most of the day. Then after I wake up this morning ~7:30am, it has gone back to failing the IPv6 test 0/10. AirPort hasn't disconnected (needing a restart) since the 7.7.7 update so I'm just going to leave it. Something is screwy with COX's implementation of IPv6 so hopefully they figure out what's going on.

Don't mean to hijack some ones else thread, but the fall back has not been transparent to me, when ipv6 fails I have to restart my modem

TThe fallback isn't perfect. Cox's mail server and Apple mail stop talking and some web sites refuse to update. And I can verify it with test-IPv6.

YatBob wrote:

 

i also reverted to link-local, tired of all the experimenting only to have it fail, once I read on this forum that a solution has been found and everything is working as it should and does for other cable providers I will then try the ipv6 again, unfortunately I am in contract with Cox.

YatBob - going back through this thread I see that you'd initially reported better stability with the recent Airport image, for several days in a row.  I'm trying to understand whether it's still working but just failing the v6 test web sites, or whether it takes down your general internet access when it happens?  In other words - IPv4 fallback should be improved such that you don't have to change IPv6 to Link-Local only.