IPv6 forward chain lets the internet reach internal devices

What the audit found

Your router has IPv6 enabled with a global address or prefix, but the forward chain under IPv6 → Firewall → Filter Rules contains no active rule that drops new connections arriving from the WAN side and heading for your internal network. In practice, any device on your LAN that has an IPv6 address can be reached directly from the internet.

The audit rates this high. It is reported independently of the IPv4 firewall: a perfectly good IPv4 firewall does nothing for IPv6 traffic.

Why it matters

With IPv4, most people never had to think about this. The router gives out private addresses, does NAT, and an outside host cannot address a PC on the LAN even if the firewall is weak. That accidental protection does not exist in IPv6. Your ISP delegates a prefix, every device gets a globally routable address in it, and the router simply routes. If the forward chain does not say "drop", the packet is delivered.

Picture an office where a Windows PC has file sharing on, a printer has its web interface on port 80, and an IP camera answers on RTSP. Over IPv4 none of that is visible from outside. Over IPv6, with this finding, all of it is — with the same weak default passwords and old firmware as always. Scanning the IPv6 space is harder than IPv4, but addresses leak constantly through DNS, web logs and peer-to-peer software, and one known address is enough to probe the whole prefix.

The most common cause is simply that IPv6 arrived later: the router got a careful IPv4 firewall years ago, the ISP then switched on IPv6, the router picked up a prefix through DHCPv6, and nobody added the second set of rules.

What it looks like in Winbox

Open IPv6 → Firewall → Filter Rules. Look at the Chain column for rules with forward. If there are none, or the only ones are greyed out (disabled), or none of them drops traffic coming from the WAN, this is your situation. Compare with IP → Firewall → Filter Rules, where you probably do have such a rule for IPv4.

Confirm IPv6 is active under IPv6 → Addresses and IPv6 → DHCP Client.

How to fix it

The principle is a rule at the end of the IPv6 forward chain that drops everything which did not arrive from your LAN. It works on the same interface list as your IPv4 firewall (Interfaces → Interface List), so create that list first if it does not exist. On its own such a rule would also block reply traffic, so the usual accept rules go in front of it: keep sessions that your devices opened working, discard invalid packets, and allow ICMPv6, which IPv6 needs for neighbour discovery and path MTU and must not be blocked wholesale. Only then comes the final drop for new connections arriving from anywhere that is not the LAN, all built under IPv6 → Firewall → Filter Rules.

If a device on the LAN must be reachable from the internet over IPv6 — a self-hosted server, say — add an accept rule for its address and port above the final drop. That is the IPv6 equivalent of a port forward.

This change affects traffic through the router, not to it, so it cannot lock you out of Winbox; use Safe Mode anyway if you are editing several rules at once. The IPv6 input chain, which protects the router itself, is covered by a separate finding.

Afterwards, find the IPv6 address of a LAN device and, from a network outside yours with IPv6, try to ping it or connect to a service on it; it should fail, while the device can still browse IPv6 sites normally. Then re-run the audit; the finding should disappear.

The full MKRouterKit report gives the exact commands for your configuration — with your interface names and subnets filled in, in the order that will not lock you out.

FAQ

I have a good IPv4 firewall. Doesn't it cover IPv6 too?

No. The IPv4 and IPv6 firewalls are separate tables and neither sees the other's traffic. Every rule you want for both protocols has to exist twice.

Won't dropping inbound IPv6 break things that need it?

Normal use — browsing, email, video calls, updates — works because those are connections your devices open, and the established/related rule lets the replies through. What stops working is unsolicited inbound connections, which is the point. If you host something, allow it explicitly.

I do not use IPv6. Should I just disable it?

If you are sure nothing needs it, disabling IPv6 under IPv6 → Settings removes the exposure entirely and the audit will stop checking IPv6. But many ISPs, mobile networks and cloud services now depend on it, so a proper firewall is the better long-term answer.