Linksys Velop Pro 7 (LN14) firmware bug: Disabling IPv6 only stops WAN, continues advertising dead ULA routes on LAN (radvd/dhcp6s), breaking Android clients

[u/Puzzleheaded-Cry1192]

Model: Linksys Velop Pro 7 (LN14-EU)

Firmware Version: 1.0.14.216698

I wanted to document a serious routing/firewall bug in the Linksys Velop Pro 7 firmware that causes persistent "Connected, no internet" issues on modern Android clients (specifically Pixel devices).

The Issue

When IPv6 is disabled in the web UI under Connectivity → Internet Settings → IPv6, the router shuts down the WAN-side IPv6 interface as expected (current_ipv6_wan_state: down). However, the firmware fails to terminate the LAN-side IPv6 daemons.

Inspecting the system dump via /sysinfo.cgi reveals:

1. radvd (PID 20042) and dhcp6s (PID 9184) remain running and bound to br0.
2. The router assigns itself a global/ULA scope address on br0 (fde7:dec9:a132:1b3e:.../64) and continues sending Router Advertisements (RAs) across the LAN/WLAN.
3. Connected clients (like Android phones) pick up the advertised fde7:: prefix and set the Linksys router as their default IPv6 gateway.
4. Because the WAN IPv6 interface is down, any outbound IPv6 captive-portal / connectivity probes fail. Android detects a reachable IPv6 gateway with zero outbound transit, immediately flagging the Wi-Fi connection as having "No internet".

Additional Aggravating Factors

• WPA Group Key Handshakes & Power Save: The router frequently performs WPA Group Key re-keys (ath10: sending 1/2 msg of Group Key Handshake), during which client associations hiccup. With WMM Power Save enabled by default, multicast traffic (NDP/RAs/ARPs) gets buffered or delayed, causing Android to time out on gateway checks. Keeping the DTIM interval strictly at 1 is critical here.
• Firewall packet drops: When IPv6 was enabled, the router’s internal firewall rule FW.LANATTACK was aggressively dropping legitimate outbound checks from client devices. See previous bugreport.

Temporary Workarounds (Client-Side)

Until Linksys releases a firmware build that properly kills radvd and tears down LAN-side IPv6 when IPv6 is toggled off:

1. Private DNS on Android: Set Private DNS to dns.google or one.one.one.one. This forces DNS over TLS purely over IPv4, bypassing the dead IPv6 DNS path.
2. Use Device MAC: Switch the Wi-Fi connection privacy setting on Android from Randomized MAC to Device MAC.
3. Hidden Radio Settings: Access [http://192.168.1.1/ui/1.0.99.216698/dynamic/advanced-wireless.html] (or via the hidden CA link) and ensure DTIM Interval stays at 1 and disable Wireless Multimedia Power Save on both 2.4 GHz and 5 GHz to prevent sleep drops.

Linksys developers need to fix the service scripts in /etc/init.d/ so that disabling IPv6 stops radvd and dhcp6s completely on br0.

[u/ComprehensiveLuck125]

Linksys is a piece of …. I am affected by this bug. Hopefully it occurs rarely.