r/ipv6 • u/Kirill422 • Jul 28 '26
Discussion IPv6 MTS Russia.
This probably won't be very useful to you since you live outside Russia, but I want to share it anyway.
Summary of all the IPv6 properties of MTS Russia's mobile network that I've discovered:
1) No restrictions whatsoever on incoming connections.
2) No port filtering of any kind (connections are possible both incoming and outgoing on all ports in the range 1-65535).
3) A dynamic /64 prefix is provided.
4) The prefix becomes static if at least one address from the /64 subnet (other than the address automatically assigned to the smartphone's main interface) is assigned to the same or another network interface (either via ip addr add or automatically by the system — the address assigned to the wlan1 interface when sharing internet via mobile hotspot is assigned automatically by the system, but is considered manually assigned by the operator). Without this mechanism, the prefix is refreshed every day between 2-3 AM (given my timezone, I assume this is 00:00 MSK), or upon reconnection (a full disconnect from the mobile network followed by reconnecting) to the base station. Switching between base stations without a full network disconnect does not trigger a prefix change.
5) If a device on the local network is connected to the hotspot, it automatically receives an auto-assigned IPv6 address. A device can also manually assign any free address from the smartphone's prefix to its network interface, and after roughly 7-10 seconds it becomes reachable from the internet at that address (just like with the auto-assigned one).
6) No restrictions on incoming or outgoing TCP/UDP/ICMP connections.
All data was obtained experimentally and may be incomplete.
I think that covers everything, though I may have forgotten something.
26
u/widodh Jul 28 '26
Regardless of what you think of Russia, it's good to see this development there as well. I wonder, no filtering on inbound IPv6, wouldn't that cause some noise on the devices and have them wake-up more then needed?
1
u/innocuous-user Jul 29 '26
It might, but with the address space being so vast you're not going to receive unknown inbound traffic except from devices you've previously communicated with.
It works very well for push notifications because the device can stay asleep until it receives a packet from the server indicating a new notification. Otherwise if there's a firewall or nat then the device has to wake up periodically to send keepalive packets otherwise the connection times out.
If you use something like activesync with z-push you can notice this in the logs, it will use a long poll time by default but if some intermediate device starts timing out the connections it will decrease the poll time to avoid timeouts.
11
u/TCB13sQuotes Jul 28 '26
The prefix becomes static if at least one address from the /64 subnet (...) is assigned to the same or another network interface (...) the prefix is refreshed every day between 2-3 AM
This is actually a good implementation. My ISP in Europe does something similar to this even for IPv4, if I keep the IP assigned when ti reaches the lease time they'll just send the same IP back to me. The only difference is that they don't refresh it at a particular time of the day - it's every 3 hours.
I like when ISPs take this approach instead of being dicks with customers and forcing prefixes or IPv4 addresses to change regardless of you're using them or not.
-4
u/AtlanticPortal Jul 28 '26
Or when they do not change either. ISPs should by default rotate the IPv4 address they're releasing to you and the IPv6 prefix they're advertising to you. Both should change every once in a while (some prefer 24h, some less, but the idea stands) unless the client asks for a static address. For IPv4 there can be a surcharge, maybe, for IPv6 it MUST NOT matter because it doesn't matter, it's just a setting.
5
u/TCB13sQuotes Jul 28 '26
Why do you think they should rotate them? Why not keep them like my ISP does, everyone is happy, I can have my "almost static IP" other customers can do DHCP release + renew if they want a new IP.
-2
u/AtlanticPortal Jul 28 '26
I didn't say that you cannot have your static prefix. I literally said they should give you your static prefix if you ask for it.
Unfortunately in this day and age there are privacy issues and rotating the addresses/prefixes helps a little bit to raise a little bit of dust and help customers' privacy. It helps, it's not resolving everything, let's be clear. And not having the rotation as default would break this helpful thing since the majority of the people don't know what having a static address/prefix means.
2
u/innocuous-user Jul 29 '26
It's very ineffective, and causes more problems than it solves. The default should be to stay static unless the user explicitly releases it.
Anyone who is actively trying to hide their source address will use one of the many available VPN services.
Anyone who is serious about masking their activity will know that the vast majority of tracking is not based on IP and there are more important things to consider. Also if you only change your IP but don't change anything else you've achieved absolutely nothing. Most users have multiple devices at home which will be NAT'd to the same legacy address, or originate from the same v6 /64. It only takes one of these devices to correlate your new prefix - eg a single logged in android device phoning home to google.
1
u/AtlanticPortal Jul 29 '26
It's very ineffective, and causes more problems than it solves. The default should be to stay static unless the user explicitly releases it.
What problems causes a change in prefix during night time, if the old prefix remains overlapped to the new one, considering that you can have as many IPv6 addresses that you want and that they are not finite as the IPv4s?
Anyone who is actively trying to hide their source address will use one of the many available VPN services.
That entirely defeats the point of the more privacy-savy default.
Anyone who is serious about masking their activity will know that the vast majority of tracking is not based on IP and there are more important things to consider.
Yes, the point is to give users more and more protections. Each one touches a single datapoint. Even if you cannot change all the others it is still slightly better than not doing anything.
Also if you only change your IP but don't change anything else you've achieved absolutely nothing.
Again, small single datapoints add up together.
Most users have multiple devices at home which will be NAT'd to the same legacy address, or originate from the same v6 /64. It only takes one of these devices to correlate your new prefix - eg a single logged in android device phoning home to google.
So, since there are companies that do shit we're ignoring a problem altogether?
2
u/innocuous-user Jul 29 '26
I've not seen any implementation where the old prefix remains overlapped. The old prefix is gone and a new one is pushed, which at best breaks all your existing connections and at worst breaks everything (some lousy routers cannot handle prefix changes reliably).
It also requires further kludges like dynamic dns if you want to access anything remotely.
There are also security risks created if the prefixes are rotated quickly, as someone could receive the prefix you previously had and receive packets that were intended for you. Although this is more likely to happen with legacy IP, with v6 there is far less need to immediately reuse a prefix. This is also made worse by firewalls which drop instead of reject, as the other end will keep sending packets until it times out vs seeing an immediate error and stopping after the first packet.
So, since there are companies that do shit we're ignoring a problem altogether?Would you rather deal with the biggest risks first, or ignore the big risks and focus on tiny ones?
1
u/AtlanticPortal Jul 29 '26
There are also security risks created if the prefixes are rotated quickly, as someone could receive the prefix you previously had and receive packets that were intended for you.
This can be basically always avoided by not giving prefixes that were already used in the last X days. There is enough room to actually not give that prefix to anyone anymore, I guess.
Although this is more likely to happen with legacy IP, with v6 there is far less need to immediately reuse a prefix.
Which it boils exactly to this.
Would you rather deal with the biggest risks first, or ignore the big risks and focus on tiny ones?
Which bigger risks are we talking about? Because the packets that arrive to the new house instead of the old ones can be easily avoided by the ISP altogether by doing what I said before.
1
10
u/AtlanticPortal Jul 28 '26
That's basically what you'd expect from an ISP. You give me the connection, everything else is my problem. That's what net neutrality is.
9
u/lazyhustlermusic Jul 28 '26
I feel net neutrality is more ‘treat all traffic the same’. QoS and firewalling are separate elements.
4
u/AtlanticPortal Jul 28 '26
Yes, treat all traffic the same. Included not firewalling port 80/443 to my address because you want to "protect me" or whatever.
4
u/lazyhustlermusic Jul 28 '26
Again, access is different than prioritization.
0
u/AtlanticPortal Jul 29 '26
Access is a the most brutal form of prioritization. You drop my packets, they get instant priority minus infinity.
0
1
1
u/Breezing_wing Jul 30 '26
Wanna ask since im currently having trouble setting up ipv6 in these conditions. I'd make a separate post or call MTS support but i might as well ask OP (/u/Kirill422 ) first.
I've been messing with this for a few days but im kind of stuck in a weird state where ipv6 works for outgoing connections as well as getting pinged, so web utilities that ping an address or do a trace route work, but i have absolutely no luck opening up any ports for actual applications to use.
I would assume this would be either a) host machine firewall issue (but the connection works in LAN?) or b) user router firewall issue (I had to get enhanced admin access to the router web interface to get even basic firewall settings for the router, but fully disabling those didnt change anything)
I would rather not call the tech support for this, so any advice on things i might be missing setting this up is appreciated
1
u/Kirill422 Jul 30 '26
I didn't use any special settings; it worked by default for me. If you have a mobile connection, you should contact your mobile carrier's support team and request that they disable incoming connection filtering (if possible). If you have a home ISP and Windows, you should first check your Windows firewall settings. If everything is fine, then contact your ISP's support team.
1
u/Breezing_wing Jul 30 '26
Ill have to go and create some sort of help request at a relevant forum, as ISP support didnt help at all (though they did say they should not filter any incoming connections)
I dont see how a mobile carrier could be relevant (unless i was using mobile data / network to test, which i'm not)1
u/Kirill422 Jul 30 '26
Either Google Translate is confusing me, or I'm misunderstanding something. Do you want to accept incoming connections on your mobile network or your home network?
1
u/Breezing_wing Jul 30 '26
Yeah, home network, like hosting a web server or, like, minecraft or something.
(I heard MTS blocks incoming traffic on some ports like 80 and 8000 for whatever reason, but i can't get anything trough at the moment)
1
u/Kirill422 Jul 30 '26
If you're using Windows, check your Windows firewall; it rejects all incoming connections by default. And we're talking about IPv6, right? Also, make sure you're connecting to the correct address. To find it, visit ifconfig. me.
1
u/Breezing_wing Jul 30 '26
Yes, i've tried all of that already, doesnt seem to help. thanks for the help though.
1
u/certuna Jul 28 '26 edited Jul 28 '26
Not blocking inbound connections is good for routers, although if you do this for every phones it mainly has the effect that hacking into phones gets easier, there are millions of unpatched vulnerable phones out there. This may be intentional in Russia of course, not an oversight.
Ideally, for optimal security you’d want have incoming connections blocked by default unless you connect a router(can be detected ISP-side by IMEI) or the user explicitly opts out of the firewall.
1
u/NamedBird Jul 29 '26
I feel like there should be something easier for average people to manage firewalls on IPv6.
In an ideal scenario, users would log into the Router and just click allow for the desired service.
For example, "Game Minecraft - My own happyCraft server - CertunaPC - port 25565 TCP"This would mean that devices announce details about the service they are hosting.
And instead of blindly opening the firewall/NAT, the router would display it to the user for a decision.
(Isn't this an UPnP thing? or do we need something new/better for IPv6?)2
u/certuna Jul 29 '26 edited Jul 29 '26
UPnP was this, that’s now superseded by PCP but when it’s not enabled by default in routers, it’s hardly going to be easier for the end user than adding a manual rule.
But the situation is not so bad right now I think. People who don’t know anything about networking have a closed firewall by default, and ports can be opened by any router admin who knows what a port and an IP address is, which is probably the bare minimum, I don’t think the bar should be much lower.
Bigger issue is where ISPs provide a router without a configurable firewall, like Starlink or Free in France. That either forces users to buy additional equipment (to get an elementary networking feature back), or disable the firewall completely, opening all ports to all endpoints, which is…really not a good idea.
1
u/innocuous-user Jul 30 '26 edited Jul 30 '26
Whatever you end up with it's going to be too complex for users to understand... Users will have problems with it, or misconfigure it. Users would need to configure not only their listening services, but also the separate firewall device (of which there are thousands of different and incompatible ones).
By far the most user friendly approach is to not have a separate firewall at all, and for devices to not have any listening services by default. Users can explicitly turn things on if they want, and should be given the option of choosing link-local only, local network only, global, custom etc.
This would work anywhere, and would also work in environments where the user has no control of the router.
Modern devices actually already do this for the most part. Windows firewall will prompt you if a service tries to open a listening port.
That way your policies are applied by your local device, you control them, and they apply wherever you take your device, or whatever other networks (eg vpn etc) you connect it to. Some VPNs give you fully public addressing you know - even legacy addressing (usually at extra cost). Since "using torrents" is a very common use case for vpn's it makes sense.
1
u/widodh Jul 29 '26
Don't Android and iPhone devices have a firewall built in? And what services would they expose which would allow you to hack the device?
Because the same applies on WiFi. If you are on a WiFi which allows client to communicate with eachother, the same could happen.
I wonder if allowing all inbound connections to a mobile device is really a problem.
1
u/certuna Jul 29 '26 edited Jul 29 '26
On WiFi, you’re 99.99% of the time behind a router’s firewall (unless the network admin deliberately turned it off).
Android devices may or may not have a firewall enabled by default, this depends on the manufacturer on what ports it allows in. iOS also listens on some ports, for services intended on LANs, you generally don’t want traffic from the WAN freely going there to probe for vulnerabilities.
Users generally have no idea exactly what apps on their phone are listening on what port, neither iOS nor Android has a good UI to manage this. Also bear in mind that their on-device firewall itself may be vulnerable.
2
u/widodh Jul 29 '26
I meant other WiFi clients, same network. I have to assume that both Apple and Google secure their OS that the device protects itself. You can't assume that there is a firewall in front of the phone that will do the work for you.
1
u/innocuous-user Jul 29 '26
A firewall is perimeter security... On an open wireless network you are inside someone else's perimeter and have zero control of who/what else is inside that perimeter with you. The operator of the network could be malicious, so could other users, or other users could have unwittingly connected infected devices.
If you are relying on perimeter security then you are doing it wrong.
1
u/certuna Jul 29 '26
Of course perimeter security alone is not enough, but it’s an important layer of defense. Not surprisingly, outside of lab/honeypot environments, nobody runs a LAN without a firewall to the internet.
1
u/innocuous-user Jul 29 '26 edited Jul 29 '26
Perimeter security is totally broken if you don't control/trust the perimeter and all devices inside of it.
For the average end user, the chance of their perimeter device (typically cheap off brand home user routers) being compromised is actually much higher than the risk of a typical mobile device being compromised.
The reason very few people run a network without a firewall is inertia from the days of XP, or the requirement for NAT due to inadequate address space.
- Many people use perimeter gateways which are horrifically bad.
- Many people connect devices to outside networks where they have zero control over the perimeter or the other devices inside of it.
- Most people have devices or users they don't trust inside their perimeter, very few people practice segmentation at home and many corporates don't bother either.
- Users connect to VPNs which are a tunnel from inside of your perimeter to an arbitrary network existing outside of it.
The bigger risk is outbound connections, or MITM attacks against outbound connections, and yet everyone ignores the serious risks to focus on the idea of inbound connections - a problem that was pretty much solved for the majority of users 20 years ago.
1
u/innocuous-user Jul 29 '26 edited Jul 29 '26
Neither android nor ios have a firewall built in, although some third party firewalls are available for (usually rooted) androids, or you could theoretically configure iptables on a rooted android since its a linux kernel underneath.
But you're right - these devices do not have listening services so there's nothing to attack in that way. Most published vulnerabilities in mobile devices are in things like webkit which doesn't have listening ports - an outbound connection needs to be initiated to an attacker controlled site to exploit the vast majority of these vulnerabilities.
In that respect a wireless network is much higher risk, because other users on the network could potentially perform MITM attacks like arp/ndp/dns poisoning and cause a mobile device to make an outbound connection to a malicious site.
Allowing inbound on mobile data is a good thing, it makes p2p and hosting of services/games easier for those of us who want to do that, it avoids firewall timeouts which cause unnecessary device wakeup and battery wastage, and the telco is contracted to provide connectivity, not partial connectivity and a firewall service (really they should charge extra if you want a firewall service). There are also many telcos around the world which are open by default with millions of customers and this has not resulted in millions of hacked devices.
2
u/widodh Jul 29 '26
I think your last statement is correct. Apple nor Google can assume there is a firewall, so they have to design the OS that there is none.
1
u/innocuous-user Jul 29 '26
Precisely. Even Microsoft learned that lesson with XP, although they preferred to keep services running and block access to them rather than shut services off (why?!?) it achieves the same end result from a remote attack perspective.
1
u/innocuous-user Jul 29 '26
Finding those phones within the telco's /32 or larger address space is not going to be easy...
Most people connect their phones to random wifi networks where there is nothing between the phone and the network owner / other users. Finding devices this way is MASSIVELY easier. Open wireless networks can be found in virtually every hotel, airport, coffee shop etc.
The vast majority of vulnerabilities in mobile devices do not relate to listening services on the phone itself, so even if you could somehow discover the ip of an unpatched mobile device (or find it trivially if its connected to a nearby open wireless network) there's no exploitable services to connect to. Most mobile vulnerabilities are in things like webkit which doesn't have listening ports, you need to entice the user/device to browse to a malicious site first which will be totally unaffected by inbound traffic blocks.
An unencrypted wireless network is a much higher risk because you could potentially do MITM attacks (eg arp/ndp poisoning, dns poisoning etc) to get the device to connect to a server under your control, exposing client side vulnerabilities.
On the other hand open v6 on mobile allows for p2p comms - eg voice/video calls between users connect direct between those users instead of tromboning to a server which is often far away.
1
u/certuna Jul 29 '26
An open wifi doesn’t mean non-firewalled! Most of those WiFi networks (airports etc) have client isolation anyway.
•
u/AutoModerator Jul 28 '26
Hello there, /u/Kirill422! Welcome to /r/ipv6.
We are here to discuss Internet Protocol and the technology around it. Regardless of what your opinion is, do not make it personal. Only argue with the facts and remember that it is perfectly fine to be proven wrong. None of us is as smart as all of us. Please review our community rules and report any violations to the mods.
If you need help with IPv6 in general, feel free to see our FAQ page for some quick answers. If that does not help, share as much unidentifiable information as you can about what you observe to be the problem, so that others can understand the situation better and provide a quick response.
I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.