IPv6 ICMP: the solution, but do we really need it?

If you performed the IPv6 test on IPv6 test - IPv6/4 connectivity and speed test (it should be noted, there are some other IPv6 test websites), you most likely noticed that it shows your PC unreachable by ICMP protocol. This is the common result for most of Windows OS, not only 11. But the pop-up explanation says that "IPv6 relies heavily on ICMP".

In some case ICMP filtering may be performed by local router, rarely by ISP, most often by Windows Firewall. Firewall settings depend on Windows version; to enable ICMP echo in Windows 11 you need to do this:
1. Open Settings, Network & internet, Advanced network settings, Windows Firewall link (it opens Windows Security window, Firewall & network protection).
2. Open Advanced settings link (it opens Windows Defender Firewall and Advanced Security window).
3. Select Inbound Rules, then Core Networking Diagnostics - ICMP Echo Request (ICMPv6-In); there are two profiles with this name, need to select "Private, Public" profile, not "Domain". By default, this rule is disabled.
4. Open the rule window, on the General tab select Enabled, then on the Scope tab in "Remote IP address" group select "Any IP address" instead of predefined "Local subnet".
5. OK, close all opened windows.
Now you can perform the test again and it should show ICMP as Reachable.

But does this solution really improves IPv6 connectivity, for example, for better stability of VPN or other services like online videogames? Or the disadvantage in possible exposing of IPv6 address by echo reply is more significant than possible, but not very important benefits.

Good catch. On Win 10 that measurement shows as FIltered, but the overall score for my 2 PC's is the same. The VPN I use does not have IPV6 protection but has a switch for IP/DNS Protection (which disables IPV6).
No observed network or connectivity issues with Win 11 so no apparent need to enable ICMP on my PC.

Slavic said:

But does this solution really improves IPv6 connectivity, for example, for better stability of VPN or other services like online videogames? Or the disadvantage in possible exposing of IPv6 address by echo reply is more significant than possible, but not very important benefits.

Click to expand...

Yeah, at the end of the day that's my question - what's the overall benefits?

Slavic said:

But does this solution really improves IPv6 connectivity, for example, for better stability of VPN or other services like online videogames? Or the disadvantage in possible exposing of IPv6 address by echo reply is more significant than possible, but not very important benefits.

Click to expand...

Dru2 said:

Yeah, at the end of the day that's my question - what's the overall benefits?

Click to expand...

According to Cloudfare (CDN provider to many websites, including this one)....

What is ICMP used for?

The primary purpose of ICMP is for error reporting. When two devices connect over the Internet, the ICMP generates errors to share with the sending device in the event that any of the data did not get to its intended destination. For example, if a packet of data is too large for a router, the router will drop the packet and send an ICMP message back to the original source for the data.

A secondary use of ICMP protocol is to perform network diagnostics; the commonly used terminal utilities traceroute and ping both operate using ICMP....

Click to expand...

As both Tracert and Ping work fine without enabling inbound ICMP connections in the W10/W11 Firewall I see not advantage in removing the filtering, only the possibility of making your machine more exposed to others who may be trying to probe it.

Bree said:

As both Tracert and Ping work fine without enabling inbound ICMP connections in the W10/W11 Firewall I see not advantage in removing the filtering, only the possibility of making your machine more exposed to others who may be trying to probe it.

Click to expand...

Although I don't have much proficiency in networking, my conclusions are nearly the same: right now there are no obvious reasons to enable ICMP for getting two extra points in results of IPv6 test.

Currently we live in the net world with mixed IPv4/IPv6 protocols, which is still mostly v4. Switching from v4 to v6 (and back) in most cases happens behind the scene, transparently for a user; in particular, v4 can work as a failsafe option. At least for PCs, which still receive IPv4 addresses, either from global or private net from ISP or local router; contrary to growing IoT devices which should use primarily IPv6 addresses because of their supposed myriads in number. Well, for PC v6 may have some advantages right now, if you install some services or apps (like streaming video or game) which demand or at least count on IPv6, but they almost certainly will add the specific rule, including ICMP support, to Windows Firewall during the installation or at the first start. And that rule will be limited to app or service only, not exposing your PC all the time.

But what was a reason to include ICMP to IPv6 tests? I think that it allows to test local network behind the PC. When you enable ICMP echo on PC, you should see it reachable if your local net devices as well as ISP don't block this protocol. If they block, need to perform some actions like enable ICMP in router or replace it to more modern device. If your test is OK, no reason to keep ICMP enabled. It's also possible to check this without modifications described in my first post, simply switching off the Windows Firewall for a few seconds.

Unfortunately, this explanation why need to enable ICMP only temporarily for testing the local network devices is not mentioned on the IPv6 test website.

Interestingly enough, I just cleanly installed Windows 11 yesterday.



So, based upon that, I suppose if it detects that IPv6 is natively supported, it enables the ICMP by default then?

Background - I know that my connection to the world via AT&T Lightspeed FttH supports IPv6, but it was disabled by default in the router. After double checking in my internal network, running on a Google WiFi network, also can support it natively, I enabled it on the Residential Gateway (AT&T's fancy word for AIO modem + router), and then enable it on my Google WiFi, and had mixed results with my old system. But since it seemed to work some times I kinda left it all enabled and forgot about it.

Now it seems that it works perfectly fine with more modern hardware - but, I'm also hardwired into the main Google WiFi puck, which has a hardline running to it from the RG, so I have full wired access to my connection, versus using WiFi. Technically, I could check via WiFi, but the results should be no different, since my wired connection is routed through the Google WiFi puck, and Google WiFi is handling the DHCP and DNS, as that is how I've set it up.


I'm kinda giggling, though, that they are docking points for me not having a unique identifier (aka hostname) for my computer - and because of the fallback to IPv4 is set too ... fast?

Because, yeah, I want everyone to be able to identify me and my unique machine even more so than they already can through my browser, thanks! Oh, and failsafes? We don' need no stinkin' failsafes!

Sigh.

OK, here are my test results (with local addresses removed, of course):


I enabled ICMP for this test to get maximum possible points, 19 of 20. My PC doesn't have IPv6 hostname, in theory I could get one using one of dynamic DNS services, but it was never supposed to work as a server and become reachable from the outside. Yes, some people keep home servers with remote access to docs, media files, home devices from outside, but it's not my case. IPv6 also was not enabled in my router by default, I had to switch the protocol manually to IPv4/v6. After that, all works well.

Fallback in 1 second is a feature of web browser, Google Chrome 93; Edge shows the same 1 sec. If you repeat the test, the result may be improved. If not, it's a Windows or maybe a network problem (never solved this yet).

Why your ICMP test was not performed? The port may be blocked by ISP or router, to check this, you can do the same test using Wi-Fi connection and/or using other PC or mobile device. Sure, you don't need ICMP for common work, only if you will install a specific service in the future...

I did not manually enable ICMP, and I'm wondering if it is because I am (pretty much) double NATd - I have my Google WiFi inside of my AT&T RG, and I did not perform any port forwarding / bridging / etc between the RG and the GW, so that GW gets an IP from the RG and all my systems get an IP from the GW. So, being double NATd, I suspect that may be why it doesn't bother to check ICMP. Of course, I amy be wrong, that may have no effect on it - this setup certainly has no effect on anything else I do, so....

As for the fallback - I use Firefox. so it's 7. I suppose I could change that if need be - but I'm not enabling ICMP for nothing. I don't need a high score, I need it to work first and foremost - and it does work as things stand right now exactly as I have it set up.

So, if it is not broken, I'm not going to try to fix it.

I would assume that if it was important, remembering that MS is all for iPV6, it wouldn't be filtered by the firewall, so leaving well alone.

I will await until it becomes an issue but TFHU

johnlgalt said:

Interestingly enough, I just cleanly installed Windows 11 yesterday.

View attachment 7748

So, based upon that, I suppose if it detects that IPv6 is natively supported, it enables the ICMP by default then?

Click to expand...

Did you click on the hamburger by the score?

No. My score today is 17, and ICMP is supposedly being filtered. And I'm fine with that.

Allowing incoming ICMPv6 echo requests is fine. The main risk you run if you allow them in is that if someone finds a stable (non-temporary/privacy) address for e.g. your laptop then they can keep pinging it to see when it's switched on. That might be considered a privacy risk. They'll have to find such an address first though, because for outgoing connections it will use its temporary privacy addresses.

While IPv4 and fallback is still mainstream ICMP is not vital to continued operation, but going forward "if/as" site's and programs begin to use IPv6 as the main with less and less IPv4 as fall back it might become more of an issue. The IPv6 equivalent of ARP is neighbour-discovery, which uses ICMP packets as well. The stateless auto configuration is part of neighbour discovery, so also needs ICMP. So it is not just error reporting.

From what I have been reading and several papers published Filtering at Firewall level (ISP/server/home) is recommended, so that you receive, error messages (there is an advanced windows firewall setting to allow ICMPv6 echo requests on your private network(disabled as default)) , but drop messages that are potential security risks.

I feel that the option is there in both the test, and in windows for those people working on IPv6 only networks, where its operation is needed, and so disabled as default due to most current routers/homes etc just not being setup to handle IPv6 only networks and more importantly security. Still lots to learn for me, but working my way through it.

There is a pretty heavy read on the subject here RFC 4890: Recommendations for Filtering ICMPv6 Messages in Firewalls (good luck with it, it is interesting)

As to your question about helping with gaming and VPN's, I just don't think Games and services are leaning on IPv6 and its feature set enough for it to be an issue for them at the moment, there are still routers out there with either No Ipv6 support or with it disabled as default, and people just don't know, or care as long as it is working.

Hope this helped @Slavic