Remote IPv4 LAN Access via IPv6 WAN
The information on this page is updated in accordance with the 00.07.23.0 firmware version .
Introduction
This guide explains how to remotely access an IPv4 LAN device through a router that only has a public IPv6 WAN address. Since many ISPs now provide IPv6-only WAN connectivity, it may be necessary to bridge IPv6 incoming traffic to an IPv4 LAN endpoint. This is achieved using socat - a utility that can relay TCP connections between IPv6 and IPv4 - combined with appropriate firewall rules on the router.
Configuration overview and prerequisites
Before we begin, let's take a look at the configuration that we are attempting to achieve and the prerequisites that make it possible.
Prerequisites:
- One RUTXXX series router with a public IPv6 address;
- An end device (e.g. RUT281) connected to the router's LAN that you want to access remotely;
- A remote device (PC, Laptop) with IPv6 connectivity used to access the end device;
- A socat package installed on the router;
Topology
RUT986 - acts as the gateway router. It has a public IPv6 WAN address and a LAN IP: 192.168.1.1. It listens on IPv6 WAN port 8443 and forwards traffic to the LAN end device on port 443 using socat.
RUT281 - acts as the end device. It is connected to RUT986 via cable and has a LAN IP of 192.168.1.119. Its WebUI is accessible on port 443 (HTTPS).
PC - the remote client that initiates the connection. It must have IPv6 internet connectivity and accesses the RUT281 WebUI through the RUT986 IPv6 WAN address on port 8443.
Step 1: Install and configure socat on RUT986
socat is used to listen on the router's IPv6 WAN interface and relay incoming TCP connections to the IPv4 LAN device.
Note: If socat is not already installed, install it via the package manager using the CLI.
opkg update opkg install socat
Once installed, navigate to System → Maintenance → Custom Scripts and add the following startup script:
 |
|
|---|---|
socat TCP6-LISTEN:8443,bind=[<RUT986_WAN_IPv6>],fork,reuseaddr TCP4:192.168.1.119:443 & exit 0 Replace |
Note: To start the script immediately without rebooting the device, run the following command in the CLI:
 |
|
|---|---|
sh /etc/rc.local |
Step 2: Configure firewall rules on RUT986
Two firewall rules have to be created to allow the socat relay to function correctly.
Navigate to Network → Firewall → Traffic Rules and create the following rules.
Rule 1 – Allow incoming IPv6 traffic on port 8443
 |
|
|---|---|
|
Additionally, navigate to the Advanced Settings tab of this rule and configure:
 |
|
|---|---|
|
Rule 2 – Allow socat to forward traffic to LAN
 |
|
|---|---|
|
Additionally, navigate to the Advanced Settings tab of this rule and configure:
 |
|
|---|---|
|
Step 3: Enable remote HTTPS access on RUT281
Login to the RUT281 WebUI and ensure that remote HTTPS access is enabled so that port 443 is open and accepting connections from the WAN side.
Navigate to System → Administration → Access Control and enable HTTPS access:
Step 4: Access RUT281 WebUI remotely
Note: The remote PC must have IPv6 internet connectivity to access the endpoint.
From the remote PC, open a web browser and navigate to:
https://[<RUT986_WAN_IPv6>]:8443/
Replace <RUT986_WAN_IPv6> with the actual public IPv6 address of the RUT986 WAN interface.
If the configuration was completed correctly, the RUT281 WebUI will load in the browser:
See also
Custom Scripts on Teltonika Networks devices
Firewall Traffic Rules on Teltonika Networks devices