About pswired

No signs of improvement for me on 68 here in Maryland. Latest peak hours speed test results: 1.04 Mbps down and 10 kbps up. On the other hand, I'm getting 30-40 Mbps down and 2-3 Mbps up during off-peak hours. This behavior has been consistent since I got the service in September.   http://testmy.net/quickstats/pswired       ... View more

@C0RR0SIVE I am a residential subscriber. I personally was never promised static IPv6 addresses (or any IPv6 at all, for that matter) during the sales process, but it appears that others have been. Regardless, every other ISP that I'm aware of in the US provides static IPv6 prefixes to its fixed customers. This is a central design feature of IPv6, evidenced by the lack of wide support for IPv6 dynamic DNS and Hughesnet's own IPv6 firewall design in its HT2000W router. The firewall rules must be built with the end device's IPv6 address, so if those addresses are dynamic, the user would need to reconfigure their firewall rules every few days. ... View more

@Liz If the situation of having dynamic IPv6 prefixes is not expected to change anytime soon, then HughesNet sales and support staff should be trained to tell customers and prospects that using remote access devices such as security camera systems is not possible with the service offering. CGN prevents it on IPv4 and dynamic addressing prevents it via IPv6. That's very unfortunate since this seems to be requested quite often here in the forums. ... View more

Liz, to be clear, there are two issues here:   -The HT2000W inbound IPv6 firewall implementation is buggy and requires the above posted workaround to disable the firewall entirely. Using the firewall as intended does not seem to be possible. The inability to ping downstream devices is a symptom of this problem.   -The IPv6 prefix assigned to a downstream device via DHCP-PD is dynamic and indeed changes often. This is undesirable because it prevents IP-based firewall rules from being implemented for downstream devices and prevents remote access to those devices. ... View more

Yes, if you have a way to use a dynamic DNS service to update your IPv6 address, that will work. However, the DDNS client in my Hikvision DVR doesn't appear to be IPv6 enabled.  ... View more

Basically, this is not possible on Gen5 as it currently stands. Configuring the IPv4 inbound port forwards required for a conventional DVR (Hikvision, etc.) will not work due to the CGN layer added to the Gen5 network. Your router's "public" IP is not a public Internet routable IP address.   Hughes does assign a public, routable, IPv6 block to your LAN, but it changes so often that it's useless. Dynamic DNS infrastructure for IPv6 isn't really much of a thing because customer issued IPv6 blocks aren't supposed to change. We're kind of in a pickle until (if ever) Hughes prevents the customer IPv6 blocks from changing.   The solution here is to use a camera system that connects to a cloud service (Ring, Nest Cam, etc.). ... View more

Thank you for the update. Any new information that you can relay would be appreciated. ... View more

Here's how to get it to work:   Go to your HT2000W setup page and, under advanced settings, in the firewall section: -Enable the firewall -Disable DMZ -Disable both intrusion detection checkboxes -In IPv6 rules, add a rule with "::" as the client address (no quotes), TCP, start port 1, end port 1. -REBOOT THE ROUTER USING THE WEB UI OPTION, then don't change any more firewall settings   Your Hikvision DVR (assuming it's moderately recent) will pick up an IPv6 address and will be accessible from the Internet if your device has IPv6 connectivity. You can see what the address of your DVR is by going to the network settings page in the web interface. It's also worth mentioning that any other IPv6 capable devices on your network will also receive publicly accessible Internet addresses, so be sure they have proper local firewalling, etc.   I am noticing my IPv6 previx change quite frequently, which is somewhat useless for remote access. But YMMV on that. ... View more

Not sure if you need the data, but here's the latest round of test results. Last night, during peak hours, I had an average of 5.3 Mbps downstream and 0.195 Mbps upstream. The connection was virtually unusable. This morning, during non-peak hours, I have an average of 46.1 Mbps downstream and 2.27 Mbps upstream.    ... View more

Thanks, @Liz. What would the techs be doing if they dispatch to the site? ... View more

Can you post all your HT2000W configuration settings? I am able to ping, traceroute, etc. both inbound and outbound on mine.   FWIW, I'm on the San Diego IP gateway. ... View more

It is not static at all, or at least hasn't been the past few days. Sometimes it lasts a couple days, other times a few hours and they assign a new prefix. Really annoying and not the way IPv6 is supposed to work. I'm still sorting out some sort of dynamic DNS solution to do the updates automatically. ... View more

Also maybe open up remote admin on your sonicwall and try to make a http/s connection via IPv6. But don't leave it open for long since your IP is posted above 🙂 ... View more

Interesting. When I was having problems, the ICMPv6 pings would not even make it in past the HT2000W. I think there must be something else going on here. Do you have a laptop or something you could plug directly into the HT2000W and disable the firewall completely on? What are you using to test from (ping origin)? I have been using the Level3 looking glass here:   http://lookingglass.level3.net/   Using the Atlanta, GA site. It seems that not all of the sites are actually IPv6 enabled.    One note: ICMPv6 is a core part of IPv6 functionality, so network operators can't get away with blocking it wholesale like they could with IPv4.  ... View more

I've noticed the same problem trying to view facebook videos. Constant starting and stopping. Even in the mornings when the system should not be as loaded down as it is during peak hours. I am inclined to believe that's a separate problem from the raw throughput issues.   Right now, my testmy.net results are 784 kbps downstream and 12 kbps upstream. Wow!   http://testmy.net/quickstats/pswired     ... View more

Are you able to take a packet capture from your sonicwall's WAN interface to see if your inbound connection attempts are reaching the Sonicwall? ... View more

Here's a bad screenshot- hopefully this helps. ... View more

This has not been my experience. I still have very poor performance in the evenings. ... View more

I have "IPv6 - Automatic" checked. IIRC, the HT2000W won't provide any IPv6 at all to the LAN side if that box is unchecked. ... View more

So...   Everything was working well. I had my security cameras set up for IPv6 access from the Internet and I was able to view them from my smartphone via cellular, etc...   Then I got the bright idea to log in to the HT2000W and see if anything had changed in the IPv6 firewall settings options. I had the firewall enabled and a single IPv6 rule added to allow remote admin access to my downstream router. I decided to try disabling the firewall and removing that rule. Well, that made all the IPv6 inbound stop working. So I reverted my changes, and guess what- doesn't work now. Same symptoms as when I started.    After some additional experimenting, here's what I think needs to be done, and I can reproduce, to get inbound IPv6 working:   -Enable the firewall with the "firewall features" checkbox in advanced setup -Add an IPv6 firewall rule. It doesn't matter what the rule does, but one must be present. Mine allows TCP port 1 to a null address (::) -Reboot the rotuer and don't maky any further firewall changes. This is important--inbound stops working if you make any further firewall changes after the reboot.   So, my conclusion is that there's a bug that is worked around with the above process. Last night's change must have been something unrelated done by Hughes that caused a modem reboot which triggered the last step of the above workaround.   Whew. ... View more

Hey! It looks like it's working now! Last night I noticed that my IPv6 DHCP allocation changed (maybe the modem rebooted, I haven't checked yet). Now I can ping my downstream router's IPv6 address and access its HTTP interface from the Internet via IPv6!    Thank you for getting this in front of the right people, @Liz, and please relay my thanks to the engineers who got this resolved quickly. Impressive to have a firmware fix rolled out and functional in about a week.   This is somewhat light testing so far, but I'll continue to verify everything is working. ... View more

@Liz Thank you for the update and we appreciate the effort to resolve this. If there's anything I can do to help, let me know.    @tracerrx The "proper" way to implement IPv6 in this case is to indeed attach that /62 to your LAN and hand out public addresses to your LAN devices directly. Your devices will then run dual stack and requests to IPv6 enabled hosts will use one network stack, IPv4 another. Then add firewall rules to your router so that services on your LAN are not exposed to the Internet except as desired. However, if the LAN devices you want to be publicly accessible do not support IPv6 natively, then yes, you'll need to do as you describe and 6to4 at the Sonicwall.   It looks to me like everything is good to go in the Hughes network itself and the problem lies in the HT2000W- when I run traceroutes to the IPv6 address of a device behind the HT2000W, I see the 600ms latency jump at the last hop before the traces die. That tells me the packets are making their way all the way to my CPE and dying there. Hopefully the engineers working on this will get it sorted and release a new firmware soon. And hopefully that firmware will allow the firewall to be completely disabled instead of needing to add individual rules for each service allowed through. ... View more

Yup, looks like you're well on your way to getting that block assigned to the Sonicwall LAN. Let me know if you have any results different than mine as far as accessibility to those addresses from the Internet.    Unfortunately I have a feeling we'll need to wait for a future software version of the HT2000W for this to work. All of my testing shows that the "disable firewall" checkbox option doesn't work for IPv6. ... View more

@tracerrx, the address you see in the HT2000W's WAN status section is just the link-local address on that interface. There is a routable block that's assigned to the HT2000W's LAN interface. If you plug a device into the LAN, it will be assigned a public routable address block via an IPv6 router advertisement. Also, you can connect a router to the HT2000W's LAN port and receive a public IPv6 block via DHCPv6's prefix delegation feature, which will allow that router to assign another routable subnet to its inside (LAN) interface(s). The HT2000W is giving a /62 to my router in this case.   HOWEVER, it appears to me that the HT2000W is filtering all inbound IPv6 connections to devices connected to the LAN network regardless of the firewall being enabled or disabled, or adding allow rules in the IPv6 section of the configuration. I can ping my HT2000W's LAN IPv6 address from the public Internet, but can't ping any of the devices connected to it. Running packet captures on those devices shows no inbound ICMPv6 at all from the host on the Internet sending the pings. So it appears that the firewall in the HT2000W is not being disabled when instructed to do so through the web UI.   Input and suggestions from a Hughesnet network engineer would be very helpful!  ... View more

Still waiting to hear back on when the next stab at a fix for this will be implemented. In the meantime, I'm continuing to test at different times of day. Around noon yesterday, I was getting 40-50 Mbps downstream and 3 Mbps upstream. At 9:30 last night, 3 Mbps down and 1 Mbps up.  ... View more

Hi, @Liz. Anything back from engineering on this? ... View more