Re: Configure Recursive IPv6

psimmond · ‎10-21-2020

I just bought a new TP-Link router and I'm trying to configure IPv6 recursive DNS resolution so that I still can block Youtube without disabling IPv6.
I put in these settings:

support.opendns.com_hc_user_images_FyxhAxiF3O38zwOFIUohpg.jpeg

And at first it seemed like it worked, but now Youtube is not blocked even though the OpenDNS Welcome page says I'm connected. Any ideas? Thanks!

When I run "nslookup -type=txt debug.opendns.com" I get ...

C:\WINDOWS\system32>nslookup -type=txt debug.opendns.com
Server: resolver1.opendns.com
Address: 2620:119:35::35

Non-authoritative answer:
debug.opendns.com text =

"server r1.atl1"
debug.opendns.com text =

"flags 40020 0 70 180000000000000000007950800000000000000"
debug.opendns.com text =

"originid 0"
debug.opendns.com text =

"actype 0"
debug.opendns.com text =

"source [2600:6c5a:677f:40c2:d11f:99dd:86f1:334a]:65270"

C:\WINDOWS\system32>

rotblitz · ‎10-21-2020

You cannot register an IPv6 address at the dashboard. Therefore your settings do not take affect. You must run your DNS traffic over IPv4. Use these resolver addresses:
::ffff:d043:dedc and ::ffff:d043:dcde

Web traffic still can go via IPv6.

psimmond · ‎10-21-2020

Can you tell me what I'm doing wrong? I entered "::ffff:d043:dcde" and it said Invalid format, so I tried "0000:0000:0000:0000:0000:ffff:d043:dcde" but it still says Invalid format.

On a related side note, why would Youtube sometimes be blocked with "2620:119:35::35" & "2620:119:53::53" and sometimes not be blocked? (I have Video Sharing blocked, but it seems odd to me that it seems to toggle on and off.)

rotblitz · ‎10-22-2020

I don't know why your router treats the entries as invalid. Mine does not. Yours may not like such addresses.

"why would Youtube sometimes be blocked with "2620:119:35::35" & "2620:119:53::53" and sometimes not be blocked?"

Although IPv6 has priority over IPv4, there still may be randomly DNS queries via IPv4, for example if there is no response from IPv6. For those your dashboard settings take effect.

psimmond · ‎10-22-2020

Thanks, rotblitz. My Archer C6 let's me use...

2620:119:35::35
2620:119:53::53

and

2620:0:ccc::2
2620:0:ccd::2

but of course neither allow me to use content filtering from the Dashboard.
Do you know if OpenDNS has any other IPv6 resolver addresses I could try?

rotblitz · ‎10-22-2020

As I said above, the problem is not the DNSv6 resolver address, but the fact that you cannot register an IPv6 address at the dashboard yet. Therefore there is no way for OpenDNS to associate your DNS queries with your dashboard when using DNSv6. Therefore your question for other IPv6 resolver addresses does not make sense. If you want to have your dashboard settings in effect, your DNS traffic must be over IPv4.

If you cannot configure this, your only other option is to disable IPv6 altogether.

Ah wait, if you just want to have adult sites blocked, you can use the OpenDNS FamilyShield IPv6 addresses, 2620:119:35::123 and 2620:119:53::123
But still, these addresses do not use your dashboard settings either. For example, you cannot block YouTube with these addresses.

psimmond · ‎10-22-2020

Thanks, I'll try the 2 you just sent me although they only filter adult sites.

I was probably using the wrong terminology. What I was trying to ask is whether there were addresses I could try, besides ::ffff:d043:dedc and ::ffff:d043:dcde, that would achieve the same result: running all DNS traffic over IPv4.

rotblitz · ‎10-23-2020

There are two other addresses, but with the same kind of notation. This certainly will lead to the same result.
::ffff:d043:dede and ::ffff:d043:dcdc