Tag Info

New answers tagged

1

You've done this: # Drops all incoming TCP that's not directed to these ports, # Preventing also answers for locally initiated connections! ip6tables -A INPUT -p tcp -m multiport ! --dports 21,22,80,443 -j DROP # Drops all incoming UDP that's not directed to these ports, # Preventing also answers for locally initiated connections! ip6tables -A INPUT -p udp ...


0

The solution is the same as for IPv4 - you have to hide a private network behind a NAT with two WAN links. Unique Local Addresses (ULA) is "Private networks for IPv6". Network Prefix Translation (NPt) is "NAT for IPv6". Assign an internal IPv6 Unique Local Address for your network. While it is not required to do so (the chances of colliding ULAs is much ...


1

As Tilman Schmidt already pointed out, you have an all-zero host part. However, I also had trouble enabling IPv6 in an LXC container. This worked for me on CentOS 7: In /etc/sysconfig/network-scripts/ifcfg-eth0, add: IPV6INIT=yes IPV6_AUTOCONF=yes IPV6_DEFROUTE=yes IPV6_PEERDNS=yes IPV6_PEERROUTES=yes IPV6_FAILURE_FATAL=yes ...


2

The address 2001:41d0:2:XXXX::/64 has an all-zero host part. Try assigning a proper address, eg. 2001:41d0:2:XXXX::YYYY/64. Before you try pinging a host on the Internet like ipv6.google.com, check if you can ping the default gateway by its numeric address 2001:41d0:2:xxff:ff:ff:ff:ff. Also check if XXXX == xxff in the above addresses. Otherwise your ...


2

Name-based is easier because you don't have to adjust your network configuration for every website you host. Address-based is nice because every website you host is more easily identifiable in e.g. firewall policies, traffic management and monitoring, DDOS prevention etc. The best choice depends more on your personal preferences, available management tools ...


1

You could use BIND as a local resolver, it has an option to filter AAAA: https://kb.isc.org/article/AA-00576/0/Filter-AAAA-option-in-BIND-9-.html


1

Stop using gethostbyname(). You should be using getaddrinfo() instead, and should have been for years now. The man page even warns you of this. The gethostbyname*(), gethostbyaddr*(), herror(), and hstrerror() functions are obsolete. Applications should use getaddrinfo(3), getnameinfo(3), and gai_strerror(3) instead. Here is a quick sample program in C ...


0

If country-level granularity is sufficient for you, then you can simply rely on whois. Don't query whois for every single client IP address you see. When you do see a new IP and query whois, then cache the range such that future requests for IP addresses in that range do not touch whois. If you get no response from whois, then don't try to use whois for the ...


0

boot into rescue mode mount root filesystem (if not already mounted) restore old ssh config or fix your mistakes (in your rootfs, not the one from rescue system e.g /some/mount/point/etc/ssh/sshd_config) reboot into regular mode profit ;)


0

I'm sure you've solved your issue at some point in the past four years since this post was begun, but I ended up here trying to find a solution to starting nginx on a systemd-enabled CentOS 7 system with similar issues, so perhaps this will help others. My nginx would come up before networking for both IPv4 and IPv6 was up, causing it to fail to start and ...


0

The nginx was not restarting properly. I killed manually all the nginx process and restarted the service.


13

Such preferences can be expressed using SRV records. Unfortunately those are not supported for HTTP. So you are left with a situation where the client alone is making the choice between IPv4 and IPv6. Many clients use the roundtrip time of SYN + SYN-ACK to decide which of the two to use. So by slowing down the sending of a SYN-ACK packet on IPv6, you can ...


23

IPv6/IPv4 preference is determined by the initiator of a connection, i.e. the web browser. The address selection rules are defined in RFC 6724. While these can be overridden, it is only by the user reconfiguring their operating system. The only way you can force someone to use IPv4 is to not offer IPv6 at all. Obviously this is not a practical solution even ...


0

The correct way to interpret your packet capture is that you're seeing dropped reply packets for both the A and AAAA record responses. The SOA record seems to be confusing you and is worth elaboration: The SOA record is actually in the authority section, not the answer section. NXDOMAIN means "there are no records that have that name". If there are other ...


1

Your DNS server appears to be buggy. Two requests are sent to the DNS server, but it sends only a single reply. The client does what clients are supposed to do in that case, it waits a short while and then retransmits the request. An initial delay of 5 seconds may be reasonable for non-interactive usage. But for interactive usage I would consider that to be ...


0

Here was my solution. By default Windows gives IPv6 routes a higher priority than IPv4 routes. If you edit the IPv6 prefix policy, you can change this behavior to make it use IPv4 in preference to IPv6. To make sure all the systems in my network are set up the same way, I put the following commands into a .bat script run during software installation after ...


0

After checking logs and wondering when this problem occures, it became evident after I contacted the helpdesk that the problem was caused by firewall blocking MLD / ICMPv6 type 130 packets. Normal IPv6 traffic just stops if that query isn't being responded to. Yet stuff like ICMPv6 ping still come through and after address is known also other traffic passes ...



Top 50 recent answers are included