I have a Draytek router configured to port forward SSH connections to an internal server from specific ip addresses only. Clients and myself can connect externally successfully except one who cannot connect to our router's public static ip address but to its domain name only. router.domain.com Should the router even have a domain name assigned to it?? Not really sure why they can only connect to the domain name and not the ip - Advice appreciated
Based on the limited information in the question it is not possible to say for sure why connectivity using a hostname works but connecting to the very same server using an IP address does not work.
However I guess the most likely explanation is the client is depending on DNS64+NAT64 in order to connect to the server. Since IPv4 addresses ran out, deployments of various kinds of CGN solutions have become more common. One of them is DNS64+NAT64, and those has the limitation that clients cannot connect to IPv4 servers by IP address.
What will happen when such a client connects to an IPv4-only server is this:
- Client sends AAAA query for
- DNS64 server sends AAAA query for
- Authoritative server sends NOANSWER.
- DNS64 server sends A query for
- Authoritative server responds with
- DNS64 translates
- Client connects to NAT64 on address
- NAT64 translates
If the client is OpenSSH, you can use
ssh -v on the client side to see which IP address it is connecting to. If the server is IPv4 only, and the client connects to an IPv6 address when given the hostname, you will know that the client is depending on DNS64+NAT64.
Possible mitigations if you cannot connect to IP address due to NAT64:
- Enable IPv6 on the server and create an AAAA record alongside the current A record. The client can now connect directly to the IPv6 address of the server. This is the preferred method even if the client keeps using connections by hostname, because it will remove the dependency on the NAT64.
- Leave it as is. You said connections using the servers hostname works. So DNS64+NAT64 is working as intended and there is no immediate need to change anything. In most cases connections using a hostname is considered better practice than connecting directly to the IP address, so there is no real reason to stop using the hostname.
- Have the client connect using hostname once to learn the IPv6 address that the DNS64 mapped to, and then keep connecting through the NAT64 using this IPv6 address. (Works but seems a bit silly)
- Have the client use NAT464. This is a solution intended for the case where the client software only supports IPv4 but the client is connected to an IPv6-only access network. However if connections by hostname already works, then you don't need NAT464 and you are better off using one of the other solutions.