0

I'm currently trying to access a computer, over an OpenVPN tunnel, by addressing it on IPv6. I've also registered an A and AAAA record on my private DNS server. On both sides of the tunnel, I want to still be able to run IPv4. The reason is that I rely on DHCP + PXE a lot and have quite a few legacy devices that aren't EFI, and I would like to still address these by the same FQDN. What I don't want, is to be able to route IPv4 over the tunnel, I managed this by not creating an IPv4 route for the tunnel; only for IPv6

Long story short, I'm fully able to ping6 the computer on the other end of the tunnel, as well as SSH'ing on the IPv6 address.

However, what does not seem to work (as expected) is to prefer IPv6 when using DNS. I noticed both records get returned, but there's no program that seems to prefer the IPv6 AAAA-record, they all want to use the IPv4 address (only when I'm lucky, the application will retry using the AAAA-record with the gift of 60 seconds timeout). I always thought that IPv6 is preferred if my network supports it. Perhaps I have misconfigured my system?

I have tried to re-order my DNS records, hoping

Details

  • OS: CentOS 7
  • DNS-sofware: BIND9
  • IPv6: 2000::/48
  • IPv6 route for 2000::/48 to tunnel created and working as expected
  • A and AAAA records created and working
Improve this question
4
  • Does this answer over at SuperUser.SE help?
    – Rob
    Sep 5, 2018 at 20:28
  • You need to use real IPv6 addresses, not fake ones. Also, check your machine for a file /etc/gai.conf. If it exists, delete it.
    – Michael Hampton
    Sep 5, 2018 at 21:53
  • Hi Rob, thank you for the referred issue, but I already have an IPv6 route towards my tunnel. Michael Hampton, I don't fully understand the "you need to use real IPv6 addresses, not fake ones"? My IPv6 addresses that I set are using EUI-64 (so use the mac as basis) with 2000:: as prefix. I don't have a gai.conf, I thought this was going to be the culprit but since it's not there... Could it be that my system fails to prefer IPv6 because there's no default route for my IPv6 data? (the remainder of my network isn't IPv6 compatible so it didn't make sense to me at the time)
    – Xabre
    Sep 6, 2018 at 7:02
  • maybe I'm completely on a limb here but, would it be possible to prevent my Bind9 to slave to simply ignore all request for A-records and only return AAAA-records?
    – Xabre
    Sep 6, 2018 at 22:42

1 Answer 1

Reset to default
0

So, turns out I'm an idiot. I actually created a subnet in the 2000:: range, which is public. It seems some clever things are happening in the back to check if this address is reachable before preferring it (at least, that my observation, not sure about the internals of this). If I changed this to be in the fd00::/8 range, all seems to work as expected.

I hope this answer might help others who didn't read up (enough) on IPv6 like me and just trial-and-error'ed away.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.