I have this situation where Apache is listening on :::443 only on a Linux host that has both IPv6 and IPv4 enable.

I can access the content served by that Apache from IPV4 only enabled computer.

Can someone help me understand what's happening, and how to verify this configuration on a Linux host (CentOS in my case)

I read somewhere that

[...] servers bind to IPv6 addresses (on all interfaces or on a specific one, if needed) and treat IPv4 as mapped ones because IPv6 and IPv4 share the same port space on the same machine. This works transparently thanks to glibc and is a recommended way to write networking applications. See man ipv6(7) for details.

I'd guess this means the only way this could happen would be with Ipv4 mapped address. However I can't get this working with ping6 ::ffff: or to my public IPv4 address. Besides I don't see any config that would support this when looking at ip a

  • 2
    You cannot use IPv4-mapped Addresses (::ffff:0:0/96) as source or destination addresses, they are not forwardable (routable), nor globally reachable, and they are reserved by the IPv6 protocol, itself; see IANA IPv6 Special-Purpose Address Registry. Basically, you can use those addresses to store IPv4 addresses in a common format with IPv6 addresses, e.g. a database. – Ron Maupin Nov 20 '19 at 21:37

You can tell these are in use when ss output shows sockets with mapped addresses.

From ipv6(7)

IPv4 connections can be handled with the v6 API by using the v4-mapped-on-v6 address type; thus a program needs to support only this API type to support both protocols. This is handled transparently by the address handling functions in the C library.

Note "transparently". You don't give programs v4 mapped v6 addresses, you give them v4 addresses.

Socket option IPV6_V6ONLY defaults to v6 listening to v4 mapped v6, per the default of /proc/sys/net/ipv6/bindv6only.

This behavior is platform specific. Notably, it is a peculiarity of Linux.

  • Note that I find this incredibly good and convenient. It's just that I got used to read netstat to understand what was listening to what, usually making sure services were listening to both ipv4 and ipv6. I just don't understand how this work. If a service is not listening on a port on ipv4, how the hell can the listener for ipv6 receives ipv4? This incidently also means that there no point for sshd for instance to listen to both stack as it usually does. I guess it's a matter of compatibility with older system. – coolnodje Nov 21 '19 at 9:20
  • I was not able to "see" anything about mapped address with ss. Just says [::]:443 the same way netstat does. – coolnodje Nov 21 '19 at 9:21
  • Test by connecting to a service over both v4 and v6. If both are successful, you have the configuration correct. This functional test also will detect problems above layer 4. – John Mahowald Nov 21 '19 at 14:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.