# 2026-07-09 — IPv6 `:15d6` reachability

## Symptom

`https://exchange.hacktivism.ch/config` failed with `ERR_ADDRESS_UNREACHABLE`
when clients preferred AAAA `2a02:168:53a8:0:d584:9e34:13cf:15d6`.
IPv4 `212.51.151.254` worked (HTTP 200).

## Path comparison

| | IPv4 | IPv6 |
|--|------|------|
| Public endpoint | WAN IP DNAT | Host global `:15d6` |
| VeciGate | dstnat 443→9001 | forward 443 (no NAT) |
| Host listener | Caddy `:9001` | `https-proxy.socket` `:443` → 9001 |
| firewalld needed | 9001 | **443** (+ 80 for ACME) |

## Fix applied

```bash
# on koopa (root)
firewall-cmd --permanent --zone=public --add-port=443/tcp
firewall-cmd --reload
```

VeciGate: confirmed IPv6 filter allow 443; added explicit allow **80** for ACME.

## Verify

```bash
curl -6 -sS -o /dev/null -w '%{http_code} %{remote_ip}\n' \
  https://exchange.hacktivism.ch/config
# 200 2a02:168:53a8:0:d584:9e34:13cf:15d6
```