34 lines
914 B
Markdown
34 lines
914 B
Markdown
# 2026-07-09 — IPv6 `:15d6` reachability
|
|
|
|
## Symptom
|
|
|
|
`https://exchange.hacktivism.ch/config` failed with `ERR_ADDRESS_UNREACHABLE`
|
|
when clients preferred AAAA `2a02:168:53a8:0:d584:9e34:13cf:15d6`.
|
|
IPv4 `212.51.151.254` worked (HTTP 200).
|
|
|
|
## Path comparison
|
|
|
|
| | IPv4 | IPv6 |
|
|
|--|------|------|
|
|
| Public endpoint | WAN IP DNAT | Host global `:15d6` |
|
|
| VeciGate | dstnat 443→9001 | forward 443 (no NAT) |
|
|
| Host listener | Caddy `:9001` | `https-proxy.socket` `:443` → 9001 |
|
|
| firewalld needed | 9001 | **443** (+ 80 for ACME) |
|
|
|
|
## Fix applied
|
|
|
|
```bash
|
|
# on koopa (root)
|
|
firewall-cmd --permanent --zone=public --add-port=443/tcp
|
|
firewall-cmd --reload
|
|
```
|
|
|
|
VeciGate: confirmed IPv6 filter allow 443; added explicit allow **80** for ACME.
|
|
|
|
## Verify
|
|
|
|
```bash
|
|
curl -6 -sS -o /dev/null -w '%{http_code} %{remote_ip}\n' \
|
|
https://exchange.hacktivism.ch/config
|
|
# 200 2a02:168:53a8:0:d584:9e34:13cf:15d6
|
|
```
|