koopa-admin-log/2026/2026-07-09--ipv6-15d6.md

2026-07-09 — IPv6 :15d6 reachability

Symptom

https://exchange.hacktivism.ch/config failed with ERR_ADDRESS_UNREACHABLE when clients preferred AAAA 2a02:168:53a8:0:d584:9e34:13cf:15d6. IPv4 212.51.151.254 worked (HTTP 200).

Path comparison

	IPv4	IPv6
Public endpoint	WAN IP DNAT	Host global :15d6
VeciGate	dstnat 443→9001	forward 443 (no NAT)
Host listener	Caddy :9001	https-proxy.socket :443 → 9001
firewalld needed	9001	443 (+ 80 for ACME)

Fix applied

# on koopa (root)
firewall-cmd --permanent --zone=public --add-port=443/tcp
firewall-cmd --reload

VeciGate: confirmed IPv6 filter allow 443; added explicit allow 80 for ACME.

Verify

curl -6 -sS -o /dev/null -w '%{http_code} %{remote_ip}\n' \
  https://exchange.hacktivism.ch/config
# 200 2a02:168:53a8:0:d584:9e34:13cf:15d6