2

I'm trying to work out how to connect an inbound IPv4 connection to a port listening on a IPv6 port on a CentOS box.

To demonstrate on a vanilla CentOS 7 server:

  1. Confirm bindV6only is disabled
   $ cat /proc/sys/net/ipv6/bindv6only
   0
  1. Run netcat listening on a IPv6 port
   nc -lvn6p 80
  1. On another shell, attempt to telnet to the port via IPv4
   telnet 127.0.0.1 80

Trying 127.0.0.1... telnet: connect to address 127.0.0.1: Connection refused

Further information

  • Trying to connect via IPv6 works as expected. e.g. telnet ::1 80
  • However everything I'm reading suggests that Linux-based IPv6 sockets should accept IPv4 connections too if net.ipv6.bindv6only is disabled in sysctl, which it is.
  • I've tried Socket CAT, it works but isn't an elegant solution and requires a separate service to be configured. e.g.
socat TCP4-LISTEN:80,reuseaddr,fork TCP6:[::1]:80

ref: https://sysctl-explorer.net/net/ipv6/bindv6only/

ref: https://stackoverflow.com/questions/6343747/ipv6-socket-creation

2

1 Answer 1

4

I don't know if this is your problem, but running yum install nc on centos 7 will install nmap-ncat, which does set the SOL_IPV6/IPV6_V6ONLY socket option itself on ipv6 sockets:

# strace -e trace=setsockopt nc -lvn6p 80
Ncat: Version 7.50 ( https://nmap.org/ncat )
setsockopt(3, SOL_SOCKET, SO_REUSEADDR, [1], 4) = 0
setsockopt(3, SOL_IPV6, IPV6_V6ONLY, [1], 4) = 0
Ncat: Listening on :::80

If you omit the -6 and -4 options, it will bind two different ipv6 and ipv4 sockets:

# strace -e trace=bind,setsockopt nc -lvnp 80
Ncat: Version 7.50 ( https://nmap.org/ncat )
setsockopt(3, SOL_SOCKET, SO_REUSEADDR, [1], 4) = 0
setsockopt(3, SOL_IPV6, IPV6_V6ONLY, [1], 4) = 0
bind(3, {sa_family=AF_INET6, sin6_port=htons(80), inet_pton(AF_INET6, "::", &sin6_addr), sin6_flowinfo=0, sin6_scope_id=0}, 28) = 0
Ncat: Listening on :::80
setsockopt(4, SOL_SOCKET, SO_REUSEADDR, [1], 4) = 0
bind(4, {sa_family=AF_INET, sin_port=htons(80), sin_addr=inet_addr("0.0.0.0")}, 16) = 0
Ncat: Listening on 0.0.0.0:80

Apparently, the nmap people aren't great fans of the dual-stack sockets feature of Linux ;-)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .