0

We have an Apache server running, where it serves well any IPV4 address, but all access from IPV6 is blocked with "403 Forbidden". Any possible most likely causes to that?

EDIT

Thanks for the directions below.

I just checked which conf files there are for the httpd server.

This is the list below.

They all include a single LoadModule to a corresponding .so file, nothing out of the ordinary, except for the limitip one which has:

<IfModule limitipconn_module>
  MaxConnPerIP 30
  CustomLog /var/lcfg/log/apacheconf.ipdenied combinedsite env=LIMITIP
</IfModule>

which I don't think is related.

There is also this bit somewhere:

# Apache 2.4 defaults to a more strict "default deny", so you have
# to be more explicit about which bits should be accessible.
<IfVersion >= 2.4 >
<Directory [path-to-html-files]>
  Require all granted
</Directory>
</IfVersion>

Maybe I need to change the "Require all granted" to something else that include IPv6?

All other configuration is absorbed from the original configuration files that came with the Apache server, it seems.

access_compat.conf   authn_dbm.conf        autoindex.conf   env.conf          logio.conf        setenvif.conf          unique_id.conf
access_compat.conf~  authn_file.conf       cache.conf       expires.conf      mime.conf         slotmem_plain.conf     unixd.conf
actions.conf         authn_socache.conf    cache_disk.conf  ext_filter.conf   mime_magic.conf   slotmem_shm.conf       userdir.conf
alias.conf           authz_core.conf       cgi.conf         filter.conf       mpm.conf          socache_dbm.conf       version.conf
allowmethods.conf    authz_dbm.conf        data.conf        headers.conf      negotiation.conf  socache_memcache.conf  vhost_alias.conf
auth_basic.conf      authz_groupfile.conf  deflate.conf     include.conf      php5.conf         socache_shmcb.conf     waklog.conf
auth_digest.conf     authz_host.conf       dir.conf         info.conf         remoteip.conf     status.conf
authn_anon.conf      authz_owner.conf      dumpio.conf      limitipconn.conf  reqtimeout.conf   substitute.conf
authn_core.conf      authz_user.conf       echo.conf        log_config.conf   security2.conf    systemd.conf
1
  • 1
    It's not really possible to diagnose without seeing the configuration. But first guess would be to check the access control. It might be configured to allow some IPs and not others. If it lacks IPv6 configuration, clients might get rejected. It's best to check the error logs and see what's reported. – Philip Couling Apr 24 '19 at 15:38
0

Check for vhosts and see if the ip6 address is used.

NameVirtualHost 192.168.1.13:80 NameVirtualHost 192.168.1.13:443

NameVirtualHost [fd00::021e:2aff:fe49:522c]:80 NameVirtualHost [fd00::021e:2aff:fe49:522c]:443

ServerAdmin root@robkalmeijer.nl ServerName server3.robkalmeijer.nl

Yhis works for me.

4
  • NameVirtualHost is deprecated and has no effect in Apache >=2.3.11. Any VirtualHost with ip and port will do. – Freddy Apr 24 '19 at 20:03
  • This is what I could found and it still works. Do you mean you can remove those lines? I use multiple subdomains on 1 ip address. – Rob Kalmeijer Apr 26 '19 at 1:38
  • That's what the documentation says, so I would guess that's right. If you run apachectl configtest there should be a line like this: NameVirtualHost has no effect and will be removed in the next release /etc/apache2/sites-enabled/000-default.conf:1 Syntax OK. – Freddy Apr 26 '19 at 5:23
  • I had some trouble with apache vhosts, but NameVirtualHost gave no error. httpd -S shows your vhosts. – Rob Kalmeijer Apr 27 '19 at 18:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.