0

I'm running debian 8 on my server. Recently, the server starting only using IPv6 for all outgoing TCP connections. It still accepts IPv4 for incoming connections, however.

Because of this, I can't access any web sites (port 80), make any ssh connections (port 22), nor access any other outgoing host via any TCP port from my server now.

I completely disabled all iptables rules via iptables -F followed by iptables -X, and the problem persists.

Here are some command outputs which might be pertinent:

% sudo ip address
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: dummy0: <BROADCAST,NOARP> mtu 1500 qdisc noop state DOWN group default qlen 1000
    link/ether aa:bf:5c:77:b2:82 brd ff:ff:ff:ff:ff:ff
3: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
    link/ether f2:3c:91:96:da:28 brd ff:ff:ff:ff:ff:ff
    inet 45.33.123.70/24 brd 45.33.123.255 scope global eth0
       valid_lft forever preferred_lft forever
    inet 45.33.5.47/24 scope global eth0:1
       valid_lft forever preferred_lft forever
    inet 192.168.135.4/17 scope global eth0:2
       valid_lft forever preferred_lft forever
    inet6 2600:3c00::f03c:91ff:fe96:da28/64 scope global mngtmpaddr dynamic 
       valid_lft 87sec preferred_lft 27sec
    inet6 fe80::f03c:91ff:fe96:da28/64 scope link 
       valid_lft forever preferred_lft forever
4: teql0: <NOARP> mtu 1500 qdisc noop state DOWN group default qlen 100
    link/void 
5: tunl0@NONE: <NOARP> mtu 1480 qdisc noop state DOWN group default qlen 1000
    link/ipip 0.0.0.0 brd 0.0.0.0
6: gre0@NONE: <NOARP> mtu 1476 qdisc noop state DOWN group default qlen 1000
    link/gre 0.0.0.0 brd 0.0.0.0
7: gretap0@NONE: <BROADCAST,MULTICAST> mtu 1476 qdisc noop state DOWN group default qlen 1000
    link/ether 00:00:00:00:00:00 brd ff:ff:ff:ff:ff:ff
8: erspan0@NONE: <BROADCAST,MULTICAST> mtu 1464 qdisc noop state DOWN group default qlen 1000
    link/ether 00:00:00:00:00:00 brd ff:ff:ff:ff:ff:ff
9: ip_vti0@NONE: <NOARP> mtu 1480 qdisc noop state DOWN group default qlen 1000
    link/ipip 0.0.0.0 brd 0.0.0.0
10: ip6_vti0@NONE: <NOARP> mtu 1364 qdisc noop state DOWN group default qlen 1000
    link/tunnel6 :: brd ::
11: sit0@NONE: <NOARP> mtu 1480 qdisc noop state DOWN group default qlen 1000
    link/sit 0.0.0.0 brd 0.0.0.0
12: ip6tnl0@NONE: <NOARP> mtu 1452 qdisc noop state DOWN group default qlen 1000
    link/tunnel6 :: brd ::
13: ip6gre0@NONE: <NOARP> mtu 1448 qdisc noop state DOWN group default qlen 1000
    link/gre6 00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00 brd 00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00

% sudo route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         45.33.123.1     0.0.0.0         UG    0      0        0 eth0
45.33.5.0       0.0.0.0         255.255.255.0   U     0      0        0 eth0
45.33.123.0     0.0.0.0         255.255.255.0   U     0      0        0 eth0
192.168.128.0   0.0.0.0         255.255.128.0   U     0      0        0 eth0

I don't know what could have caused this change to IPv6-only on output. But in any case, I just want to go back to IPv4 for the default for all outgoing connections.

Thank you for any insights and suggestions.

2
  • Deleting the public IPv6 address 2600:3c00::f03c:91ff:fe96:da28/64 (according to whois it belongs to Linode) would probably get you going, but the real problem is how it got to be added to eth0 in the first place. May 22 at 15:12
  • Thank you! What command(s) should I run in order to delete that public IPv6 address from eth0? Yes, it's Linode. And I agree that the real problem is how that got added in the first place. I don't have any idea.
    – HippoMan
    May 22 at 15:14

3 Answers 3

2

Another method that might work would be to configure your machine to prefer IPv4. So it'll try IPv4 first but then try IPv6 if that fails.

This can be done in /etc/gai.conf

precedence ::ffff:0:0/96  100
scopev4 ::ffff:0.0.0.0/96       14

This tells the getaddrinfo() call to give priority to IPv4 results.

1

I take the "nuke it from orbit" approach when it comes to IPv6.

Add ipv6.disable=1 to your kernel options in /etc/default/grub then run update-grub and reboot:

GRUB_CMDLINE_LINUX_DEFAULT="... ipv6.disable=1"

Alternatively if you can't easily modify kernel parameters add this to your sysctl.conf or run sysctl to set manually:

net.ipv6.conf.all.disable_ipv6=1
net.ipv6.conf.default.disable_ipv6=1
1
  • Setting this sysctl parameters fixed my problem! Thank you!
    – HippoMan
    May 22 at 19:47
1

If you delete the public ip6 address you should be ok:

# ip address del 2600:3c00::f03c:91ff:fe96:da28/64 dev eth0

As to how it got there, it might be that their DHCP server (if you're getting addresses over DHCP) just started sending an IPv6 prefix.

You might want to tell your provider about it, beacause in the long run you do want to have IPv6 enabled.

4
  • This worked, as well as the suggestion by "CR.", above. I wish I could flag both of your answers as "the" answer! Thank you!
    – HippoMan
    May 22 at 19:48
  • PS: And I have asked my provider ("Linode") about whether they have recently started sending an IPv6 prefix recently via DHCP. If so, that could explain why this problem started occurring.
    – HippoMan
    May 22 at 20:07
  • Linode have supported IPv6 natively for quite a long time. linode.com/docs/guides/an-overview-of-ipv6-on-linode May 22 at 22:31
  • Yes, but Linode did not have SLAAC IPv6 enabled for my particular server, because it's running the old debian 8. After I asked them about the IPv6 prefix as I mentioned above, they came back and said that they did not have SLAAC IPv6 set for my server, and they now set it. This has totally fixed the problem.
    – HippoMan
    May 23 at 4:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.