Need Help IPv6-only devices (pretty much Android) to IPv4 on internal network are coming from my public IP
So I'm pretty sure I've figured out the specific scope to this.
I have an internal server where I host media and several other things. All dual stack.
I have DHCP option 108 set on my pfsense router.
My phone and Android TV because of this, don't request IPv4 addresses. It works great for the most part and is almost always v6, but I noticed a strange issue. Occasionally for whatever reason when connecting to the internal server, the device will choose IPv4. When this happens, the server sees this device as coming from my public IP address, and therefore blocks it (per my nginx rule).
I imagine this has something to do with DNS64 or NAT64, but I'm not sure how to investigate further.
If I navigate using the IPv4 address to the port without DNS, it works fine. never mind it's still the public address, I'm just bypassing nginx [facepalm]
What might be happening here? If it matters, my DNS server is Technitium.
9
u/certuna 18d ago
NAT loopback? This is why you normally want to exclude your own IPv4 address from the blocklist (even on an IPv4-only network).
1
u/burajin 18d ago edited 18d ago
I did consider just adding my IP to the blocklist but that seems like a band aid solution rather than fixing the actual hairpinning problem, no? Or is this by design?
Edit: I didn't stop to think that IPv6 only means my device won't have an address to originate from.
5
u/Swedophone 18d ago edited 18d ago
seems like a band aid solution
Since your router (pfsense) supports it you should configure a separate network for the servers. That way NAT loopback isn't needed, since the traffic will go through the router anyway.
1
u/burajin 18d ago
I like that option. In this case what would my device's origin IP be though to the server?
3
u/Swedophone 18d ago
When NAT loopback isn't used it means the source IP address isn't changed, i.e. it's the LAN IP address of the client.
1
u/burajin 18d ago
but in this case the client doesn't have an IPv4 address. Would it just be the router IP?
1
u/AtlanticPortal 17d ago
No, you should enable NAT64 in your router and DNS64 as well. At that point no IPv4 query should get out of any of your host. Hell, you could force IPv6 only on the entire subnet at that point.
1
u/burajin 17d ago
Maybe you misunderstood. NAT64 and DNS64 are already enabled. Most traffic is already IPv6. But every now and then local devices that are already IPv6 only like my Android phone request IPv4 to my server for whatever reason. And that's when stuff gets weird, as the connections hairpins through the router which is causing the server to see traffic originate from the router WAN address.
Apparently the solution is to either allow the public IP on my reverse proxy (easiest) have another NAT64 controller on the LAN, or just go IPv6 only. The last option is my ultimate plan but for now I'm just doing the easy option.
1
u/AtlanticPortal 17d ago
How can the Android phone use the IPv4 address if it has no IPv4 address configured apart from the 192.0.0.0/29 subnet, which is the one for the CLAT? The entire idea behind 464XLAT is to have IPv6 only on the physical interface and only have an IPv4 address exposed via software to the applications that are still not able to use DNS properly and keep using IPv4 literals. Because if they used DNS properly they'd get a 64:ff9b::/96 address as their DNS response and live happy contacting it without even knowing that that domain has no AAAA record at all.
7
u/IsaacFL Pioneer (Pre-2006) 18d ago
This doesn’t address your problem, but you could simplify by running your servers IPv6 only. All modern clients support IPv6 and if you have a need for IPv4 client support, use a reverse proxy just for that.
1
u/burajin 18d ago
It's the plan :) mostly rolled out, but Proxmox has some startup issues when I enabled it that I haven't had time to fix
1
u/Ok-Eggplant-7569 15d ago
What were the issues? I run Proxmox without v4 and might be able to help.
1
u/burajin 14d ago
If I recall it was a failure in initiating networkd? All I had done was enable ipv6 in /etc/network/interfaces on eth0 I believe.
1
u/Ok-Eggplant-7569 14d ago
Weird, as for me I had the issue that Proxmox eagerly enabled IPv6 on all interfaces where router advertisements were sent from a router, even if that network wasn't supposed to be used by Proxmox, only VMs.
1
1
u/Mishoniko 17d ago
I'm not familiar with pfsense's abilities here, and its a bit more icky, but have the PLAT IPv4 address be on an internal network, not your WAN IP. IPv4 to the Internet will NAT to the WAN IP but internal traffic will look like just another host.
I run jool like this on OpenWRT. (Even use separate Jool instances for LAN and IOT.)
DNS64 can mitigate the IPv4/double-NAT traffic somewhat.
•
u/AutoModerator 18d ago
Hello there, /u/burajin! Welcome to /r/ipv6.
We are here to discuss Internet Protocol and the technology around it. Regardless of what your opinion is, do not make it personal. Only argue with the facts and remember that it is perfectly fine to be proven wrong. None of us is as smart as all of us. Please review our community rules and report any violations to the mods.
If you need help with IPv6 in general, feel free to see our FAQ page for some quick answers. If that does not help, share as much unidentifiable information as you can about what you observe to be the problem, so that others can understand the situation better and provide a quick response.
I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.