Resolved Unable to connect to the server via IP6

[Kulturmensch]

Server operating system version

Ubuntu 20.04.6 LTS

Plesk version and microupdate number

Plesk Obsidian v18.0.52_build1800230502.13 os_Ubuntu 20.04

I just found out, that my server is no lnger reachable via IP6. IP4 works without any problems. I do not find errors in the system protocolls and also the config-files for the server include my ip6-address for different ports. This seems to be ok. Also the DNS entries for IP4 (A) and IP6 (AAAA) are correct for my domain.ltd

ping <hostname> finds my IP6-address but does not receive any response: Online Ping IPv6 - SubnetOnline.com :
4 packets transmitted, 0 received, 100% packet loss, time 2999ms

Any idea how I can find out what the problem is? Could it be a misconfiguration of the new firewall?

 

[Kaspar]

[...]
Any idea how I can find out what the problem is? Could it be a misconfiguration of the new firewall?

Could be. What have you done so far to troubleshoot the issue?

 

[sergej-wv]

Hello,

do check the IPs inside Tools and Settings -> IP Addresses. Press Reread IP and see whether the IP address is actually active. Check whether the firewall allows ICMP out and in. Also ping the address itself to see whether it is reachable.

 

[Peter Debik]

Has the firewall extension been updated to the latest version? Then that issue should be resolved. If not yet done, please update the extension. An alternative solution is to add the full port range 1 - 65535 to the firewall restrictions.

 

[Kulturmensch]

Thank you for the qucik help. What have I done after the latest update of the firewall?
1. I used the new feature with GeoIP and blocked some countries.
2.I checked my IP addresses and switched the IP4 and the IP6 from dedicated to commen use and finally reread the IPs. Did not help.
3. I checked the DNS entries of my domain in Plesk and at Strato: both IPs are enabled at my server (Plesk) and at the Hoster
4. I checked the error-files - I did not find an error belonging to IP6
5. I checked the config-files of my server. Both IPs are configured.
6. I pinged my IP6 (2a01:238:430e:9400:f421:da1d:bef8:c802) from outside with Online Ping IPv6 - SubnetOnline.com : found my IP6 but did not receive any response: 4 packets transmitted, 0 received, 100% packet loss, time 2999ms
That is all what I have done so far.

 

[Peter Debik]

What version of the firewall extension do you have? It should be 2.0.2-352, is it?

 

[Kulturmensch]

What version of the firewall extension do you have? It should be 2.0.2-352, is it?

Yes, it is 2.0.2-352

 

[Kaspar]

My suggestion would be to first check if your own IP and your server ipv6 IP are not banned by fail2ban. If that's not the case you could try to temporary disable the firewall and test if you can connect to your server afterwards. If can connect after disabling the firewall then the firewall was probably causing the issue. You can try enabling it again after you done testing. Perhaps disabling and enabling it solves the issue altogether.

 

[Kulturmensch]

Peter, I followed your recommendation and opened all ports for IP6/TCP. Now it works:


IPv6 Ping Output:
PING mail.tenckhoff.de(2a01:238:430e:9400:f421:da1d:bef8:c802 (2a01:238:430e:9400:f421:da1d:bef8:c802)) 32 data bytes
40 bytes from 2a01:238:430e:9400:f421:da1d:bef8:c802 (2a01:238:430e:9400:f421:da1d:bef8:c802): icmp_seq=1 ttl=57 time=13.8 ms
40 bytes from 2a01:238:430e:9400:f421:da1d:bef8:c802 (2a01:238:430e:9400:f421:da1d:bef8:c802): icmp_seq=2 ttl=57 time=13.7 ms
40 bytes from 2a01:238:430e:9400:f421:da1d:bef8:c802 (2a01:238:430e:9400:f421:da1d:bef8:c802): icmp_seq=3 ttl=57 time=13.8 ms
40 bytes from 2a01:238:430e:9400:f421:da1d:bef8:c802 (2a01:238:430e:9400:f421:da1d:bef8:c802): icmp_seq=4 ttl=57 time=13.8 ms

--- mail.tenckhoff.de ping statistics ---
4 packets transmitted, 4 received, 0% packet loss, time 3005ms
rtt min/avg/max/mdev = 13.787/13.840/13.896/0.125 ms

 

[Kulturmensch]

I suppose, that this cannot be the final configuration as I opened all ports for IP6. But we found out, that is a firwall matter.

 

[Kulturmensch]

ipv6 IP are not banned by fail2ban

I checked fail2ban. My IP6 is already on the whitelist. So, fail2ban was not the reason.

 

[Kulturmensch]

A little bit-and-byte-wonder appeared. I just removed the new firewall-rule concerning IP6. Applied this change again to the firewall and .... my domain continues to be reachable by the IP6-address. Thank you all for guideing me to this solution!