Port forwarding and dual stack issues

[Ryan0751]

My pfSense Netgate box is on a dual-stack cable modem setup.

I have Dynamic DNS set up so that my hostname (pfsense.foo.com) has both valid and correct A and AAAA records for the IPv4 and IPv6 WAN IP's.

I have an IPv4 port forwarding rule that directs traffic on high port to an internal IPv4 SSH server (running on the standard port 22).

The issue is that if I try to ssh to the WAN IP on my pfSense box to get into my SSH server, and my remote client supports IPv6, of course the SSH client is trying to connect to the IPv6 WAN IP on my port forwarding high port.

The connection just sits there until the clients stack falls back to IPv4, and then things work wonderfully.  But it takes quite a long time (30s - 1m).

I COULD alter my hostnames to have separate IPv4 and IPv6 hostnames, but this seems a bit silly.  Is there a better way to fix this?

[JKnott]

Just create separate rules for IPv4 only and IPv6 only.  The IPv4 rule port forwards and IPv6 allows.

[Ryan0751]

Destinations aren't the same.

In the port forward case my WAN IPv4 address forwards to an internal IP, in the IPv6 case I don't want to "allow" SSH to the WAN IP.

[Ryan0751]

I think the easiest solution is to just force IPv4 with the client (ssh -4).  This avoids the long delay.