IPv6 and /etc/resolv.conf

[johnpoz]

@JonathanLee well couple things I notice about what you listed there with your 409 errors. They are all cnames, and they have round robin answers on the cname, ie multiple IPs.

And can tell you right now that foxnews one is never going to work because it doesn't have a IPv6 address. So no if trying to do IPv6 with that its never going to work..

My opinion with IPv6 and proxy, just like normal IPv6 is its not really ready for prime time.. There are vast amounts of major player sites that don't even have IPv6 versions. Your going to run into issues - how the client normally handles it is dual stacked, and something that doesn't have IPv6 it uses IPv4.. it makes the switch on its own.. etc..

When doing splice you can have issues with when the host name not matching, etc..

You could also be running into issues with browser doing doh on its own.. And getting different responses for dns, etc..

https://docs.netgate.com/pfsense/en/latest/troubleshooting/squid.html#sites-not-loading-with-splice-error-409-in-access-log

Personally I wouldn't if you really want to proxy, even allow clients to use IPv6.. Its not like its a requirement or anything.. Can you name one major resource that requires IPv6? Just 1?? Not talking about some guys personal website he is hosting only on ipv6 because his isp doesn't have IPv4 address space to give to clients or they use cgnat, etc.

[Gertjan]

@johnpoz said in IPv6 and /etc/resolv.conf:

Can you name one major resource that requires IPv6? Just 1??

Let me think .... => got it : Humanity !?!

[JonathanLee]

Thanks for the clarification because it works perfectly with dual stack. This was more of a can I make some clients only IPv6. But when in dual stack it only works IPv4 clients to IPv6 sites and never IPv6 to IPv6. I enabled pure IPv6 and Squid terminates with this error..

The error it shows when I activate IPv6 only mode not dual stack is

Error: no forward proxy ports configured

Squid terminated

The errors in the pcap act like they require a udp 443 I have DoH blocked for major DoH servers. Again that is like wack a mole. The IPv6 only works once the proxy is removed. So the error is isolated into Squid. I have tested old packages and knew they seem to have the same issues. I was reading it might require SLLAC enabled and I currently have it set to managed. I might test this out today. Goal is to have it work with IPv6 only mode and proxy traffic.

Some users also added this to the configuration.

acl localnet src fc00::/7
acl localnet src fe80::/10

[johnpoz]

@Gertjan said in IPv6 and /etc/resolv.conf:

Humanity

hahaah - yeah I agree ipv6 is the future, etc. Problem is now that all the mobile stuff has been moved over to IPv6.. Stuff where there are billions of clients, etc. There is no financial push to move the rest.. You got some company that owns plenty of IPv4 space for their needs.. Why should should they move to IPv6, and not like they can just drop all their IPv4 space, etc.. There is no benefit for them - its money, its work, its time that they could be working on other things, etc..

Companies do not just invest in moving to something new, unless they are going to get something out of it.. Which currently that something is not really there other than they could get off the no IPv6 shame list ;)

My isp doesn't even offer IPv6 - and I have not heard any sort of even hint that its down the road, etc..

[JonathanLee]

If I enable SLLAC I have to make new ACLs because devices all create temp addresses over managed it gets my assigned IPv6 no change with testing same result. IPv6 only ->to IPv6 sites nothing works no sites.

[JonathanLee]

@johnpoz @Gertjan if you want to check out the pcap file it just says conflict

I do block DoH on known major players like wack a mole. So ignore that and QUIC is also blocked HTTP3. Thus DoH over HTTP3 is also blocked.

Outside of that it should work right?

It acts like the firewall can't respond to clients backwards

<---The 007 File Is now Gone--->

Client we are looking at is

2001:xxx.xxxx:a:192:168:1:5 ----> accessing [2001:xxx:xxxx:a:192:168:1:1]:3128

That is the IPv6 only client it can't get web traffic with it set to use the IPv6 proxy ran same in pfSense Plus 24.03 and 23.05(my favorite version) they all do the same thing with Squid 6.6(version with security fixes) and or Squid 5.8 (old working version that has status page)

WARNING THIS MESSAGE WILL SELF DESTRUCT AFTER YOU READ THE PCAP

Please reply when you look at this so I can delete this file

[johnpoz]

@JonathanLee yeah that seems to this

https://www.squid-cache.org/Doc/config/host_verify_strict/

[JonathanLee]

@johnpoz I never enabled that, maybe it is on by default for IPv6...

[JonathanLee]

@johnpoz turned if off same results

[JonathanLee]

@johnpoz
Maybe it’s because it’s HE tunnel and Squid doesn’t know what to do with the connections that connect to the IPv6 interface address?

Does it require

acl localnet src fc00::/7
acl localnet src fe80::/10

[JonathanLee]

@johnpoz Do you have any other ideas, I have it set to listen on ipv6 and ipv4 I can see it bind to my interface on both addresses but if a machine connects to the proxy with an ipv6 source address the proxy gives a 409 error. Everything else works, this is in HE tunnel broker configuration, I see states that get established, again ipv6 does not do nat but I would assume that if it has the option to listen on ipv6 addresses that it would proxy the addresses, if I put the machine on the guest network without the proxy the system functions, so I know my IPV6 only settings on the side of HE tunnel work. What am I missing, I also configured tcp outgoing testing with the ipv6 for ipv6 and that was the same thing, so I turned it back to outgoing auto. I know it supports it per the Squid website, I also tried to do a http_port :: 3128 test same thing. I just wonder what is causing squid to not proxy ipv6 traffic I have tested in all transparent and non-transparent with ssl intercept.

Any ideas? Thanks again for working with me on getting me comfortable with ipv6, I just feel there is something I am missing for the proxy.

I have not tested this

#acl localnet src fc00::/7 # RFC 4193 local private network range
#acl localnet src fe80::/10 # RFC 4291 link-local (directly plugged) machines

Have you ever had it configured where ipv6 source addresses work? I have it working when it is ipv4 going to say ipv6.google.com the proxy sees the address source is my local machine ipv4 destination ipv6 and it connects, my ipv6 tests work, but if anything is a source of ipv6 it fails.