IPv6 and /etc/resolv.conf

Gertjan

@johnpoz said in IPv6 and /etc/resolv.conf:

Can you name one major resource that requires IPv6? Just 1??

Let me think .... => got it : Humanity !?!

JonathanLee

Thanks for the clarification because it works perfectly with dual stack. This was more of a can I make some clients only IPv6. But when in dual stack it only works IPv4 clients to IPv6 sites and never IPv6 to IPv6. I enabled pure IPv6 and Squid terminates with this error..

The error it shows when I activate IPv6 only mode not dual stack is

Error: no forward proxy ports configured

Squid terminated

The errors in the pcap act like they require a udp 443 I have DoH blocked for major DoH servers. Again that is like wack a mole. The IPv6 only works once the proxy is removed. So the error is isolated into Squid. I have tested old packages and knew they seem to have the same issues. I was reading it might require SLLAC enabled and I currently have it set to managed. I might test this out today. Goal is to have it work with IPv6 only mode and proxy traffic.

Some users also added this to the configuration.

acl localnet src fc00::/7
acl localnet src fe80::/10

johnpoz

@Gertjan said in IPv6 and /etc/resolv.conf:

Humanity

hahaah - yeah I agree ipv6 is the future, etc. Problem is now that all the mobile stuff has been moved over to IPv6.. Stuff where there are billions of clients, etc. There is no financial push to move the rest.. You got some company that owns plenty of IPv4 space for their needs.. Why should should they move to IPv6, and not like they can just drop all their IPv4 space, etc.. There is no benefit for them - its money, its work, its time that they could be working on other things, etc..

Companies do not just invest in moving to something new, unless they are going to get something out of it.. Which currently that something is not really there other than they could get off the no IPv6 shame list ;)

My isp doesn't even offer IPv6 - and I have not heard any sort of even hint that its down the road, etc..

JonathanLee

If I enable SLLAC I have to make new ACLs because devices all create temp addresses over managed it gets my assigned IPv6 no change with testing same result. IPv6 only ->to IPv6 sites nothing works no sites.

JonathanLee

@johnpoz @Gertjan if you want to check out the pcap file it just says conflict

I do block DoH on known major players like wack a mole. So ignore that and QUIC is also blocked HTTP3. Thus DoH over HTTP3 is also blocked.

Outside of that it should work right?

It acts like the firewall can't respond to clients backwards

<---The 007 File Is now Gone--->

Client we are looking at is

2001:xxx.xxxx:a:192:168:1:5 ----> accessing [2001:xxx:xxxx:a:192:168:1:1]:3128

That is the IPv6 only client it can't get web traffic with it set to use the IPv6 proxy ran same in pfSense Plus 24.03 and 23.05(my favorite version) they all do the same thing with Squid 6.6(version with security fixes) and or Squid 5.8 (old working version that has status page)

WARNING THIS MESSAGE WILL SELF DESTRUCT AFTER YOU READ THE PCAP

Please reply when you look at this so I can delete this file

johnpoz

@JonathanLee yeah that seems to this

https://www.squid-cache.org/Doc/config/host_verify_strict/

JonathanLee

@johnpoz I never enabled that, maybe it is on by default for IPv6...

JonathanLee

@johnpoz turned if off same results

JonathanLee

@johnpoz
Maybe it’s because it’s HE tunnel and Squid doesn’t know what to do with the connections that connect to the IPv6 interface address?

Does it require

acl localnet src fc00::/7
acl localnet src fe80::/10

JonathanLee

@johnpoz Do you have any other ideas, I have it set to listen on ipv6 and ipv4 I can see it bind to my interface on both addresses but if a machine connects to the proxy with an ipv6 source address the proxy gives a 409 error. Everything else works, this is in HE tunnel broker configuration, I see states that get established, again ipv6 does not do nat but I would assume that if it has the option to listen on ipv6 addresses that it would proxy the addresses, if I put the machine on the guest network without the proxy the system functions, so I know my IPV6 only settings on the side of HE tunnel work. What am I missing, I also configured tcp outgoing testing with the ipv6 for ipv6 and that was the same thing, so I turned it back to outgoing auto. I know it supports it per the Squid website, I also tried to do a http_port :: 3128 test same thing. I just wonder what is causing squid to not proxy ipv6 traffic I have tested in all transparent and non-transparent with ssl intercept.

Any ideas? Thanks again for working with me on getting me comfortable with ipv6, I just feel there is something I am missing for the proxy.

I have not tested this

#acl localnet src fc00::/7 # RFC 4193 local private network range
#acl localnet src fe80::/10 # RFC 4291 link-local (directly plugged) machines

Have you ever had it configured where ipv6 source addresses work? I have it working when it is ipv4 going to say ipv6.google.com the proxy sees the address source is my local machine ipv4 destination ipv6 and it connects, my ipv6 tests work, but if anything is a source of ipv6 it fails.