IPv6 dropped or Administratively prohibited for some servers

tharvik · 2023-11-12T12:54:46+00:00

Sunrise Community - Kunden helfen anderen Kunden rund um die Themen Fernsehen, Internet, Telefon und Mobile. Jetzt registrieren!

tharvik

Some IPv6 servers are unreachable since two weeks at least. Packets seems to be dropped, or sometimes ICMP is replied with “Administratively prohibited” by 2001:1700:100::1. One server reliably trigger that is perdu.com, here goes some traces

% ping -6 perdu.com
PING perdu.com(2606:4700:3033::6815:5b2 (2606:4700:3033::6815:5b2)) 56 data bytes
From 2001:1700:100::1 (2001:1700:100::1) icmp_seq=30 Destination unreachable: Administratively prohibited
From 2001:1700:100::1 (2001:1700:100::1) icmp_seq=66 Destination unreachable: Administratively prohibited
From 2001:1700:100::1 (2001:1700:100::1) icmp_seq=115 Destination unreachable: Administratively prohibited
From 2001:1700:100::1 (2001:1700:100::1) icmp_seq=125 Destination unreachable: Administratively prohibited
From 2001:1700:100::1 (2001:1700:100::1) icmp_seq=164 Destination unreachable: Administratively prohibited

Has you can see, many ICMP packets are dropped, but some get answered by a Sunrise node.

% curl -v6 perdu.com
*   Trying [2606:4700:3037::ac43:85b0]:80...
* connect to 2606:4700:3037::ac43:85b0 port 80 failed: Connection timed out
*   Trying [2606:4700:3033::6815:5b2]:80...
* connect to 2606:4700:3033::6815:5b2 port 80 failed: Connection timed out
* Failed to connect to perdu.com port 80 after 259754 ms: Couldn't connect to server
* Closing connection
curl: (28) Failed to connect to perdu.com port 80 after 259754 ms: Couldn't connect to server

# tcpdump host perdu.com
dropped privs to pcap
tcpdump: verbose output suppressed, use -v[v]... for full protocol decode
listening on wlp0s20f3, link-type EN10MB (Ethernet), snapshot length 262144 bytes
IP6 $my_ip.50874 > 2606:4700:3033::6815:5b2.http: Flags [S], seq 2050940123, win 64800, options [mss 1440,sackOK,TS val 3775205778 ecr 0,nop,wscale 7], length 0
IP6 $my_ip.50874 > 2606:4700:3033::6815:5b2.http: Flags [S], seq 2050940123, win 64800, options [mss 1440,sackOK,TS val 3775206834 ecr 0,nop,wscale 7], length 0
IP6 $my_ip.50874 > 2606:4700:3033::6815:5b2.http: Flags [S], seq 2050940123, win 64800, options [mss 1440,sackOK,TS val 3775208882 ecr 0,nop,wscale 7], length 0
IP6 $my_ip.50874 > 2606:4700:3033::6815:5b2.http: Flags [S], seq 2050940123, win 64800, options [mss 1440,sackOK,TS val 3775212914 ecr 0,nop,wscale 7], length 0
IP6 $my_ip.50874 > 2606:4700:3033::6815:5b2.http: Flags [S], seq 2050940123, win 64800, options [mss 1440,sackOK,TS val 3775221106 ecr 0,nop,wscale 7], length 0
IP6 $my_ip.50874 > 2606:4700:3033::6815:5b2.http: Flags [S], seq 2050940123, win 64800, options [mss 1440,sackOK,TS val 3775237490 ecr 0,nop,wscale 7], length 0
IP6 $my_ip.50874 > 2606:4700:3033::6815:5b2.http: Flags [S], seq 2050940123, win 64800, options [mss 1440,sackOK,TS val 3775269746 ecr 0,nop,wscale 7], length 0
IP6 $my_ip.49418 > 2606:4700:3037::ac43:85b0.http: Flags [S], seq 777863320, win 64800, options [mss 1440,sackOK,TS val 2499174144 ecr 0,nop,wscale 7], length 0
IP6 $my_ip.49418 > 2606:4700:3037::ac43:85b0.http: Flags [S], seq 777863320, win 64800, options [mss 1440,sackOK,TS val 2499175168 ecr 0,nop,wscale 7], length 0
IP6 $my_ip.49418 > 2606:4700:3037::ac43:85b0.http: Flags [S], seq 777863320, win 64800, options [mss 1440,sackOK,TS val 2499177217 ecr 0,nop,wscale 7], length 0
IP6 $my_ip.49418 > 2606:4700:3037::ac43:85b0.http: Flags [S], seq 777863320, win 64800, options [mss 1440,sackOK,TS val 2499181248 ecr 0,nop,wscale 7], length 0
IP6 $my_ip.49418 > 2606:4700:3037::ac43:85b0.http: Flags [S], seq 777863320, win 64800, options [mss 1440,sackOK,TS val 2499189505 ecr 0,nop,wscale 7], length 0
IP6 $my_ip.49418 > 2606:4700:3037::ac43:85b0.http: Flags [S], seq 777863320, win 64800, options [mss 1440,sackOK,TS val 2499205888 ecr 0,nop,wscale 7], length 0
IP6 $my_ip.49418 > 2606:4700:3037::ac43:85b0.http: Flags [S], seq 777863320, win 64800, options [mss 1440,sackOK,TS val 2499238144 ecr 0,nop,wscale 7], length 0

The TCP-SYN packets are never answered, as if theses were simply dropped.

When running theses outside of the network, on a remote server, I got

% ping -6 '2606:4700:3037::ac43:85b0'
PING 2606:4700:3037::ac43:85b0(2606:4700:3037::ac43:85b0) 56 data bytes
64 bytes from 2606:4700:3037::ac43:85b0: icmp_seq=1 ttl=56 time=20.0 ms
64 bytes from 2606:4700:3037::ac43:85b0: icmp_seq=2 ttl=56 time=20.2 ms
64 bytes from 2606:4700:3037::ac43:85b0: icmp_seq=3 ttl=56 time=20.5 ms
64 bytes from 2606:4700:3037::ac43:85b0: icmp_seq=4 ttl=56 time=20.2 ms
64 bytes from 2606:4700:3037::ac43:85b0: icmp_seq=5 ttl=56 time=20.5 ms

% curl -v6 http://perdu.com
*   Trying 2606:4700:3033::6815:5b2:80...
* Connected to perdu.com (2606:4700:3033::6815:5b2) port 80 (#0)
> GET / HTTP/1.1
> Host: perdu.com
> User-Agent: curl/7.81.0
> Accept: */*
> 
* Mark bundle as not supporting multiuse
< HTTP/1.1 200 OK
< Date: Sun, 12 Nov 2023 12:35:56 GMT
< Content-Type: text/html
< Transfer-Encoding: chunked
< Connection: keep-alive
< Last-Modified: Thu, 02 Jun 2016 06:01:08 GMT
< ETag: W/"cc-5344555136fe9-gzip"
< Cache-Control: max-age=600
< Expires: Sun, 12 Nov 2023 12:45:56 GMT
< Vary: Accept-Encoding,User-Agent
< CF-Cache-Status: DYNAMIC
< Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7DEE7yiY9oDZ6XjNWCHVcICvzTE2MZmi%2BNr8ZUGwuYSe4MRLodPGBHg%2BIiG0YBrYSzJ%2BlnNzcNLtYiI0bF76E8tAvI3zmivWEHQDGggq0WOYJ3c0yKCi20ikZ52LauzV3LkSnzN69wQ%3D"}],"group":"cf-nel","max_age":604800}
< NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
< Server: cloudflare
< CF-RAY: 824ed150b87cbaab-MXP
< alt-svc: h3=":443"; ma=86400
< 
<html><head><title>Vous Etes Perdu ?</title></head><body><h1>Perdu sur l'Internet ?</h1><h2>Pas de panique, on va vous aider</h2><strong><pre>    * <----- vous &ecirc;tes ici</pre></strong></body></html>
* Connection #0 to host perdu.com left intact

It’s not the case with some other servers, such as wikipedia.org, arin.net, google.com, in theses cases, every packets goes through.

FWIW, I’m directly using the box, connecting it to it via WiFi.

Daniele_Sunrise

tharvik Welcome to the community!

Do you need IPv6 or can your connection also be switched to IPv4?

Greetings
Daniele

tharvik

Daniele_Sunrise

Hello Daniele, thanks for the rapid answer.
No, I do need IPv6 connections as some of my servers are only reachable through it.

# traceroute -6I perdu.com
traceroute to perdu.com (2606:4700:3037::ac43:85b0), 30 hops max, 80 byte packets
 1  2a02:aa12:b105:b580:a605:d6ff:fe19:1278 (2a02:aa12:b105:b580:a605:d6ff:fe19:1278)  1.489 ms  1.598 ms  1.710 ms
 2  2a02:aa04:0:2b10::1 (2a02:aa04:0:2b10::1)  12.395 ms  17.943 ms  19.146 ms
 3  * * *
 4  ch-zrh03a-rc2-lo0-0.v6.aorta.net (2001:730:2c00::5474:801d)  25.072 ms  28.103 ms  28.097 ms
 5  * * *
 6  colozur.swissix.sunrise.ch (2001:7f8:24::2f)  28.067 ms  26.214 ms  26.191 ms
 7  * * *
 8  * * *
 9  * * *
10  * * *
11  * * *
12  * * *
13  * * *
14  * * *
15  * * *
16  * * *
17  * * *
18  * * *
19  * * *
20  * * *
21  * * *
22  * * *
23  * * *
24  * * *
25  * * *
26  * * *
27  * * *
28  * * *
29  * * *
30  * * *

As you can see, the pings got a fairly normal entering of the UPC network, then forwarded to swissix (a swiss IXP) but get’s blackholed somewhere after that.
I do think that this issue impacts all IPv6 users and not only my connection as it seems to be happening way after entering UPC/sunrise’s pipes.

tharvik

Daniele_Sunrise

Triggering the “administratively prohibited” response is hard as it only happens on average every 50 packets, the rest seemingly being dropped, but I managed to get a few traces showing that happening after the IXP (never before it).

# traceroute -6I perdu.com
traceroute to perdu.com (2606:4700:3037::ac43:85b0), 30 hops max, 80 byte packets
 1  2a02:aa12:b105:b580:a605:d6ff:fe19:1278 (2a02:aa12:b105:b580:a605:d6ff:fe19:1278)  4.570 ms  4.553 ms  4.550 ms
 2  2a02:aa04:0:2b10::1 (2a02:aa04:0:2b10::1)  19.415 ms  21.213 ms  22.584 ms
 3  2a02:aa00:2:b102::1 (2a02:aa00:2:b102::1)  28.713 ms * *
 4  ch-zrh03a-rc2-lo0-0.v6.aorta.net (2001:730:2c00::5474:801d)  33.538 ms  35.637 ms  35.634 ms
 5  * * *
 6  colozur.swissix.sunrise.ch (2001:7f8:24::2f)  35.659 ms  35.656 ms  35.654 ms
 7  2001:1700:100::1 (2001:1700:100::1)  30.610 ms !X * *

# traceroute -I6 -q10 perdu.com
traceroute to perdu.com (2606:4700:3033::6815:5b2), 30 hops max, 80 byte packets
 1  2a02:aa12:b105:b580:a605:d6ff:fe19:1278 (2a02:aa12:b105:b580:a605:d6ff:fe19:1278)  3.715 ms  3.701 ms  3.698 ms  3.696 ms  3.694 ms  3.691 ms * * * *
 2  2a02:aa04:0:2b10::1 (2a02:aa04:0:2b10::1)  41.945 ms  79.231 ms  79.942 ms  79.939 ms  81.639 ms  83.233 ms * * * *
 3  2a02:aa00:2:b102::1 (2a02:aa00:2:b102::1)  19.598 ms * * * * * * * * *
 4  ch-zrh03a-rc2-lo0-0.v6.aorta.net (2001:730:2c00::5474:801d)  24.171 ms  23.935 ms  23.745 ms  21.446 ms  24.023 ms  24.175 ms  21.543 ms  22.471 ms  29.014 ms  27.828 ms
 5  * * * * * * * * * *
 6  colozur.swissix.sunrise.ch (2001:7f8:24::2f)  27.809 ms  25.085 ms  24.972 ms  22.973 ms  20.041 ms  26.392 ms  26.354 ms  23.261 ms  24.965 ms  21.970 ms
 7  * * * * * * * * * *
 8  * * * * * * * * * *
 9  * * * * * * * * * *
10  2001:1700:100::1 (2001:1700:100::1)  18.559 ms !X * *  21.749 ms !X  26.511 ms !X  26.508 ms !X  26.027 ms !X  26.019 ms !X * *

Sadly, I don’t think that this denied response is the real source of the issue, just a noticable indicator that might be of some help. The main issue remains that some IPv6 webservers are unreachable. From what I gathered, the whole Fastly network (AS54113) is currently unreachable via IPv6.

% curl -v6 fastly.com
*   Trying [2a04:4e42::313]:80...
* connect to 2a04:4e42::313 port 80 failed: Connection timed out
*   Trying [2a04:4e42:400::313]:80...
* ipv6 connect timeout after 85189ms, move on!
*   Trying [2a04:4e42:600::313]:80...
* ipv6 connect timeout after 42594ms, move on!
*   Trying [2a04:4e42:200::313]:80...
* ipv6 connect timeout after 42593ms, move on!
* Failed to connect to fastly.com port 80 after 300084 ms: Timeout was reached
* Closing connection
curl: (28) Failed to connect to fastly.com port 80 after 300084 ms: Timeout was reached