Trouble with a website using IPv6

Forums › 2degrees (including Slingshot, Orcon, Flip, Stuff Fibre, MyRepublic, 2talk and Vocus) › Trouble with a website using IPv6

Mahon

473 posts

Ultimate Geek

#258493 7-Oct-2019 09:36

Had an issue for a few days now trying to reach

https://ilibrary.co.nz/ which is the Invercargill Library.

Talked to their IT support guy this morning and he says its all 2 degrees customers and VF customers who use IPv6.

Turning off IPv6 and just using 4 is fine. IT support assure nothing has changed at the Library site, and he suggests its a routing issue with the above 2 ISP's.

Perhaps 2degrees could look it is, but its no biggy.

thanks

1 | 2 | 3

11410 posts

Uber Geek

Trusted

Lifetime subscriber

#2331723 7-Oct-2019 09:38

@NickMack

NickMack

962 posts

Ultimate Geek

Trusted

Lifetime subscriber

#2331726 7-Oct-2019 09:42

Hi All,

I'm oof today, I've pinged to team to investigate.

https://nick.mackechnie.co.nz | NZ ISP latency monitoring - https://smokeping.thenet.gen.nz

timmmay

20577 posts

Uber Geek

Trusted

Lifetime subscriber

#2331731 7-Oct-2019 09:50

I use 2deg and IP6. The first problem is the certificate is for another domain, www.metrosurveygroup.com.au. Once I click continue it takes me to there, not the library website.

nzkc

1571 posts

Uber Geek

#2331732 7-Oct-2019 09:50

Looks more like its them or their hosting provider.

This server could not prove that it is ilibrary.co.nz; its security certificate is from www.metrosurveygroup.com.au. This may be caused by a misconfiguration or an attacker intercepting your connection.

Edit: Ah...snap! Posted at the same time as Timmmay.

Mahon

473 posts

Ultimate Geek

#2331735 7-Oct-2019 09:53

nzkc:

Looks more like its them or their hosting provider.

This server could not prove that it is ilibrary.co.nz; its security certificate is from www.metrosurveygroup.com.au. This may be caused by a misconfiguration or an attacker intercepting your connection.

Library says they have had a lot of calls about it and they are all VF or 2 degrees customers on ipv6. As soon as you turn IPv6 off and flush dns access to the site is fine. But, I am no expert.

nzkc

1571 posts

Uber Geek

#2331737 7-Oct-2019 09:54

Its up to them (or their hosting provider) to make sure their DNS entries are correct. It would seem the IPv6 one is not.

Linux

11410 posts

Uber Geek

Trusted

Lifetime subscriber

#2331739 7-Oct-2019 09:57

Just clicked on link connected to IPv6 this is not a 2degrees issue sorry @NickMack

GoodSync

GoodSync. Easily back up and sync your files with GoodSync. Simple and secure file backup and synchronisation software will ensure that your files are never lost (affiliate link).

freitasm

BDFL - Memuneh
79263 posts

Uber Geek

Administrator

ID Verified

Trusted

Geekzone

Lifetime subscriber

#2331755 7-Oct-2019 10:46

This is not an IPv6 issue. It shows for 2degrees because that's an ISP with IPv6 support broadly available.

This is a problem with the library's hosting provider not creating the correct IPv6 records (the Ipv6 record AAAA exists and pointing to a server. Two options:

If the server for this domain doesn't support IPv6 for this domain then remove the AAAA record
If the server for this domain does support IPv6 then they need to make sure the AAAA is correct and the server is correctly processing the domain request

NickMack

962 posts

Ultimate Geek

Trusted

Lifetime subscriber

#2331765 7-Oct-2019 10:55

HTTP using IPv6 doesn’t work at all, their webserver returns connection refused.

$ curl -6 http://ilibrary.co.nz/ -v

connect to 2404:8280:a222:bbbb:bba1:32:ffff:ffff port 80 failed: Connection refused

HTTPS using IPv6 points to another website altogether, metrosurveygroup.com.au.

$ curl -6 https://ilibrary.co.nz/ -v

Connected to ilibrary.co.nz (2404:8280:a222:bbbb:bba1:32:ffff:ffff) port 443 (#0)

curl: (51) SSL: certificate subject name (www.metrosurveygroup.com.au) does not match target host name 'ilibrary.co.nz'

Nick

https://nick.mackechnie.co.nz | NZ ISP latency monitoring - https://smokeping.thenet.gen.nz

Mahon

473 posts

Ultimate Geek

#2331793 7-Oct-2019 11:35

All good stuff. Hope the library IT guy is reading this.

lordmuck

7 posts

Wannabe Geek

#2331895 7-Oct-2019 14:09

freitasm:

This is not an IPv6 issue. It shows for 2degrees because that's an ISP with IPv6 support broadly available.

This is a problem with the library's hosting provider not creating the correct IPv6 records (the Ipv6 record AAAA exists and pointing to a server. Two options:

If the server for this domain doesn't support IPv6 for this domain then remove the AAAA record
If the server for this domain does support IPv6 then they need to make sure the AAAA is correct and the server is correctly processing the domain request

Wondering if you can shed a little light on this :) i have checked the AAAA records and they are none existant.

Our SSL cert is fine and the issue seems only to be with IPV6 if you disable IPV6 and flush the resolver cache this issue disappears...

The odd thing is the issue does not occur with spark?

It is only an issue with Voda,trustpower and 2degrees from what i can see so far. But not on Voda business plans or mobiles witch is odd.

Any help would be appreciated.. :)

Linux

11410 posts

Uber Geek

Trusted

Lifetime subscriber

#2331900 7-Oct-2019 14:12

@lordmuck SparkNZ are not doing IPv6 yet and this is why the issue does not happen on Spark

freitasm

BDFL - Memuneh
79263 posts

Uber Geek

Administrator

ID Verified

Trusted

Geekzone

Lifetime subscriber

#2331902 7-Oct-2019 14:13

There are AAAA records for ilibrary.co.nz

If your ISP does not support IPv6 then you won't see them. Click the link above and you will see these records.

engedib

254 posts

Ultimate Geek

#2331903 7-Oct-2019 14:15

lordmuck:

freitasm:

This is not an IPv6 issue. It shows for 2degrees because that's an ISP with IPv6 support broadly available.

This is a problem with the library's hosting provider not creating the correct IPv6 records (the Ipv6 record AAAA exists and pointing to a server. Two options:

If the server for this domain doesn't support IPv6 for this domain then remove the AAAA record
If the server for this domain does support IPv6 then they need to make sure the AAAA is correct and the server is correctly processing the domain request

Wondering if you can shed a little light on this :) i have checked the AAAA records and they are none existant.

Our SSL cert is fine and the issue seems only to be with IPV6 if you disable IPV6 and flush the resolver cache this issue disappears...

The odd thing is the issue does not occur with spark?

It is only an issue with Voda,trustpower and 2degrees from what i can see so far. But not on Voda business plans or mobiles witch is odd.

Any help would be appreciated.. :)

The default AAAA record for the domain has to be removed, or correctly pointed to the site if it has an IPv6 address.

MCSE+M/S, MCITP

freitasm

BDFL - Memuneh
79263 posts

Uber Geek

Administrator

ID Verified

Trusted

Geekzone

Lifetime subscriber

#2331907 7-Oct-2019 14:17

@lordmuck:

Our SSL cert is fine and the issue seems only to be with IPV6 if you disable IPV6 and flush the resolver cache this issue disappears...

The odd thing is the issue does not occur with spark?

Spark does not have IPv6 so you won't try to access the IPv6 address ever.

The SSL may be correct but your provider is binding the IPv6 address to another domain and SSL cert, despite the ilibrary.co.nz DNS AAAA.

If your domain is not supposed to support IPv6, remove the AAAA records from DNS. If it is supposed to support IPv6, then get your hosting provided to fix the site binding.

1 | 2 | 3