@selfhosted Remote Access to my server over IPv6 is only possible with IA_PD enabled

I’m honestly at my wits end. I opened port 443 in my router (port forwarding, FRITZ!Box 7530) to get access to my server from outside my network. Due to my IPv4 being behind CGNAT I can’t use IPv4 and decided to solely use IPv6 for outside connections. With IA_PD enabled it works but unfortunately the work laptop of my sister in law can’t connect to the internet with this option enabled and I’m trying to find a work around without this option. I gave my server a static IPv6 address and the DNS entry in OVHcloud is pointing to it.

Bonus question: maybe someone can help me with this as well, I’m using lire on iOS connected to FreshRSS on my server and it doesn’t work while inside my network and only works outside my network. In the browser everything works in whichever network. All other services on my server work too. It says it can’t connect to the internet as an error. But that’s a secondary problem for now.

Please tell me if you need any information to help me troubleshoot.

#selfhost #selfhosting #selfhosted #networking #remoteaccess #server #homeserver

  • jake_jake_jake_@lemmy.worldEnglish
    0·
    2 months ago

    Without prefix delegation turned on, you probably don’t get an IPv6 address on your lan devices. With it turned on, your router should assign a /64 to the LAN from a different subnet then what your WAN will have.

    With PD on, what addresses do your clients get? For the laptop that doesn’t work, what does test-ipv6.com tell you?

    With IPv6 you need to have your firewall rules setup correctly, as blocking certain ICMP messages will break IPv6.

    Is the static IPv6 chosen for your server from the subnet your WAN is in? In this case, with PD off, if you cannot reach the internet you might need to enable a Neighbor Discovery Protocol proxy to allow the service provider’s router to learn where to find your server.

    Personally, I would reenable PD then try to get the work laptop fixed. Maybe disable IPv6 on the work laptop. What I found at my job, is that when I am on VPN from a dual stack client, my company does not give a IPv6 address (or route) on the vpn, but replies with AAAA records causing the client to try to use the internet to reach things behind the corporate firewall.

    • Tywèle@corteximplant.comOP
      0·
      2 months ago

      @jake_jake_jake_ I can’t check anything on the work laptop since it isn’t mine and it’s work issued. Very locked down. But I just called my ISP and asked to be taken off CGNAT and they are doing that so that will be easier in the future.

      • irmadlad@lemmy.worldEnglish
        0·
        2 months ago

        Huh. That’s kind of unusual in my experience. They’re usually quite adamant about keeping you on CGNAT.