ANSWERED prefer IPv6 / IPv6 only

[Crewman6639 4]

having trouble getting Eddie on Windows 11 to use IPv6 instead of IPv4. In the networking tab if I set any of the preferences to either prefer IPV6 and/or block IPv4, regardless of protocol, I cannot connect to a server. I am assuming I am probably doing something wrong and was hoping others might have a solution. 

[ss11 22]

While I am not using Eddie I can confirm the problem is something config related at your side, I am connecting via IPv6 to servers using both OpenVPN and Wireguard protocols, except not by using Eddie and using the native OpenVPN and Wireguard client/daemons. Please give more details about your config.

[Crewman6639 4]

9 minutes ago, ss11 said:

While I am not using Eddie I can confirm the problem is something config related at your side, I am connecting via IPv6 to servers using both OpenVPN and Wireguard protocols, except not by using Eddie and using the native OpenVPN and Wireguard client/daemons. Please give more details about your config.

I can try and provide a log file later when I home from work.

Not sure if this adds much but, the issue only occurs if I try and have Eddie prefer IPv6 in anyway. If I use the standard options where it eithe blocks IPv6 or prefers IPv4 it works just fine, and I can see I also have an IPv6 address.

I also tried using a wireguard config, with the advanced options to only use IPv6 but that resulted in traffic being routed outside the tunnel, or if the kill switch was on, no connection at all. 

My initial guess is that I may need to configure windows 11 as well - so I was considering perusing this article - https://learn.microsoft.com/en-US/troubleshoot/windows-server/networking/configure-ipv6-in-windows

[Staff 10132]

1 hour ago, Crewman6639 said:

having trouble getting Eddie on Windows 11 to use IPv6 instead of IPv4. In the networking tab if I set any of the preferences to either prefer IPV6 and/or block IPv4, regardless of protocol, I cannot connect to a server. I am assuming I am probably doing something wrong and was hoping others might have a solution. 

Hello!

An essential requisite is that your ISP supports pure IPv6 (not IPv6 over IPv4), can you please verify? If your ISP does not support IPv6 you must connect over IPv4. Then, provided that IPv6 is supported by your system, you can use IPv6 over IPv4 through our servers.

Kind regards
 

[Crewman6639 4]

14 minutes ago, Staff said:

Hello!

An essential requisite is that your ISP supports pure IPv6 (not IPv6 over IPv4), can you please verify? If your ISP does not support IPv6 you must connect over IPv4. Then, provided that IPv6 is supported by your system, you can use IPv6 over IPv4 through our servers.

Kind regards
 

@Staff I appreciate the reply. My ISP is Comcast/Xfinity and my understanding is that they do support IPv6 (although I am having a bit of trouble trying to figure out if they support "pure IPv6"). 

Do you happen to know if Windows 11 needs to be configured, specifically to prefer IPv6 over IPv4, before it will work with AirVPN?
 

1 hour ago, Crewman6639 said:

My initial guess is that I may need to configure windows 11 as well - so I was considering perusing this article - https://learn.microsoft.com/en-US/troubleshoot/windows-server/networking/configure-ipv6-in-windows

[knighthawk 19]

22 hours ago, Crewman6639 said:

My ISP is Comcast/Xfinity and my understanding is that they do support IPv6 (although I am having a bit of trouble trying to figure out if they support "pure IPv6"). 
 

Just want to let you know as a fellow Comcast customer they support pure ip6 on all customer issued hardware(modems and gateways, and most custom user hardware as well), and have for many years now, they also support delegating prefix requests if requested (how large is honored varies but /59 or /60 are common among residential service users) if you need subnets. Can't speak to rest of your issue(s) unfortunately though, other than to suggest first ensure ip6 connectivity exists\functions outside of eddie\vpn use before trying to tunnel over it (ie can you ping -6 outside addresses?). /2c

 

[Crewman6639 4]

On 4/20/2024 at 10:14 AM, knighthawk said:

Just want to let you know as a fellow Comcast customer they support pure ip6 on all customer issued hardware

Awesome, this is what I had figured.
 

On 4/20/2024 at 10:14 AM, knighthawk said:

other than to suggest first ensure ip6 connectivity exists\functions outside of eddie\vpn use before trying to tunnel over it (ie can you ping -6 outside addresses?)

I got it working eventually by having the Eddie client using a different DNS, which isn't ideal. My guess is I am still setting something up wrong because @Staff made it pretty clear it should work and I have no reason to not believe that.

[dacorbex 0]

Same issue here, I'm not using Eddie, here is my wg config file:

[Interface]
Address = fd7d:76ee:e68f:a993:3e4d:e922:2bf4:7aee
PrivateKey = **********************
MTU = 1000
DNS = fd7d:76ee:e68f:a993::1

[Peer]
PublicKey = **********************
PresharedKey = **********************
Endpoint = ch3.ipv6.vpn.airdns.org:47107
AllowedIPs = ::/0
PersistentKeepalive = 25

If my Linux PC is configured in dual stack, everything is Ok.
With IPv4 disabled (=IPv6 only):

1. Tunnel OFF: `traceroute6 google.com` is Ok
2. Tunnel ON: `traceroute6 google.com` fails.

[dacorbex 0]

As my tunnel was working in dual-stack, I didn't bother to check why I couldn't use the wireguard vpn in IPv6 mode only.
Today, it was raining the entire day, so... I fired up tcdump on to see that was going on.

I eventually went to the conclusion that the firewall on my workstation was rejecting UDP packets once the tunnel was up.
In short, I found that firewalld, the firewall management tool for Linux was using connectivity checks by default.
It means that if a reply to the packet is sent via the same interface that the packet arrived on (eth0), the packet will match and be accepted, otherwise (wg0) dropped.

To allow connectivity checks to function as intended:
1. Edit

/etc/firewalld/firewall.conf

2. Change

IPv6_rpfilter=strict

to

IPv6_rpfilter=loose

as it is in IPv4.

Note: This was done on Fedora Linux 41 (Workstation Edition). Firewalld IPv6_rpfilter will default to loose on Fedora 42 coming out soon.