IPv6 preference

[ericnixmd]

I currently have ip_stack set to split.

Are there any plans to allow IPv6 preference when resolving domains (i.e., prefer IPv6 over IPv4)? I may be confused with the functionality. Does split prefer IPv6 when an IPv6 client queries the resolver (responds in-kind)?

[cuonglm]

I may be confused with the functionality. Does split prefer IPv6 when an IPv6 client queries the resolver (responds in-kind)?

No, the ip_stack is ued to decide whether ipv4 or ipv6 will be used to connect to upstream, not deciding what's kind of response from ctrld.

[ericnixmd]

Ah, makes sense.

I'm trying to figure out why ctrld is replying with refused for queries to my Raspberry Pi DNS relay server using IPv6. If I run a ping6 command, the client obtains an IPv6 address and pings appropriately. Dig, however, reports refused. I've verified IPv6 is working on the Pi, firewall rules are correct, and the IPv6 subnets are within the networks appropriately (with a separate listener for :: on the correct port.

[ericnixmd]

I'm getting "REFUSED" when I try to query a DNS relay server with IPv6. It works with other resolvers using IPv6 (i.e., DNSFilter). It seems to be an issue with either my config (which is configured to monitor IPv6) or with the ctrld CLI itself. ctrld CLI is running on a Raspberry Pi 5 using an SSD.

ericnix@macstudio ~ % nslookup cnn.com 2001:559:2030:1::101
Server:		2001:[redacted]:1::101
Address:	2001:[redacted]:1::101#53

** server can't find cnn.com: REFUSED

ericnix@macstudio ~ % 

ericnix@macstudio ~ % nslookup cnn.com
;; Got recursion not available from 2001:[redacted]:1::101, trying next server
;; Got recursion not available from 2001:[redacted]:1::102, trying next server
Server:		10.0.1.101
Address:	10.0.1.101#53

Non-authoritative answer:
Name:	cnn.com
Address: 151.101.67.5
Name:	cnn.com
Address: 151.101.131.5
Name:	cnn.com
Address: 151.101.3.5
Name:	cnn.com
Address: 151.101.195.5

[cuonglm]

@ericnixmd You may need to enable ctrld listeners to allow wan clients: https://github.com/Control-D-Inc/ctrld/blob/main/docs/config.md#allow_wan_clients

For security reason, this is disabled by default.

[ericnixmd]

@ericnixmd You may need to enable ctrld listeners to allow wan clients: https://github.com/Control-D-Inc/ctrld/blob/main/docs/config.md#allow_wan_clients

For security reason, this is disabled by default.

This is necessary when accessing from LAN only? What security issues will this create?

[cuonglm]

@ericnixmd You may need to enable ctrld listeners to allow wan clients: https://github.com/Control-D-Inc/ctrld/blob/main/docs/config.md#allow_wan_clients

For security reason, this is disabled by default.

This is necessary when accessing from LAN only? What security issues will this create?

This is because your ipv6 is not local addresses (ULA or LLA), so requests from there are considered from wan clients.

[ericnixmd]

I'll give it a try. I'm assuming since my firewall isn't doing any port forwards that this should not be a security risk for the relay behind the firewall.

Since I have two listeners (one IPv4, one IPv6), I'm assuming I only add this to my IPv6 listener? Also, should I set the IPv6 listener to restricted since I have a static IPv6 (/48)? All networks on the IPv6 will be defined in network policies.

[ericnixmd]

That looks like it got it working, but the backend isn't showing the IPv6 address of the client. Will mess with it to see if I can get it to send the MAC address.

Also doesn't seem to be routing clients on various VLANs through the appropriate profile (instead sending all to default).

[cuonglm]

Since I have two listeners (one IPv4, one IPv6), I'm assuming I only add this to my IPv6 listener?

Yes, ipv4 for LAN clients will be in private addresses range.

Also, should I set the IPv6 listener to restricted since I have a static IPv6 (/48)? All networks on the IPv6 will be defined in network policies.

Yes, it's a good protection to complement with the allowing wan clients config.

[ericnixmd]

I'll have to keep messing with it. It's not honoring IPv6 VLANs that are supposed to go to different profiles/endpoints and also is listing every request address as my relay server address instead of the client IPv6.

I was trying to figure out a way to set a ULA to request and see if that passed client info, but I can't get my Pi to accept it. Trying to set preference to using MAC didn't change anything.

Work in progress, but it's making some progress!

[cuonglm]

I'll have to keep messing with it. It's not honoring IPv6 VLANs that are supposed to go to different profiles/endpoints and also is listing every request address as my relay server address instead of the client IPv6.

I was trying to figure out a way to set a ULA to request and see if that passed client info, but I can't get my Pi to accept it. Trying to set preference to using MAC didn't change anything.

Work in progress, but it's making some progress!

Are you sure clients reach the relay server directly instead of going through a NAT device?

If you saw the client IPv6 address in ctrld log, then that IP will be included in client info.

[ericnixmd]

I'll have to keep messing with it. It's not honoring IPv6 VLANs that are supposed to go to different profiles/endpoints and also is listing every request address as my relay server address instead of the client IPv6.
I was trying to figure out a way to set a ULA to request and see if that passed client info, but I can't get my Pi to accept it. Trying to set preference to using MAC didn't change anything.
Work in progress, but it's making some progress!

Are you sure clients reach the relay server directly instead of going through a NAT device?

If you saw the client IPv6 address in ctrld log, then that IP will be included in client info.

Yes, unless my gateway is doing something weird that I'm not aware of. Another DNS resolver I've used on the relay correctly reports the client ID to its upstream.

[ericnixmd]

I've about given up on this... I'm suspicious for this to be a ctrld bug by not allowing local IPv6 connections. I can ping and SSH into the Raspberry Pi via its IPv6 address suggesting interVLAN is working. Running DNSFilter's relay server on another Pi, IPv6 connectivity works (and is reported in DNSFilter's logs).

I'm not sure what else I can try. WAN works, but this should work locally. Not sure why I can't get it to work. My ICMPv6 firewall rule allows any ICMP traffic between IPv6 clients. Again, the relay server works with a competitor's relay server app.

If I specify my DNS server as only the IPv6 address, attempts at pulling up a website results in an error.

[ericnixmd]

@cuonglm were you able to look into this any further?

[cuonglm]

@cuonglm were you able to look into this any further?

Do you mean the local IPv6 that you mentioned above?

If yes, I answered here: #260 (comment)