On 2018-01-20 12:34, Karol Augustin wrote:

Hi,

Until recently I was using HE tunnel as IPv6 provider until AWS enabled native IPv6 support in my region and everything was working without problems. Since I have enabled native IPv6 on my mail server and have problem with DANE tester site https://dane.sys4.de/smtp/augustin.pl

It always times out on IPv6 address and I am confident that everything is configured properly as I receive lots of connections by IPv6 including gmail, Debian and Postfix mailing lists etc.

Ok, it looks like I am hitting firewall on mail.sys4.de:

Jan 20 12:35:00 mail postfix/smtp[29506]: connect to mail.sys4.de[2001:1578:400:111::7]:25: Permission denied Jan 20 12:35:06 mail postfix/smtp[29506]: Verified TLS connection established to mail.sys4.de[194.126.158.132]:25: TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)

ping 2001:1578:400:111::7 PING 2001:1578:400:111::7(2001:1578:400:111::7) 56 data bytes

From 2001:1578:0:ff::1:2 icmp_seq=2 Destination unreachable:

Administratively prohibited

From 2001:1578:0:ff::1:2 icmp_seq=3 Destination unreachable:

Administratively prohibited

From 2001:1578:0:ff::1:2 icmp_seq=8 Destination unreachable:

Administratively prohibited

Is there any reason for blocking AWS IPv6?

Jan 20 06:32:38 mail postfix/postscreen[17537]: CONNECT from [2604:8d00:0:1::4]:54406 to [2a05:d018:76d:5af6:d050:9b30:6bf7:df98]:25 Jan 20 06:32:38 mail postfix/postscreen[17537]: WHITELISTED [2604:8d00:0:1::4]:54406 Jan 20 06:32:38 mail postfix/smtpd[17538]: connect from russian-caravan.cloud9.net[2604:8d00:0:1::4] Jan 20 06:32:39 mail postfix/smtpd[17538]: Trusted TLS connection established from russian-caravan.cloud9.net[2604:8d00:0:1::4]: TLSv1 with cipher DHE-RSA-CAMELLIA256-SHA (256/256 bits)

You can see test results here: https://network-tools.webwiz.net/email-test.htm?email=augustin%2Epl&conn...

Is there any known problem with DANE tester IPv6 configuration?

I appreciate your help.

Karol

On 2018-01-20 13:16, Jens Link wrote:

...

Is there any reason for blocking AWS IPv6?

I don't think that AWS is blocked but IPv6 prefixes > 32 are. I have the same problem with my mail server which is an /48 PI.

Thanks, it explains it. I was using HE tunnel before and it was working fine. Anyway that seems weird to me to block >32 prefixes especially if the biggest cloud provider in the world is hit by that.

Karol

Your IP is announced by AWS in a /38:

# sh ipv6 route 2a05:d018:76d:5af6:d050:9b30:6bf7:df98 Routing entry for 2a05:d018:400::/38 Known via "bgp", distance 20, metric 0, best Last update 04w0d01h ago * fe80::e6aa:5dff:fe82:e001, via eth0

And as a general tip:

Use a TCP variant of traceropute, newer version have -T option for this and also try tracepath(6) so see if there are any MTU issuse.

Yeah, it was the first thing I have checked and there is no problems with MTU.

Jens

Bjørn Mork bjorn@mork.no writes:

Hi,

I don't think that is it. One of my mail servers is fine (in a /32 prefix), but the other one (in a /24 prefix) is not.

just talked to the provider, looks like a wired routing issue, they are working on a fix.

Jens, Hm, I somehow sound like all the provider hotline I talked to in the last couple of weeks ;-=)

On 2018-01-22 9:34, Jens Link wrote:

Jens Link lists@quux.de writes:

...

just talked to the provider, looks like a wired routing issue, they are working on a fix.

okay, at least for me it's working now.

It's working for me as well. Thanks for looking into that!

Karol