[8.920][BUG] IPv6 connection issues (was: Proxy does not handle dual stack servers!)

Since swapping my ASG v8 with v9 beta I'm having problems accessing dual-stack enabled servers.

Servers like my own (blackdot.be) or even astaro.org time out when using the HTTP Proxy. If I disable the IPv6 DNS entry it works fine. So I know it is IPv6 related.

2012:04:10-23:12:16 inertia httpproxy[10369]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="GET" srcip="2001:6f8:1480:15:11a8:c2f0:eb92[:D]869" dstip="2a02:788:12:38::5" user="" statuscode="502" cached="0" profile="REF_DefaultHTTPProfile (Default Proxy)" filteraction="REF_DefaultHTTPCFFAction (Default content filter action)" size="2850" request="0x841e5c8" url="http://www.astaro.com/sites/all/themes/yaml/layouts/yaml_astaro/images/en-int/myastaro.png" exceptions="" error="Connection to server timed out"
2012:04:10-23:12:16 inertia httpproxy[10369]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="GET" srcip="2001:6f8:1480:15:11a8:c2f0:eb92[:D]869" dstip="2a02:788:12:38::5" user="" statuscode="502" cached="0" profile="REF_DefaultHTTPProfile (Default Proxy)" filteraction="REF_DefaultHTTPCFFAction (Default content filter action)" size="2746" request="0x836ccf0" url="http://www.astaro.com/elqNow/elqCfg.js" exceptions="" error="Connection to server timed out"
2012:04:10-23:12:16 inertia httpproxy[10369]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="GET" srcip="2001:6f8:1480:15:11a8:c2f0:eb92[:D]869" dstip="2a02:788:12:38::5" user="" statuscode="502" cached="0" profile="REF_DefaultHTTPProfile (Default Proxy)" filteraction="REF_DefaultHTTPCFFAction (Default content filter action)" size="2746" request="0x836cb88" url="http://www.astaro.com/elqNow/elqImg.js" exceptions="" error="Connection to server timed out"
2012:04:10-23:12:33 inertia httpproxy[10369]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="GET" srcip="2001:6f8:1480:15:11a8:c2f0:eb92[:D]869" dstip="2a02:788:12:38::5" user="" statuscode="502" cached="0" profile="REF_DefaultHTTPProfile (Default Proxy)" filteraction="REF_DefaultHTTPCFFAction (Default content filter action)" size="2836" request="0xbcd35198" url="http://www.astaro.com/sites/all/themes/yaml/layouts/yaml_astaro/css/navigations.css" exceptions="" error="Connection to server timed out"
2012:04:10-23:12:33 inertia httpproxy[10369]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="GET" srcip="2001:6f8:1480:15:11a8:c2f0:eb92[:D]869" dstip="2a02:788:12:38::5" user="" statuscode="502" cached="0" profile="REF_DefaultHTTPProfile (Default Proxy)" filteraction="REF_DefaultHTTPCFFAction (Default content filter action)" size="2742" request="0xbcd06768" url="http://www.astaro.com/misc/jquery.js" exceptions="" error="Connection to server timed out"
2012:04:10-23:12:33 inertia httpproxy[10369]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="GET" srcip="2001:6f8:1480:15:11a8:c2f0:eb92[:D]869" dstip="2a02:788:12:38::5" user="" statuscode="502" cached="0" profile="REF_DefaultHTTPProfile (Default Proxy)" filteraction="REF_DefaultHTTPCFFAction (Default content filter action)" size="2850" request="0x830fb68" url="http://www.astaro.com/sites/all/themes/yaml/layouts/yaml_astaro/images/en-int/myastaro.png" exceptions="" error="Connection to server timed out"
2012:04:10-23:12:34 inertia httpproxy[10369]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="GET" srcip="2001:6f8:1480:15:11a8:c2f0:eb92[:D]869" dstip="2a02:788:12:38::5" user="" statuscode="502" cached="0" profile="REF_DefaultHTTPProfile (Default Proxy)" filteraction="REF_DefaultHTTPCFFAction (Default content filter action)" size="2746" request="0x834f060" url="http://www.astaro.com/elqNow/elqCfg.js" exceptions="" error="Connection to server timed out"
2012:04:10-23:12:34 inertia httpproxy[10369]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="GET" srcip="2001:6f8:1480:15:11a8:c2f0:eb92[:D]869" dstip="2a02:788:12:38::5" user="" statuscode="502" cached="0" profile="REF_DefaultHTTPProfile (Default Proxy)" filteraction="REF_DefaultHTTPCFFAction (Default content filter action)" size="2746" request="0x830fe38" url="http://www.astaro.com/elqNow/elqImg.js" exceptions="" error="Connection to server timed out"
2012:04:10-23:13:34 inertia httpproxy[10369]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="GET" srcip="2001:6f8:1480:15:11a8:c2f0:eb92[:D]869" dstip="2a02:788:12:38::5" user="" statuscode="502" cached="0" profile="REF_DefaultHTTPProfile (Default Proxy)" filteraction="REF_DefaultHTTPCFFAction (Default content filter action)" size="2742" request="0x830fb68" url="http://www.astaro.com/misc/jquery.js" exceptions="" error="Connection to server timed out"
2012:04:10-23:14:14 inertia httpproxy[10369]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="GET" srcip="2001:6f8:1480:15:11a8:c2f0:eb92[:D]869" dstip="2001:1938:81:164::2" user="" statuscode="502" cached="0" profile="REF_DefaultHTTPProfile (Default Proxy)" filteraction="REF_DefaultHTTPCFFAction (Default content filter action)" size="2708" request="0x834f768" url="http://blackdot.be/" exceptions="" error="Connection to server timed out"
2012:04:10-23:14:35 inertia httpproxy[10369]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="GET" srcip="2001:6f8:1480:15:11a8:c2f0:eb92[:D]869" dstip="2a02:788:12:38::5" user="" statuscode="502" cached="0" profile="REF_DefaultHTTPProfile (Default Proxy)" filteraction="REF_DefaultHTTPCFFAction (Default content filter action)" size="2746" request="0x834f060" url="http://www.astaro.com/elqNow/elqCfg.js" exceptions="" error="Connection to server timed out"
2012:04:10-23:14:35 inertia httpproxy[10369]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="GET" srcip="2001:6f8:1480:15:11a8:c2f0:eb92[:D]869" dstip="2a02:788:12:38::5" user="" statuscode="502" cached="0" profile="REF_DefaultHTTPProfile (Default Proxy)" filteraction="REF_DefaultHTTPCFFAction (Default content filter action)" size="2850" request="0x830fb68" url="http://www.astaro.com/sites/all/themes/yaml/layouts/yaml_astaro/images/en-int/myastaro.png" exceptions="" error="Connection to server timed out"
2012:04:10-23:14:43 inertia httpproxy[10369]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="GET" srcip="172.16.15.111" dstip="2001:1938:81:164::2" user="" statuscode="502" cached="0" profile="REF_DefaultHTTPProfile (Default Proxy)" filteraction="REF_DefaultHTTPCFFAction (Default content filter action)" size="2708" request="0x83a3300" url="http://www.blackdot.be/" exceptions="" error="Connection to server timed out"

Parents

0 cziel over 13 years ago

Hi sjorge,

do you run the HTTP Proxy in Full Transparent Mode?

Cheers,
Cristof
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 sjorge over 13 years ago in reply to cziel

Hi cziel,

I'm running in 'Transparent Mode' I can't use 'Full Transparent Mode', the later is disabled.

kr
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 cziel over 13 years ago in reply to sjorge
Hi sjorge,

first we need to check whether a TCP/IP can be established on the destinations port 80. Therefore please set the following commands via CLI on your UTM:

telnet 80
nc -v 80

and post the respective output.

Thanks,
Cristof
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel

0 sjorge over 13 years ago in reply to cziel

Here is the info you asked for and a bit more.

This is on a IPv6 dualstacked server:

sjorge@procyon ~ $ netstat -tpln
(No info could be read for "-p": geteuid()=1000 but you should be root.)
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name                                      
tcp        0      0 0.0.0.0:80            0.0.0.0:*               LISTEN      -                                     
...               
tcp6       0      0 :::80                   :::*                    LISTEN      -                                  
sjorge@procyon ~ $ ping6 ipv6.google.com
PING ipv6.google.com(bud01s08-in-x13.1e100.net) 56 data bytes
64 bytes from bud01s08-in-x13.1e100.net: icmp_seq=1 ttl=48 time=288 ms
64 bytes from bud01s08-in-x13.1e100.net: icmp_seq=2 ttl=48 time=285 ms
64 bytes from bud01s08-in-x13.1e100.net: icmp_seq=3 ttl=48 time=291 ms

As you can see IPv6 connectivity is working and httpd is listening on port 80.

Client machine behind the gateway:

sjorge@saxion ~ $ dig -t AAAA blackdot.be +short
2001:1938:81:164::2
sjorge@saxion ~ $ ping6 2001:1938:81:164::2
PING 2001:1938:81:164::2(2001:1938:81:164::2) 56 data bytes
64 bytes from 2001:1938:81:164::2: icmp_seq=1 ttl=52 time=368 ms
64 bytes from 2001:1938:81:164::2: icmp_seq=2 ttl=52 time=386 ms
64 bytes from 2001:1938:81:164::2: icmp_seq=3 ttl=52 time=409 ms
^C
--- 2001:1938:81:164::2 ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2002ms
rtt min/avg/max/mdev = 368.940/388.109/409.140/16.472 ms

Ok so we know that we have the correct IPv6 address and that at least basic IPv6 is working. So far so good!

Now here is where it gets weird. I did the telnet and nc with web filtering set to standard and transparent mode... but the results were the same! [:O]

So i'm no longer sure it is a web filtering issue or a general IPv6 issue!


sjorge@saxion ~ $ ping6 2001:1938:81:164::2
PING 2001:1938:81:164::2(2001:1938:81:164::2) 56 data bytes
64 bytes from 2001:1938:81:164::2: icmp_seq=1 ttl=52 time=368 ms
64 bytes from 2001:1938:81:164::2: icmp_seq=2 ttl=52 time=386 ms
64 bytes from 2001:1938:81:164::2: icmp_seq=3 ttl=52 time=409 ms
^C
--- 2001:1938:81:164::2 ping statistics ---
sjorge@saxion ~ $ telnet 2001:1938:81:164::2 80
Trying 2001:1938:81:164::2...
telnet: Unable to connect to remote host: Connection timed out
sjorge@saxion ~ $ nc -v 2001:1938:81:164::2 80
Error: Couldn't resolve host "2001:1938:81:164::2"
sjorge@saxion ~ $ nc6 -v 2001:1938:81:164::2 80
nc6: timeout while connecting to cl-357.phx-01.us.sixxs.net (2001:1938:81:164::2) 80 [http]
nc6: unable to connect to address 2001:1938:81:164::2, service 80

I see the exact same thing with web filtering in standard or transparent mode.

Ruling out the server it self:

eth0@sakura:~$ ping6 2001:1938:81:164::2
PING 2001:1938:81:164::2(2001:1938:81:164::2) 56 data bytes
64 bytes from 2001:1938:81:164::2: icmp_seq=1 ttl=52 time=227 ms
64 bytes from 2001:1938:81:164::2: icmp_seq=2 ttl=52 time=224 ms
64 bytes from 2001:1938:81:164::2: icmp_seq=3 ttl=52 time=224 ms
^C
--- 2001:1***:81:164::2 ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2003ms
rtt min/avg/max/mdev = 224.239/225.381/227.492/1.543 ms
eth0@sakura:~$ telnet 2001:1938:81:164::2 80
Trying 2001:1938:81:164::2...
Connected to 2001:1938:81:164::2.
Escape character is '^]'.
^C
Connection closed by foreign host.

eth0@sakura:~$ nc -v 2001:1938:81:164::2 80
Connection to 2001:1938:81:164::2 80 port [tcp/http] succeeded!

So the server looks OK.
I no dropped packets in the firewall log window while doing these tests.

Reply

0 sjorge over 13 years ago in reply to cziel

Here is the info you asked for and a bit more.

This is on a IPv6 dualstacked server:

sjorge@procyon ~ $ netstat -tpln
(No info could be read for "-p": geteuid()=1000 but you should be root.)
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name                                      
tcp        0      0 0.0.0.0:80            0.0.0.0:*               LISTEN      -                                     
...               
tcp6       0      0 :::80                   :::*                    LISTEN      -                                  
sjorge@procyon ~ $ ping6 ipv6.google.com
PING ipv6.google.com(bud01s08-in-x13.1e100.net) 56 data bytes
64 bytes from bud01s08-in-x13.1e100.net: icmp_seq=1 ttl=48 time=288 ms
64 bytes from bud01s08-in-x13.1e100.net: icmp_seq=2 ttl=48 time=285 ms
64 bytes from bud01s08-in-x13.1e100.net: icmp_seq=3 ttl=48 time=291 ms

As you can see IPv6 connectivity is working and httpd is listening on port 80.

Client machine behind the gateway:

sjorge@saxion ~ $ dig -t AAAA blackdot.be +short
2001:1938:81:164::2
sjorge@saxion ~ $ ping6 2001:1938:81:164::2
PING 2001:1938:81:164::2(2001:1938:81:164::2) 56 data bytes
64 bytes from 2001:1938:81:164::2: icmp_seq=1 ttl=52 time=368 ms
64 bytes from 2001:1938:81:164::2: icmp_seq=2 ttl=52 time=386 ms
64 bytes from 2001:1938:81:164::2: icmp_seq=3 ttl=52 time=409 ms
^C
--- 2001:1938:81:164::2 ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2002ms
rtt min/avg/max/mdev = 368.940/388.109/409.140/16.472 ms


sjorge@saxion ~ $ ping6 2001:1938:81:164::2
PING 2001:1938:81:164::2(2001:1938:81:164::2) 56 data bytes
64 bytes from 2001:1938:81:164::2: icmp_seq=1 ttl=52 time=368 ms
64 bytes from 2001:1938:81:164::2: icmp_seq=2 ttl=52 time=386 ms
64 bytes from 2001:1938:81:164::2: icmp_seq=3 ttl=52 time=409 ms
^C
--- 2001:1938:81:164::2 ping statistics ---
sjorge@saxion ~ $ telnet 2001:1938:81:164::2 80
Trying 2001:1938:81:164::2...
telnet: Unable to connect to remote host: Connection timed out
sjorge@saxion ~ $ nc -v 2001:1938:81:164::2 80
Error: Couldn't resolve host "2001:1938:81:164::2"
sjorge@saxion ~ $ nc6 -v 2001:1938:81:164::2 80
nc6: timeout while connecting to cl-357.phx-01.us.sixxs.net (2001:1938:81:164::2) 80 [http]
nc6: unable to connect to address 2001:1938:81:164::2, service 80

I see the exact same thing with web filtering in standard or transparent mode.

Ruling out the server it self:

eth0@sakura:~$ ping6 2001:1938:81:164::2
PING 2001:1938:81:164::2(2001:1938:81:164::2) 56 data bytes
64 bytes from 2001:1938:81:164::2: icmp_seq=1 ttl=52 time=227 ms
64 bytes from 2001:1938:81:164::2: icmp_seq=2 ttl=52 time=224 ms
64 bytes from 2001:1938:81:164::2: icmp_seq=3 ttl=52 time=224 ms
^C
--- 2001:1***:81:164::2 ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2003ms
rtt min/avg/max/mdev = 224.239/225.381/227.492/1.543 ms
eth0@sakura:~$ telnet 2001:1938:81:164::2 80
Trying 2001:1938:81:164::2...
Connected to 2001:1938:81:164::2.
Escape character is '^]'.
^C
Connection closed by foreign host.

eth0@sakura:~$ nc -v 2001:1938:81:164::2 80
Connection to 2001:1938:81:164::2 80 port [tcp/http] succeeded!

So the server looks OK.
I no dropped packets in the firewall log window while doing these tests.

Children

0 sjorge over 13 years ago in reply to sjorge

Simplified test to check if stuff is being blocked by the FW. Web filtering is still set to standard.

sjorge@saxion ~ $ date

Wed Apr 11 16:06:27 CEST 2012

sjorge@saxion ~ $ nc6 -v 2001:1938:81:164::2 80

nc6: timeout while connecting to cl-357.phx-01.us.sixxs.net (2001:1938:81:164::2) 80 [http]

nc6: unable to connect to address 2001:1938:81:164::2, service 80

sjorge@saxion ~ $ date

Wed Apr 11 16:07:44 CEST 201

15:58:55 	Default DROP 	UDP 	

172.16.15.104 	: 	64207

	→ 	

77.35.128.23 	: 	18497

	

len=46 	ttl=63 	tos=0x00 	srcmac=e8:6:88:a3:4a:30 	dstmac=8:0:27:fd:96:e3

15:59:00 	Default DROP 	UDP 	

172.16.15.104 	: 	64207

	→ 	

77.35.128.23 	: 	18497

	

len=46 	ttl=63 	tos=0x00 	srcmac=e8:6:88:a3:4a:30 	dstmac=8:0:27:fd:96:e3

15:59:05 	Default DROP 	UDP 	

172.16.15.104 	: 	64207

	→ 	

77.35.128.23 	: 	18497

	

len=46 	ttl=63 	tos=0x00 	srcmac=e8:6:88:a3:4a:30 	dstmac=8:0:27:fd:96:e3

16:01:46 	Default DROP 	TCP 	

98.126.52.51 	: 	80

	→ 	

91.176.31.193 	: 	63632

	

[ACK SYN] 	len=44 	ttl=105 	tos=0x00

16:03:19 	Default DROP 	TCP 	

173.230.157.252 	: 	443

	→ 	

91.176.31.193 	: 	64337

	

[ACK FIN] 	len=52 	ttl=54 	tos=0x00

16:03:20 	Default DROP 	TCP 	

173.230.157.252 	: 	443

	→ 	

91.176.31.193 	: 	64337

	

[ACK PSH] 	len=409 	ttl=54 	tos=0x00

16:03:22 	Default DROP 	TCP 	

173.230.157.252 	: 	443

	→ 	

91.176.31.193 	: 	64337

	

[ACK PSH] 	len=409 	ttl=54 	tos=0x00

16:03:27 	Default DROP 	TCP 	

173.230.157.252 	: 	443

	→ 	

91.176.31.193 	: 	64337

	

[ACK PSH] 	len=409 	ttl=54 	tos=0x00

16:03:35 	Default DROP 	TCP 	

173.230.157.252 	: 	443

	→ 	

91.176.31.193 	: 	64337

	

[ACK PSH] 	len=409 	ttl=54 	tos=0x00

16:03:53 	Default DROP 	TCP 	

173.230.157.252 	: 	443

	→ 	

91.176.31.193 	: 	64337

	

[ACK PSH] 	len=409 	ttl=54 	tos=0x00

16:04:27 	Default DROP 	TCP 	

173.230.157.252 	: 	443

	→ 	

91.176.31.193 	: 	64337

	

[ACK PSH] 	len=409 	ttl=54 	tos=0x00

16:06:21 	Default DROP 	TCP 	

172.16.15.112 	: 	51425

	→ 	

69.171.234.48 	: 	9999

	

[SYN] 	len=60 	ttl=63 	tos=0x00 	srcmac=0:1a:4d:49:b:5d 	dstmac=8:0:27:fd:96:e3

16:06:22 	Default DROP 	TCP 	

172.16.15.112 	: 	51426

	→ 	

69.171.234.48 	: 	9999

	

[SYN] 	len=60 	ttl=63 	tos=0x00 	srcmac=0:1a:4d:49:b:5d 	dstmac=8:0:27:fd:96:e3

16:06:24 	Default DROP 	TCP 	

172.16.15.112 	: 	51425

	→ 	

69.171.234.48 	: 	9999

	

[SYN] 	len=60 	ttl=63 	tos=0x00 	srcmac=0:1a:4d:49:b:5d 	dstmac=8:0:27:fd:96:e3

16:06:28 	Default DROP 	TCP 	

172.16.15.112 	: 	51425

	→ 	

69.171.234.48 	: 	9999

	

[SYN] 	len=60 	ttl=63 	tos=0x00 	srcmac=0:1a:4d:49:b:5d 	dstmac=8:0:27:fd:96:e3

The facebook.com:9999 was forced by me to show that stuff did get logged even after the nc6 timed out.

Ok lets do it once more shall we? This time with the rule that allows internal -> http -> internet IPv4 + IPv6 set to log!

sjorge@saxion ~ $ date

Wed Apr 11 16:07:44 CEST 2012

sjorge@saxion ~ $ date

Wed Apr 11 16:11:51 CEST 2012

sjorge@saxion ~ $ nc6 -v 2001:1938:81:164::2 80

nc6: timeout while connecting to cl-357.phx-01.us.sixxs.net (2001:1938:81:164::2) 80 [http]

nc6: unable to connect to address 2001:1938:81:164::2, service 80

sjorge@saxion ~ $ date

Wed Apr 11 16:13:29 CEST 2012



16:07:31 	Default DROP 	TCP 	

172.16.15.112 	: 	51432

	→ 	

69.171.234.48 	: 	9999

	

[SYN] 	len=60 	ttl=63 	tos=0x00 	srcmac=0:1a:4d:49:b:5d 	dstmac=8:0:27:fd:96:e3

16:07:39 	Default DROP 	TCP 	

172.16.15.112 	: 	51432

	→ 	

69.171.234.48 	: 	9999

	

[SYN] 	len=60 	ttl=63 	tos=0x00 	srcmac=0:1a:4d:49:b:5d 	dstmac=8:0:27:fd:96:e3

16:07:55 	Default DROP 	TCP 	

172.16.15.112 	: 	51432

	→ 	

69.171.234.48 	: 	9999

	

[SYN] 	len=60 	ttl=63 	tos=0x00 	srcmac=0:1a:4d:49:b:5d 	dstmac=8:0:27:fd:96:e3

16:08:41 	Default DROP 	HTTP 	

91.176.135.102 	: 	64520

	→ 	

91.176.31.193 	: 	80

	

[SYN] 	len=64 	ttl=62 	tos=0x00

16:08:43 	Default DROP 	TCP 	

91.176.135.102 	: 	64522

	→ 	

91.176.31.193 	: 	10424

	

[SYN] 	len=64 	ttl=62 	tos=0x00

16:08:44 	Default DROP 	TCP 	

91.176.135.102 	: 	64522

	→ 	

91.176.31.193 	: 	10424

	

[SYN] 	len=64 	ttl=62 	tos=0x00

16:08:45 	Default DROP 	TCP 	

91.176.135.102 	: 	64522

	→ 	

91.176.31.193 	: 	10424

	

[SYN] 	len=64 	ttl=62 	tos=0x00

16:09:03 	Default DROP 	UDP 	

91.176.135.102 	: 	14527

	→ 	

91.176.31.193 	: 	10424

	

len=192 	ttl=62 	tos=0x00

16:09:07 	Default DROP 	UDP 	

91.176.135.102 	: 	14527

	→ 	

91.176.31.193 	: 	10424

	

len=192 	ttl=62 	tos=0x00

16:09:55 	Packet filter rule #9 	TCP 	

172.16.15.113 	: 	49213

	→ 	

193.41.233.25 	: 	443

	

[ACK] 	len=40 	ttl=127 	tos=0x00 	srcmac=0:26:c7:64:2b:50 	dstmac=8:0:27:fd:96:e3

16:10:15 	Packet filter rule #9 	TCP 	

2001:6f8:1480:15:21a:4dff:fe49:b5d 	: 	56416

	→ 	

2001:1938:81:164::2 	: 	80

	

[SYN] 	len=80 	srcmac=0:1a:4d:49:b:5d 	dstmac=8:0:27:fd:96:e3

16:10:51 	Packet filter rule #9 	TCP 	

172.16.15.101 	: 	53598

	→ 	

17.158.28.48 	: 	443

	

[SYN] 	len=64 	ttl=63 	tos=0x00 	srcmac=e0:f8:47:99:c2[:D]b 	dstmac=8:0:27:fd:96:e3

16:10:52 	Packet filter rule #9 	TCP 	

172.16.15.101 	: 	53599

	→ 	

17.158.28.48 	: 	443

	

[SYN] 	len=64 	ttl=63 	tos=0x00 	srcmac=e0:f8:47:99:c2[:D]b 	dstmac=8:0:27:fd:96:e3

16:10:53 	Packet filter rule #9 	TCP 	

172.16.15.101 	: 	53600

	→ 	

17.158.28.48 	: 	443

	

[SYN] 	len=64 	ttl=63 	tos=0x00 	srcmac=e0:f8:47:99:c2[:D]b 	dstmac=8:0:27:fd:96:e3

16:10:54 	Packet filter rule #9 	TCP 	

172.16.15.101 	: 	53601

	→ 	

17.158.28.48 	: 	443

	

[SYN] 	len=64 	ttl=63 	tos=0x00 	srcmac=e0:f8:47:99:c2[:D]b 	dstmac=8:0:27:fd:96:e3

16:12:00 	Packet filter rule #9 	TCP 	

172.16.15.112 	: 	34501

	→ 	

74.125.230.117 	: 	443

	

[SYN] 	len=60 	ttl=63 	tos=0x00 	srcmac=0:1a:4d:49:b:5d 	dstmac=8:0:27:fd:96:e3

16:12:04 	Packet filter rule #9 	TCP 	

172.16.15.101 	: 	53601

	→ 	

17.158.28.48 	: 	443

	

[SYN] 	len=48 	ttl=63 	tos=0x00 	srcmac=e0:f8:47:99:c2[:D]b 	dstmac=8:0:27:fd:96:e3

16:12:05 	Packet filter rule #9 	TCP 	

172.16.15.112 	: 	50084

	→ 	

173.194.41.171 	: 	443

	

[SYN] 	len=60 	ttl=63 	tos=0x00 	srcmac=0:1a:4d:49:b:5d 	dstmac=8:0:27:fd:96:e3

16:12:09 	Packet filter rule #9 	TCP 	

172.16.15.112 	: 	34503

	→ 	

74.125.230.117 	: 	443

	

[SYN] 	len=60 	ttl=63 	tos=0x00 	srcmac=0:1a:4d:49:b:5d 	dstmac=8:0:27:fd:96:e3

16:12:13 	Packet filter rule #9 	TCP 	

172.16.15.112 	: 	47595

	→ 	

74.125.230.125 	: 	443

	

[SYN] 	len=60 	ttl=63 	tos=0x00 	srcmac=0:1a:4d:49:b:5d 	dstmac=8:0:27:fd:96:e3

16:12:15 	Packet filter rule #9 	TCP 	

172.16.15.112 	: 	54152

	→ 	

74.125.230.97 	: 	443

	

[SYN] 	len=60 	ttl=63 	tos=0x00 	srcmac=0:1a:4d:49:b:5d 	dstmac=8:0:27:fd:96:e3

The 2nd logged hit of the rule clearly shows that the connection has passed through the firewall and was accepted.

I'm feeling less and less likely this a web filtering bug, but something is still going wrong [:(]

[8.920][BUG] IPv6 connection issues (was: Proxy does not handle dual stack servers!)

Submitted a Tech Support Case lately from the Support Portal?