Guest User!

You are not Sophos Staff.

Thread Info
  • State Not Answered
  • Replies 41 replies
  • Subscribers 0 subscribers
  • Views 22839 views
  • Users 0 members are here
Options
Suggested

[8.920][BUG] IPv6 connection issues (was: Proxy does not handle dual stack servers!)

sjorge
Since swapping my ASG v8 with v9 beta I'm having problems accessing dual-stack enabled servers.

Servers like my own (blackdot.be) or even astaro.org time out when using the HTTP Proxy. If I disable the IPv6 DNS entry it works fine. So I know it is IPv6 related.

2012:04:10-23:12:16 inertia httpproxy[10369]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="GET" srcip="2001:6f8:1480:15:11a8:c2f0:eb92[:D]869" dstip="2a02:788:12:38::5" user="" statuscode="502" cached="0" profile="REF_DefaultHTTPProfile (Default Proxy)" filteraction="REF_DefaultHTTPCFFAction (Default content filter action)" size="2850" request="0x841e5c8" url="http://www.astaro.com/sites/all/themes/yaml/layouts/yaml_astaro/images/en-int/myastaro.png" exceptions="" error="Connection to server timed out"
2012:04:10-23:12:16 inertia httpproxy[10369]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="GET" srcip="2001:6f8:1480:15:11a8:c2f0:eb92[:D]869" dstip="2a02:788:12:38::5" user="" statuscode="502" cached="0" profile="REF_DefaultHTTPProfile (Default Proxy)" filteraction="REF_DefaultHTTPCFFAction (Default content filter action)" size="2746" request="0x836ccf0" url="http://www.astaro.com/elqNow/elqCfg.js" exceptions="" error="Connection to server timed out"
2012:04:10-23:12:16 inertia httpproxy[10369]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="GET" srcip="2001:6f8:1480:15:11a8:c2f0:eb92[:D]869" dstip="2a02:788:12:38::5" user="" statuscode="502" cached="0" profile="REF_DefaultHTTPProfile (Default Proxy)" filteraction="REF_DefaultHTTPCFFAction (Default content filter action)" size="2746" request="0x836cb88" url="http://www.astaro.com/elqNow/elqImg.js" exceptions="" error="Connection to server timed out"
2012:04:10-23:12:33 inertia httpproxy[10369]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="GET" srcip="2001:6f8:1480:15:11a8:c2f0:eb92[:D]869" dstip="2a02:788:12:38::5" user="" statuscode="502" cached="0" profile="REF_DefaultHTTPProfile (Default Proxy)" filteraction="REF_DefaultHTTPCFFAction (Default content filter action)" size="2836" request="0xbcd35198" url="http://www.astaro.com/sites/all/themes/yaml/layouts/yaml_astaro/css/navigations.css" exceptions="" error="Connection to server timed out"
2012:04:10-23:12:33 inertia httpproxy[10369]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="GET" srcip="2001:6f8:1480:15:11a8:c2f0:eb92[:D]869" dstip="2a02:788:12:38::5" user="" statuscode="502" cached="0" profile="REF_DefaultHTTPProfile (Default Proxy)" filteraction="REF_DefaultHTTPCFFAction (Default content filter action)" size="2742" request="0xbcd06768" url="http://www.astaro.com/misc/jquery.js" exceptions="" error="Connection to server timed out"
2012:04:10-23:12:33 inertia httpproxy[10369]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="GET" srcip="2001:6f8:1480:15:11a8:c2f0:eb92[:D]869" dstip="2a02:788:12:38::5" user="" statuscode="502" cached="0" profile="REF_DefaultHTTPProfile (Default Proxy)" filteraction="REF_DefaultHTTPCFFAction (Default content filter action)" size="2850" request="0x830fb68" url="http://www.astaro.com/sites/all/themes/yaml/layouts/yaml_astaro/images/en-int/myastaro.png" exceptions="" error="Connection to server timed out"
2012:04:10-23:12:34 inertia httpproxy[10369]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="GET" srcip="2001:6f8:1480:15:11a8:c2f0:eb92[:D]869" dstip="2a02:788:12:38::5" user="" statuscode="502" cached="0" profile="REF_DefaultHTTPProfile (Default Proxy)" filteraction="REF_DefaultHTTPCFFAction (Default content filter action)" size="2746" request="0x834f060" url="http://www.astaro.com/elqNow/elqCfg.js" exceptions="" error="Connection to server timed out"
2012:04:10-23:12:34 inertia httpproxy[10369]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="GET" srcip="2001:6f8:1480:15:11a8:c2f0:eb92[:D]869" dstip="2a02:788:12:38::5" user="" statuscode="502" cached="0" profile="REF_DefaultHTTPProfile (Default Proxy)" filteraction="REF_DefaultHTTPCFFAction (Default content filter action)" size="2746" request="0x830fe38" url="http://www.astaro.com/elqNow/elqImg.js" exceptions="" error="Connection to server timed out"
2012:04:10-23:13:34 inertia httpproxy[10369]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="GET" srcip="2001:6f8:1480:15:11a8:c2f0:eb92[:D]869" dstip="2a02:788:12:38::5" user="" statuscode="502" cached="0" profile="REF_DefaultHTTPProfile (Default Proxy)" filteraction="REF_DefaultHTTPCFFAction (Default content filter action)" size="2742" request="0x830fb68" url="http://www.astaro.com/misc/jquery.js" exceptions="" error="Connection to server timed out"
2012:04:10-23:14:14 inertia httpproxy[10369]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="GET" srcip="2001:6f8:1480:15:11a8:c2f0:eb92[:D]869" dstip="2001:1938:81:164::2" user="" statuscode="502" cached="0" profile="REF_DefaultHTTPProfile (Default Proxy)" filteraction="REF_DefaultHTTPCFFAction (Default content filter action)" size="2708" request="0x834f768" url="http://blackdot.be/" exceptions="" error="Connection to server timed out"
2012:04:10-23:14:35 inertia httpproxy[10369]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="GET" srcip="2001:6f8:1480:15:11a8:c2f0:eb92[:D]869" dstip="2a02:788:12:38::5" user="" statuscode="502" cached="0" profile="REF_DefaultHTTPProfile (Default Proxy)" filteraction="REF_DefaultHTTPCFFAction (Default content filter action)" size="2746" request="0x834f060" url="http://www.astaro.com/elqNow/elqCfg.js" exceptions="" error="Connection to server timed out"
2012:04:10-23:14:35 inertia httpproxy[10369]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="GET" srcip="2001:6f8:1480:15:11a8:c2f0:eb92[:D]869" dstip="2a02:788:12:38::5" user="" statuscode="502" cached="0" profile="REF_DefaultHTTPProfile (Default Proxy)" filteraction="REF_DefaultHTTPCFFAction (Default content filter action)" size="2850" request="0x830fb68" url="http://www.astaro.com/sites/all/themes/yaml/layouts/yaml_astaro/images/en-int/myastaro.png" exceptions="" error="Connection to server timed out"
2012:04:10-23:14:43 inertia httpproxy[10369]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="GET" srcip="172.16.15.111" dstip="2001:1938:81:164::2" user="" statuscode="502" cached="0" profile="REF_DefaultHTTPProfile (Default Proxy)" filteraction="REF_DefaultHTTPCFFAction (Default content filter action)" size="2708" request="0x83a3300" url="http://www.blackdot.be/" exceptions="" error="Connection to server timed out" 
Parents
  • 0
    @sjorge: Thanks for the file! This gets a bit complicated here [;)]
    Your AICCU tunnel uses ipv6 in ipv4. Nothing wrong with that, but I thought aiccu would be default.
    So I thought this is the issue, IPS has hick-ups with that kind of traffic.
    However I setup a system with the same mode, but works fine for me.
    Also imported your backup, enabled IPS again and tried again. Also works for me.

    So could you enable IPS again and try again?
    * Anything in ips.log while you try to establish a IPv6 connection
    * See if IPv6 in IPv4 traffic is leaving the ASG: tcpdump -n -i any proto 41

    @William: Is your problem also IPS related? If not, please open another thread.
    If yes, what IPv6 connectivity do you have?

    Cheers
     Ulrich
  • 0 in reply to da_merlin
    This gets a bit complicated here [;)]


    I think that's my fault because I merged William's and sjorge's thread together.

    The merged posts are those: one, two and three

    Cheers,
    Cristof
Reply Children
No Data
Share Feedback
×

Submitted a Tech Support Case lately from the Support Portal?