Exposing application on IPV6 Airtel Xstream for self hosting purpose

  • Thread starter Thread starter panic0
  • Start date Start date
  • Replies Replies 23
  • Views Views 2,781
P

panic0

Messages
11
Location
Chennai
ISP
Airtel
Using the ZTE F670LV9.0 for my airtel xstream broadband, Wanted to expose some local backend apps on ipv6. It seems to work in LAN but trying the ipv6 from WAN doesn't work. Even though my firewall is not enabled.
Unable to figure out what is wrong with my config, also there is no Gateway shown for the ipv6 in the routing table.

Location: Chennai
Here are some results of common network commands in linux -
#ip -6 address show#
Code: 
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 state UNKNOWN qlen 1000
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
3: wlo1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 state UP qlen 1000
    inet6 2401:4900:1cc8:c13c:62c7:9xxx:xxxx:xxxx/64 scope global temporary dynamic 
       valid_lft 56167sec preferred_lft 56167sec
    inet6 2401:4900:1cc8:c13c:7faf:1cxx:xxxx:xxxx/64 scope global dynamic mngtmpaddr noprefixroute 
       valid_lft 56167sec preferred_lft 56167sec
    inet6 fe80::65f6:e9f9:71f7:d5f5/64 scope link noprefixroute 
       valid_lft forever preferred_lft forever
#ip -6 route show default#
default via fe80::1 dev wlo1 proto ra metric 600 pref medium

#ping6 ipv6.google.com#
Code: 
PING ipv6.google.com(maa03s45-in-x0e.1e100.net (2404:6800:4007:82a::200e)) 56 data bytes
64 bytes from maa03s45-in-x0e.1e100.net (2404:6800:4007:82a::200e): icmp_seq=1 ttl=59 time=6.26 ms
64 bytes from maa03s45-in-x0e.1e100.net (2404:6800:4007:82a::200e): icmp_seq=2 ttl=59 time=6.19 ms
64 bytes from maa03s45-in-x0e.1e100.net (2404:6800:4007:82a::200e): icmp_seq=3 ttl=59 time=7.07 ms
64 bytes from maa03s45-in-x0e.1e100.net (2404:6800:4007:82a::200e): icmp_seq=4 ttl=59 time=6.95 ms
64 bytes from maa03s45-in-x0e.1e100.net (2404:6800:4007:82a::200e): icmp_seq=5 ttl=59 time=6.23 ms
64 bytes from maa03s45-in-x0e.1e100.net (2404:6800:4007:82a::200e): icmp_seq=6 ttl=59 time=6.68 ms
^C
--- ipv6.google.com ping statistics ---
6 packets transmitted, 6 received, 0% packet loss, time 5006ms
rtt min/avg/max/mdev = 6.189/6.562/7.071/0.357 ms

#traceroute -6 -T -p 443 www.cisa.gov#
Code: 
traceroute to www.cisa.gov (2600:140f:9800:19c::447a), 30 hops max, 80 byte packets
 1  2401:4900:1cc8:c13c:56ce:82ff:fe7a:fa94 (2401:4900:1cc8:c13c:56ce:82ff:fe7a:fa94)  1.948 ms  2.335 ms  2.300 ms
 2  2401:4900:1c28:8fff::1 (2401:4900:1c28:8fff::1)  9.284 ms  9.252 ms  9.213 ms
 3  2404:a800:3a00:1::4a5 (2404:a800:3a00:1::4a5)  7.706 ms 2404:a800:3a00:1::4a9 (2404:a800:3a00:1::4a9)  8.427 ms 2404:a800:3a00:1::4a5 (2404:a800:3a00:1::4a5)  9.097 ms
 4  * g2600-1417-0078-0000-0000-0000-0000-0001.deploy.static.akamaitechnologies.com (2600:1417:78::1)  13.156 ms *
 5  g2600-140f-9800-019c-0000-0000-0000-447a.deploy.static.akamaitechnologies.com (2600:140f:9800:19c::447a)  10.864 ms g2600-1417-0078-0000-0000-0000-0000-0001.deploy.static.akamaitechnologies.com (2600:1417:78::1)  24.494 ms g2600-140f-9800-019c-0000-0000-0000-447a.deploy.static.akamaitechnologies.com (2600:140f:9800:19c::447a)  11.668 ms
If someone has self-hosted on a similar setup please guide me as I am a noob when it comes to ipv6.
Let me know if any other configs I need to share.
 
Solution
ishanjain28
@panic0 That means the application is only listening on the loopback interface and of course it won't be accessible from any where except that machine.

Lookup "bind" or "listen" setting in the configuration of the application you are running and set it to [::] from [::1] to listen on all interfaces.
Sort by date Sort by votes
@panic0 On another machine in your local network, Can you reach http://[2401:4900:1cc8:c13c:7faf:1cxx:xxxx:xxxx]:8000/health ?
 
Upvote 0
I have taken VPN inward access of my Windows 10 system on Airtel's IPv6 (only for testing purposes) using the same router ZTE F670L many a times. However except setting Firewall to Low in ZTE I never needed to do any more settings therein. Of course my Firewall on Win 10 was also disabled.

However I used SoftEther VPN (free) cross platform VPN Server running as host, that as well offers free DDNS for IPv6 as well. So I always worked with DDNS instead of IP address.
Can you try running your webserver on some other non standard port for testing purposes.
80 & 8000 are quite common. While ISP's generally do not block 8000, just try it out.
Also try Softether VPN and see if you can make successful inward VPN connection on WAN.

Also I assume that you are testing from another PC/laptop on different Internet connection, may be using mobile Internet.

Edit1:

Just to be curious I tried Rebex Tiny Web Server on Windows in VM directly acquiring IPv4 & IPv6 from ZTE and I made a successful inward connection to the web server over the WAN using my mobile Internet.

See the screenshots. Of course Linux could be a bit different but point is I did not require any modifications anywhere in ZTE, except lowering the firewall. It was running on non standard port 1180 for http connection.

vCsX3wi.png



zIJ5UTO.png
 
Last edited:
Upvote 0
@ishanjain28 no I cannot reach http://[2401:4900:1cc8:8301:a099:dxxc:xxxx:xxxx]:8000/health from another device(mobile phone on same wifi) on LAN, The Site can not be reached ... ERR_CONNECTION_REFUSED is shown on the browser.
Querying on that ip on the same host machine(my computer where server is hosted) also returns the same Firefox can’t establish a connection to the server at http://[2401:4900:1cc8:8301:a099:dxxc:xxxx:xxxx]:8000/health.
 
Upvote 0
@panic0 That means the application is only listening on the loopback interface and of course it won't be accessible from any where except that machine.

Lookup "bind" or "listen" setting in the configuration of the application you are running and set it to [::] from [::1] to listen on all interfaces.
 
Upvote 0
Solution
yeah, my bad, sorry was not aware of this, @ishanjain28 I changed it from [::1] to [::] and I can access the servers from my phone on the same LAN. But not from WAN (mobile internet).
Both the firewalls are still off my pc and router.
Right now this is the Ip filter -
zte-ip-filter.png


and i have these ips rt now -
Code: 
wlo1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
    link/ether c8:21:58:ca:d3:48 brd ff:ff:ff:ff:ff:ff
    altname wlp4s0
    inet 192.168.1.21/24 brd 192.168.1.255 scope global dynamic noprefixroute wlo1
       valid_lft 83637sec preferred_lft 83637sec
    inet6 2401:4900:1cc8:8301:9869:1dx:1xxx:7xxx/64 scope global temporary dynamic 
       valid_lft 62332sec preferred_lft 62332sec
    inet6 2401:4900:1cc8:8301:a099:dxxx:axxx:3xxx/64 scope global dynamic mngtmpaddr noprefixroute 
       valid_lft 62332sec preferred_lft 62332sec
    inet6 fe80::65f6:e9f9:71f7:d5f5/64 scope link noprefixroute 
       valid_lft forever preferred_lft forever
 
Last edited:
Upvote 0
@panic0
Can you try specifying the exact address of the machine in firewall in the router? Maybe their implementation is idiotic and they do exact matches rather than looking it an address in the specified block
 
Upvote 0
If you are going to directly put the address on the web-browser, then you'd need to do in the following format:
[address]: port
e.g. [2404:6800:4007:82a::200e]:443

Else, check if the mobile connectivity to whatever device you are using to test has IPv6 connectivity.
 
Upvote 0
You must log in or register to reply here.
Back