undefined | Better HN

0 pointstyingq4y ago0 comments

I'm unclear on how you suddenly know exactly what the issue was. I didn't say anything about a firewall.

0 comments

4 comments · 1 top-level

alar444y ago· 3 in thread

I worked at an MSP during the peak of covid getting remote workers at many different companies settled in. When turning off IPv6 solved connectivity problems, 100% of the time it was because IPv6 DNS was taking precedence over IPv4. IPv6 DNS request gets sent over VPN, firewall doesn't know how to resolve it, and you can't get to anything on the network. Turn that off and the IPv4 requests are happily resolved. I'm not sure what else that problem could possibly be other than maybe misconfigured domain controllers, but that seems pretty unlikely if dual stack was enabled on the firewall as that is not the default in my experience.

tyingqOP4y ago

Google, for example, "ipv6 anyconnect" and you will see issues that are solely on the PC before it ever gets to a firewall.

alar444y ago

Yikes. Pushing IPv6 traffic through the IPv4 tunnel is just bad software design, seems like a bug. That's just bizarre. Incidentally, none of our clients used that. The issue is similar though, but different root causes.

zamadatix4y ago

Nothing wrong with doing that in the slightest. Just because the user's home internet is IPv4 does not mean corporate side v6 services should be unreachable. Either way the user is going through a tunnel to reach things, it doesn't matter if what's inside the tunnel is the same as what's outside it... it's a tunnel! Doesn't even have to be IP!

Now that doesn't mean things can't get misconfigured or poorly set up in that regard but by no means is the concept just wrong, I have several clients it has been useful for.

j / k navigate · click thread line to collapse