I'm trying to get ipv6 working on nginx (nginx/1.19.6) for SSL. In my domain configs I have:
server {
listen 93.93.135.169:443 http2;
listen [::]:443 http2;
server_name backups.myserver.com;
....
}
..and then for the standard port;
server {
listen 93.93.135.169:80;
listen [::]:80;
server_name backups.myserver.com ;
...
}
Netstat shows nginx as listening on port 443 and 80:
netstat -tulpn | grep nginx
tcp 0 0 93.93.135.169:80 0.0.0.0:* LISTEN 1168/nginx: master
tcp 0 0 127.0.0.1:8084 0.0.0.0:* LISTEN 1168/nginx: master
tcp 0 0 93.93.135.169:443 0.0.0.0:* LISTEN 1168/nginx: master
tcp 0 0 0.0.0.0:9183 0.0.0.0:* LISTEN 5247/nginx: master
tcp6 0 0 :::80 :::* LISTEN 1168/nginx: master
tcp6 0 0 :::443 :::* LISTEN 1168/nginx: master
I can find the server find on ipv4 and ipv6:
root@admin3:~# ping -4 backups.myserver.com
PING backups.myserver.com (93.93.135.169) 56(84) bytes of data.
64 bytes from backups.myserver.com (93.93.135.169): icmp_seq=1 ttl=60 time=1.58 ms
^X^C
--- backups.myserver.com ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 1.575/1.575/1.575/0.000 ms
root@admin3:~# ping -6 backups.myserver.com
PING backups.myserver.com(2a00:1098:80:a0::1 (2a00:1098:80:a0::1)) 56 data bytes
64 bytes from 2a00:1098:80:a0::1 (2a00:1098:80:a0::1): icmp_seq=1 ttl=61 time=1.55 ms
^X64 bytes from 2a00:1098:80:a0::1 (2a00:1098:80:a0::1): icmp_seq=2 ttl=61 time=1.74 ms
On iptables, I get:
iptables --list -n | grep 443
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 multiport dports 80,443
iptables --list -n | grep 80
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 multiport dports 80,443
..and ip6tables:
ip6tables --list -n | grep 80
ACCEPT tcp ::/0 ::/0 state NEW tcp dpt:80
ip6tables --list -n | grep 443
ACCEPT tcp ::/0 ::/0 state NEW tcp dpt:443
Yet , when I test the site on https://ipv6-test.com/ with http, it works:
But as soon as I try SSL, I get:
Running a curl test from another server to it, I get:
curl -v -6 https://backups.myserver.com
* Trying 2a00:1098:80:a0::1:443...
* TCP_NODELAY set
* Connected to backups.myserver.com (2a00:1098:80:a0::1) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
* CAfile: /etc/ssl/certs/ca-certificates.crt
CApath: /etc/ssl/certs
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* error:1408F10B:SSL routines:ssl3_get_record:wrong version number
* Closing connection 0
curl: (35) error:1408F10B:SSL routines:ssl3_get_record:wrong version number
I'm running out of other things to try. Any suggestions?