Join Log in
Score:1
avatar Server

Global Accelerator IPv6 Cannot Connect

in flag
Gregor

I have dual-stack ALBs in eu-west-1 (Dublin) and ap-southeast-2 (Sydney).

  • port 80 redirects to https
  • port 443 forwards to a target group (IPv4)

I can reach both target groups on IPv4 and IPv6 just fine by going directly to the ALBs (in each region).

Now I create a dual-stack GA with endpoints pointing at those two ALB.

  • endpoints are marked HEALTHY
  • I can get a normal response from the GA IPv4 address. My traffic is sent to one of the ALBs.
  • I get nothing when I try to connect via the GA IPv6 address (timeout on TCP connection).
  • I can ping the IPv6 GA addresses
  • I've checked ACLs, security groups etc.
  • Failure seems like it should not be caused by the target group, security-group or VPC, because I can reach everything by going to ALB directly (IPv6).

Any hints? What am I missing?

Updated... VPC flow logs often show a srcaddr of 0:0:0:0:0:0:0:0 (ACCEPT OK) followed by a reply to dstaddr 0:0:0:0:0:0:0:0 (REJECT OK).

  • probably because 0:0:0:0:0:0:0:0 is not a valid address?
  • I don't know why I would see a srcaddr 0:0:0:0:0:0:0:0

Sometimes, however, I see a correct IPv6 srcaddr (ACCEPT OK) followed by a reply to a correct dstaddr (ACCEPT OK), however, I still get ' Connection timed out' from curl, running on my home IPv6 address or an EC2 intance with public IPv6 address.

  • I verify that I have good IPv6 access by doing curl -6 https://yahoo.com
123
1 + 1
Tim avatar
gp flag
Tim
There's not enough information to offer much help. If I was looking at this I'd look in many areas of the console to discover the configuration, probably more than is practical to post screenshots of. One note is IPv6 is routed separately from IPv4, and SG rules are done separately, you probably know those though. VPC Flow Logs might be worth reviewing.
2
Reply
Score:0
avatar Server
in flag
Gregor

I was eventually able to get this working by changing the VPC ACL to include ALL TCP traffic (port 0 to 65535 in terraform) for ::/0, rather than just ports 80 and 443.

Allowing ports 80 and 443 in ACL worked without the Global Accelerator (ALB direct), however, because of how the Global Accelerator endpoints (eni) attach to the VPC, the destination port, in the ACL is actually the source port from the Global Accelerator.

  • I had not noticed in my earlier investigation that all traffic was allowed for IPv4 but only ports 80 and 443 was allowed for IPv6.
+ 0
ธงชาติไทย
Elon Musk
I sit in a Tesla and translated this thread with Ai:

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.