Saludos muy especial para [Gatito] http://gatito.ygg.at #Yggdrasil #ipv6

acabo de montar un ssh-chat: ssh tunick@.ygg.at #Yggdrasil #ipv6

Hey siento poco animo con las nuevas aventuras.. ³Yggdrasil #Deltachat #ipv6 #i2p #tor #selfhoting #community

Un servidor casero totalmente declarativo.. todo esta ahi.. #NixOS! #ipv6 #ygg #b

Algunas fallas pero segumos en pie! Dnet! #ipv6 #ygg #b #radio

Buscame en Yggdrasil http://dev1ls.ygg.at/ #NixOS #ipv6 #yggdrasil #Domain

Nuevo Post: https://dev1ls.deno.dev/yggdrasil-la-red-mesh-ipv6-descentralizada #NixOS #ipv6 #yggdrasil #Dev

Empezamos con nixos-containers y ya tenemos #ergo y #honk deforma declarativa.. y todo bajo la ipv6 de #yggdrasil

yggdrasil Network #ygg #httpd #ergo #ipv6

Hey @lyse@lyse.isobeef.org thanks for noticing. I think I had a DNS record pointing to the old IPv6 host. Is the issue gone now?

It turns out my ISP supports ipv6. After 4-5 months with only ipv4, I thought to ask customer support, and they told me how to turn it on. (I’m pretty happy with ebox so far. Low-priced fibre with no issues so far. Though all my traffic goes through Montreal, 500km away from me in Toronto, which adds a few ms to network latency.)

@lyse@lyse.isobeef.org

But then, why just block IPv4 and not also IPv6?

I’ll take “what’s the most overlooked thing in corporate networks” for 200. 😅

Thank you, @movq@www.uninformativ.de! Luckily, I can disable it. I also tried it, no luck, though. But the problem is, I don’t really know how much snakeoil actually runs on my machine. There is definitely a ClownStrike infestation, I stopped the falcon sensor. But there might be even more, I’ve no idea. From the vague answers I got last time, it feels like even the UHD/IT guys don’t know what is in use. O_o

Yeah, it is definitely something on my laptop that rejects connections to IPv4 ports 80 and 443. All other devices here can access the stuff without issue, only this work machine is unable to. The “Connection refused” happens within a few milliseconds.

Unfortunately, I do not have the slightest idea how it works. But maybe I can look into that tomorrow. Kernel modules are a very good hint, thank you! <3

You’re right, it might be some sort of fail-safe mechanism. But then, why just block IPv4 and not also IPv6? But maybe because the VPN and company servers require IPv4, there is zero IPv6 support. (Yeah, don’t ask, I don’t understand it either.)

Fuck me dead, what a giant piece of shit. On my Linux work laptop I have the problem that some unknown snakeoil “security” junk is dropping any IPv4 connections to ports 80 and 443. All other ports and IPv6 seem unaffected. I get an immediate “connection refused” when trying to estabslish a connection.

I had this problem four weeks ago on Friday morning the very first time at home. On Thursday evening, everything was perfectly fine. Eventually, I plugged in the LAN cable in the office and everything got automatically fixed. Nobody can explain what’s happening.

Then, last week Friday morning out of the blue, the same issue was back. So, I went to the office yesterday and it got fixed again by plugging in the network cable. This evening, I have exactly the same bloody problem again.

What the hell is going on? Does anyone have any ideas? I’m certainly not an expert, but I don’t see anything suspicious in iptables or nft rules. I also do not see anything showing up in /var/log/kern.log. Even tried to stop firewalld, flush the iptables and nft rules, but that didn’t result in any changes.

@xuu@txt.sour.is Wow. txt.sour.is has IPv6, so are you hosting it on one of those VMs or is it a reverse proxy back home?

@mckinley@twtxt.net for me:

• a wall mount 6U rack which has:
  
  • 1U patch panel
    
  • 1U switch
    
  • 2U UPS
    
  • 1U server, intel atom 4G ram, debian (used to be main. now just has prometheus)
    
• a mini ryzon 16 core 64G ram, fedora (new main)
  
  • multiple docker services hosted.
    
• synology nas with 4 2TB drives
  
• turris omnia WRT router -> fiber uplink
  

network is a mix of wireguard, zerotier.

• wireguard to my external vms hosted in various global regions.
  
  • this allows me ingress since my ISP has me behind CG-NAT
    
• zerotier is more for devices for transparent vpn into my network
  

i use ssh and remote desktop to get in and about. typically via zerotier vpn. I have one of my VMs with ssh on a backup port for break glass to get back into the network if needed.

everything has ipv6 though my ISP does not provide it. I have to tunnel it in from my VMs.

QOTD: What do you host on your home server? How do you host it? Are you using containers? VMs? Did you install any management interface or do you just SSH in? What OS does it run?

Mine runs Arch (btw) and hosts a handful of things using Docker. Adguard Home, http://mckinley2nxomherwpsff5w37zrl6fqetvlfayk2qjnenifxmw5i4wyd.onion/, and some other things. NFS, Flexo, and Wireguard (peer and bounce server in my personal network) are outside Docker. I have a hotkey in my window manager that spawns a terminal on my server using SSH. It makes things very easy and I highly recommend it.

I am thinking about replacing Docker with Podman because the Common Wisdom seems to say it’s better. I don’t really know if it is or isn’t.

Also, how much of your personal infrastructure is on IPv6? I think all the software I use supports both, but I’ve mostly been using IPv4 because it’s easier to remember the addresses. I’ve been working for the last couple days on making it IPv6-only.

AWS: Cannot Escape IPv4

more than 90% of all AWS service API endpoints do not support IPv6

Sounds like AWS is instituting an IPv4 tax soon.

@xuu@txt.sour.is ah, well, I think it’s on 1.0.x now but it picked up ipv6 support in 0.10.x

@prologic@twtxt.net wow that’s wild. The ISPs I’ve had in the last few years supported ipv6. The one I have now does.

@xuu@txt.sour.is “yet”? It’s supported ipv6 for like 6 years now.

@abucci@anthony.buc.ci does fail2ban work with ipv6 yet?

@fastidious@arrakis.netbros.com (#twksmyq) IPv6 because localhost -> ::1 is preferred on linux over ol’ 127.0.0.1

Now this is very useful.. it means when yarn is doing an HTTP request to itself its not closing the connection. that could mean a http.Response Body is not getting closed.