'Last IP address' being prefixed by '::ffff:'

Product Support

AI-generated summary

The discussion revolves around an issue where the “Last IP address” of a user’s profile is prefixed with ::ffff:, causing IP lookup issues. AstonJ suspects it might be related to a recent addition of an IPv6 record. codinghorror cannot reproduce the issue, and AstonJ discovers that the prefix is a subnet prefix for IPv4 addresses in an IPv6 space.

Falco confirms that the meta site is now fully IPv6 compatible, and AstonJ realizes they use a reverse proxy (HAProxy) which might be causing the issue. Falco suggests that the problem might be due to the reverse proxy configuration.

AstonJ updates the HAProxy configuration but still encounters issues. supermathie suggests an alternative configuration, but it doesn’t resolve the problem. AstonJ provides a full report, and supermathie identifies the issue as being caused by a link-local IPv6 address. AstonJ eventually resolves the issue by changing the server configuration from “IPv6 discovery” to “Static configuration” and adding the IPv6 range manually.

1

This appears to have started recently - if you go to a user’s profile > admin - their last IP address is shown as prefixed with ::ffff: (and so when you do an ip lookup it does not work).

4

No repro here on meta.

5

Could this be related:

I did add a record to allow IPv6 recently, so could that be it? Do you have IPv6 enabled here?

6

This (meta) is running on AWS as a dogfooding experiment, so it is possible it is not, because as I understand it AWS doesn’t use ipv6 at all.. but we’d need to ask @mpalmer

7

Meta is now fully IPv6 compatible.

8

Nice! Were you getting the ::ffff: problem too?

9

It looks just fine for me:

image

I bet a beer you use a reverse proxy and not vanilla Discourse with only the internal nginx :beers:

10

Sorry only just coming back to this. Yes I use HAProxy on the front :slight_smile:

Do I need to do anything special on the Discourse side to enable IPV6?

On the HAProxy side I believe I have changed everything I need to, specifically:

bind *:80
to
bind :::80 v4v6

and

bind *:443 ssl crt /etc/haproxy/certs/
to
bind :::443 v4v6 ssl crt /etc/haproxy/certs/

On http://ready.chair6.net everything passes except for:

IPv6 Connectivity - FAIL - Could not connect (to site) on port 443 over IPv6.

Any idea what I might be missing?

11

Try instead using two lines as follows:

bind *:80
bind :::80 

bind *:443 ssl crt /etc/haproxy/certs/
bind :::443 ssl crt /etc/haproxy/certs/
12

Hi Michael, updated to:

  #bind *:80
  #bind :::80 v4v6
  #bind *:443 ssl crt /etc/haproxy/certs/
  #bind :::443 v4v6 ssl crt /etc/haproxy/certs/
  bind *:80
  bind :::80 
  bind *:443 ssl crt /etc/haproxy/certs/
  bind :::443 ssl crt /etc/haproxy/certs/

But I’m still getting the same thing. Here’s the full report in case it helps.

13

fe80::6e62:6dff:fe46:abf9 is a link-local address, only intended to be used by a machine on the same broadcast domain as the server. Nothing else on the Internet will ever be able to connect to it.

Does the server have a “real” IPv6 address (such as something starting with a 2)?

14

Awesome - fixed! (I needed to change my server from IPv6 discovery to Static configuration and add the range manually.)

Thanks for your help :heart: