CentOS - Apr 2020 - Diagnosing IPv6 routing

I discovered that IPv6 is sort of working when I got an email rejection 
from Comcast for not having an IPv6 PTR record. I discovered I could telnet 
to port 25 on their MX server over IPv6! I then found I could tracroute6 to 
them, but I couldn't to my Linode VPS in Fremont. It gets to the data 
center and stops. Going the other way, my Linode can traceroute6 almost to 
my AT&T-hosted server. Neither can reach the open port 25 on the other, but 
both can reach mx1.comcast.net via IPv6.

I dropped the firewall ("systemctl stop firewalld", confirmed with 
"ip6tables -L -v -n") on my Fremont server and still can't
traceroute6 or
ping6 it. Nor can I do so from my home system on Comcast.

What else could be blocking ping6, traceroute6, and telnet to port 25 on 
IPv6?
>From AT&T host to Linode host:
[root at saruman ~]# traceroute6 2600:3c01::f03c:91ff:febc:e22d
traceroute to 2600:3c01::f03c:91ff:febc:e22d 
(2600:3c01::f03c:91ff:febc:e22d), 30 hops max, 80 byte packets
 1  2001:1890:1837:5b00::1 (2001:1890:1837:5b00::1)  3.230 ms  3.181 ms 
3.137 ms
 2  2001:1890:c05:2f3a::ee6e:61cd (2001:1890:c05:2f3a::ee6e:61cd)  6.906 ms 
6.901 ms  6.870 ms
 3  ok3ca81crs.ipv6.att.net (2001:1890:ff:ffff:12:123:6:98)  8.305 ms 
8.254 ms  8.258 ms
 4  sffca21crs.ipv6.att.net (2001:1890:ff:ffff:12:122:110:65)  14.199 ms 
14.164 ms  14.153 ms
 5  sffca401igs.ipv6.att.net (2001:1890:ff:ffff:12:122:114:5)  9.861 ms 
10.163 ms *
 6  2001:1890:1fff:41e:192:205:32:222 (2001:1890:1fff:41e:192:205:32:222) 
9.789 ms  8.078 ms  7.365 ms
 7  linode-ic-342731-sjo-b21.c.telia.net (2001:2000:3080:1ac4::2)  6.788 ms 
6.327 ms  6.262 ms
 8  2600:3c01:3333:4::2 (2600:3c01:3333:4::2)  7.294 ms  7.728 ms  7.705 ms
 9  * * *
>From Linode to AT&T:
[root at linode2 ~]# traceroute6 2001:1890:1837:5b01::100
traceroute to 2001:1890:1837:5b01::100 (2001:1890:1837:5b01::100), 30 hops 
max, 80 byte packets
 1  2600:3c01::8678:acff:fe0d:79c1 (2600:3c01::8678:acff:fe0d:79c1)  0.783 
ms 2600:3c01::8678:acff:fe0d:a641 (2600:3c01::8678:acff:fe0d:a641)  0.834 
ms  0.972 ms
 2  2600:3c01:3333:4::1 (2600:3c01:3333:4::1)  0.645 ms  0.646 ms 
2600:3c01:3333:2::1 (2600:3c01:3333:2::1)  0.508 ms
 3  ix-ae-67-0.tcore1.sqn-san-jose.ipv6.as6453.net (2001:5a0:1000:500::a1) 
1.059 ms 2001:550:2:3::d9:1 (2001:550:2:3::d9:1)  1.967 ms 
ix-ae-67-0.tcore1.sqn-san-jose.ipv6.as6453.net (2001:5a0:100
 4  be2063.ccr21.sjc01.atlas.cogentco.com (2001:550:0:1000::9a36:1a1) 
2.340 ms 2001:1890:1fff:415:192:205:37:69 
(2001:1890:1fff:415:192:205:37:69)  3.209 ms  4.412 ms
 5  sffca21crs.ipv6.att.net (2001:1890:ff:ffff:12:122:114:6)  7.353 ms 
6.769 ms  5.379 ms
 6  ok3ca81crs.ipv6.att.net (2001:1890:ff:ffff:12:122:110:66)  4.785 ms 
6.158 ms  6.073 ms
 7  2001:1890:ff:ffff:12:122:119:125 (2001:1890:ff:ffff:12:122:119:125) 
3.401 ms  3.406 ms  3.469 ms
 8  ok3ca81crs.ipv6.att.net (2001:1890:ff:ffff:12:122:110:66)  8.444 ms 
8.415 ms 2001:1890:c05:2f3a::116e:61cd (2001:1890:c05:2f3a::116e:61cd) 
5.816 ms
 9  2001:1890:ff:ffff:12:122:119:125 (2001:1890:ff:ffff:12:122:119:125) 
4.688 ms  4.607 ms  4.565 ms
10  * * 2001:1890:c05:2f3a::116e:61cd (2001:1890:c05:2f3a::116e:61cd) 
6.732 ms
11  * * *

Once upon a time, Kenneth Porter <shiva at sewingwitch.com>
said:
> I discovered that IPv6 is sort of working when I got an email
> rejection from Comcast for not having an IPv6 PTR record. I
> discovered I could telnet to port 25 on their MX server over IPv6! I
> then found I could tracroute6 to them, but I couldn't to my Linode
> VPS in Fremont. It gets to the data center and stops. Going the
> other way, my Linode can traceroute6 almost to my AT&T-hosted
> server. Neither can reach the open port 25 on the other, but both
> can reach mx1.comcast.net via IPv6.
Yeah, unfortunately things like that can happen, v4 or v6 (like I
couldn't get to a local TV station's website a little while ago from my
home connection, but could from elsewhere).
>From your traceroutes, it kind of looks like it's possible that it's
something on your gateway (but I'm not really sure).  Do you have any
IPv6 firewall running there?

One other note about mail on v6 - not only do you need to have a valid
reverse (with matching forward) DNS record, you probably need to do TLS
with a valid cert (Let's Encrypt is free and easy).

-- 
Chris Adams <linux at cmadams.net>

--On Thursday, April 30, 2020 6:08 PM -0500 Chris Adams <linux at
cmadams.net>
wrote:
> From your traceroutes, it kind of looks like it's possible that
it's
> something on your gateway (but I'm not really sure).  Do you have any
> IPv6 firewall running there?
I dropped the firewall just to make sure it wasn't the issue. My 
connections to Linode eventually started working. Comparison to the 
traceroute I posted earlier shows a different router just before my server, 
so I suspect they had a bad router. I still can't connect the other way, 
towards AT&T. But routing must be working because replies from outbound 
connections are getting back. I'd file a ticket with AT&T but they still
haven't added my account to their ticket system after more than a week of 
service. So I'm stuck playing tag with the sales consultants.
> One other note about mail on v6 - not only do you need to have a valid
> reverse (with matching forward) DNS record, you probably need to do TLS
> with a valid cert (Let's Encrypt is free and easy).
Thanks for reminding me. I added an IPv6-only name for testing and for my 
reverse and need to add that to my certificate.