How to configure Cloud Firewall for SSH over IPV6?

This SSH command below hangs, and it seems to be due to it defaulting to the IPV6 address. When I add the "-4" option to force SSH to use IPV4 it connects fine.

Data has been obfuscated for privacy. It hangs after the last debug line, but after a long delay it will automatically retry with the IPV4 address and connect.

$ ssh -vvv -p <port> admin@myhost.com -i ~/.ssh/id_rsa_linode                                                                                     
OpenSSH_9.0p1, LibreSSL 3.3.6
debug1: Reading configuration data /Users/myuser/.ssh/config
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 21: include /etc/ssh/ssh_config.d/* matched no files
debug1: /etc/ssh/ssh_config line 54: Applying options for *
debug3: expanded UserKnownHostsFile '~/.ssh/known_hosts' -> '/Users/myuser/.ssh/known_hosts'
debug3: expanded UserKnownHostsFile '~/.ssh/known_hosts2' -> '/Users/myuser/.ssh/known_hosts2'
debug1: Authenticator provider $SSH_SK_PROVIDER did not resolve; disabling
debug2: resolving "myhost.com" port <port>
debug3: resolve_host: lookup myhost.com:<port>
debug3: ssh_connect_direct: entering
debug1: Connecting to myhost.com [####:####::####:####:####:####] port <port>.
debug3: set_sock_tos: set socket 5 IPV6_TCLASS 0x48

I'm using the Cloud Firewall to protect my host. But when I try to add an inbound rule to enable SSH/TCP via IPV6, I am unable to save the added rule.

I see the following error when I try to save it:

Must contain only valid IPv6 addresses or networks (both must be in ip/mask format)

Note that cloned the IPV4 SSH rule and copied the IPV6 address displayed by "ip addr", including the netmask. Except for the copied IPV6 address, the new rule is identical to the existing working IPV4 SSH rule.

What am I doing wrong?

Thanks in advance!

1 Reply

I suggest adding /128 to the end of the IPv6 address you're adding to your Cloud Firewall rule.

When I tested this, I first tried to add /48 to the end of the IPv6 address like they show in the Cloud Firewall Documentation. I also tried /64 and /56, all which returned the same error you saw:

"Must contain only valid IPv6 addresses or networks (both must be in ip/mask format)"

So instead, I just put in my IPv6 address in the IP/Netmask field, clicked the Add Changes button, and when I did, the system added /128 automatically. When I saved that configuration, I did not receive the error, my Cloud Firewall rule saved, and everything worked as expected.

Reply

Please enter an answer
Tips:

You can mention users to notify them: @username

You can use Markdown to format your question. For more examples see the Markdown Cheatsheet.

> I’m a blockquote.

I’m a blockquote.

[I'm a link] (https://www.google.com)

I'm a link

**I am bold** I am bold

*I am italicized* I am italicized

Community Code of Conduct