Arch Linux

Dukecz

Member

Registered: 2012-11-04

Posts: 8

Website

[Solved] Cannot connect to https websites with IPv6

Hi,

I have recently reinstalled Arch because one update pretty destroyed linux image generation but new problem happened. I cant connect to any https website (timeout). Only http. I can connect to https from any other pc from network.

I am using DHCPD client:

dhcpcd@eth0.service            loaded active running     dhcpcd on eth0

# ip addr show

2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:19:db:33:60:f0 brd ff:ff:ff:ff:ff:ff
    inet 192.168.1.8/24 brd 192.168.1.255 scope global eth0
    inet6 2001:470:6f:1c4:219:dbff:fe33:60f0/64 scope global dynamic
       valid_lft 86400sec preferred_lft 86400sec
    inet6 fe80::219:dbff:fe33:60f0/64 scope link
       valid_lft forever preferred_lft forever

# openssl s_client -connect www.google.cz:443

CONNECTED(00000003)
depth=1 C = US, O = Google Inc, CN = Google Internet Authority
verify error:num=20:unable to get local issuer certificate
verify return:0
---
Certificate chain
 0 s:/C=US/ST=California/L=Mountain View/O=Google Inc/CN=google.com
   i:/C=US/O=Google Inc/CN=Google Internet Authority
 1 s:/C=US/O=Google Inc/CN=Google Internet Authority
   i:/C=US/O=Equifax/OU=Equifax Secure Certificate Authority
---
Server certificate
-----BEGIN CERTIFICATE-----
....shortened...
-----END CERTIFICATE-----
subject=/C=US/ST=California/L=Mountain View/O=Google Inc/CN=google.com
issuer=/C=US/O=Google Inc/CN=Google Internet Authority
---
No client certificate CA names sent
---
SSL handshake has read 8403 bytes and written 350 bytes
---
New, TLSv1/SSLv3, Cipher is ECDHE-RSA-RC4-SHA
Server public key is 1024 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
SSL-Session:
    Protocol  : TLSv1.1
    Cipher    : ECDHE-RSA-RC4-SHA
    Session-ID: 831F4CF0DCE03D26271F2C62B36A77AF3EF7279C20C77D8002FF02AAFDB83FEA
    Session-ID-ctx:
    Master-Key: 00F225FA81C4DE1A960A79C8174A7CB42353021E4F9706D970E888BD58E040A816A43759311803217A1A606422D688EC
    Key-Arg   : None
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    TLS session ticket lifetime hint: 100800 (seconds)
    TLS session ticket:
    0000 - a7 4f d1 fa 9b 18 fc a7-6e 92 7b 98 23 d8 1e 68   .O......n.{.#..h
    0010 - 32 43 36 fd 6f 12 38 84-0b 72 a3 73 fc 7a 06 e0   2C6.o.8..r.s.z..
    0020 - 30 a1 ef 0e 59 00 60 b3-aa 04 8d eb 57 84 69 3c   0...Y.`.....W.i<
    0030 - 74 0b bd 9b 40 af e6 99-77 65 ad c2 54 52 c2 55   t...@...we..TR.U
    0040 - a1 51 7b 6e 26 42 3d 0f-67 92 e3 bf ca e6 c2 1d   .Q{n&B=.g.......
    0050 - de 40 61 c1 51 e9 7f 30-b7 47 a7 bb 7f 90 e4 40   .@a.Q..0.G.....@
    0060 - 15 3d c5 e8 df ac 5e 77-e2 f0 9f d2 0c 37 70 94   .=....^w.....7p.
    0070 - 9f 3f 6c 53 d6 d0 20 02-72 05 ae 48 20 5b 88 cb   .?lS.. .r..H [..
    0080 - 6d 84 06 4b 76 4f e3 91-e4 df e3 a2 60 57 2a 95   m..KvO......`W*.
    0090 - 41 20 3d fc                                       A =.

    Start Time: 1352063544
    Timeout   : 300 (sec)
    Verify return code: 20 (unable to get local issuer certificate)
---

# links https://www.google.com
"Connecting..." and thats all.

Thanks for any help.

EDIT:
# iptables -nvL

Chain INPUT (policy ACCEPT 211 packets, 16514 bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain OUTPUT (policy ACCEPT 199 packets, 32742 bytes)
 pkts bytes target     prot opt in     out     source               destination

Last edited by Dukecz (2012-11-06 18:32:46)

Strike0

Member

From: Germany

Registered: 2011-09-05

Posts: 1,491

Re: [Solved] Cannot connect to https websites with IPv6

Maybe you just have to install "ca-certificates"?
It is an optional dep for openssl and thereby also for links only.

Dukecz

Member

Registered: 2012-11-04

Posts: 8

Website

Re: [Solved] Cannot connect to https websites with IPv6

Maybe you just have to install "ca-certificates"?
It is an optional dep for openssl and thereby also for links only.

Installed. No change.

Strike0

Member

From: Germany

Registered: 2011-09-05

Posts: 1,491

Re: [Solved] Cannot connect to https websites with IPv6

Hm. I don't know much about links. How about

curl -v -4 https://www.archlinux.org/iso/2012.11.01/sha1sums.txt

Does that work?
If not, does the ip default route look ok?

Then you can also try to bring up the link manually

systemctl stop dhcpcd@eth0.service
dhcpcd -k eth0
ip link set down dev eth0 
ip link set up dev eth0
dhcpcd eth0

Dukecz

Member

Registered: 2012-11-04

Posts: 8

Website

Re: [Solved] Cannot connect to https websites with IPv6

That worked just fine. I think that there may be problem with ipv6 or something.

I have disabled IPV6:

in /etc/dhcpcd.conf

noipv6rs

and in /etc/sysctl.conf

net.ipv6.conf.eth0.disable_ipv6 = 1

And everything is fast as expected.

But i rly would like to have ipv6 with everything working. No other device has problems with that.

Strike0

Member

From: Germany

Registered: 2011-09-05

Posts: 1,491

Re: [Solved] Cannot connect to https websites with IPv6

Ah good. I saw your IPv6 in the output, that was the reason to include the curl "-4" flag. Now knowing that, you can see what happens when you explicitly use IPv6, e.g. https://wiki.archlinux.org/index.php/Ip … ic_Address
Or you can surely set dhcpcd to ignore IPv4 for testing. Also how does the _IPv6_ route look like when not disabled.

For the time being, I suggest you either add a [solved] to your thread or add something like "with IPv6" to it

Strike0

Member

From: Germany

Registered: 2011-09-05

Posts: 1,491

Re: [Solved] Cannot connect to https websites with IPv6

Another bit to check when you enable IPv6 again: Does the "resolv.conf" receive IPv6 DNS servers after dhcp negotiation?
(If not, google's are here)

Dukecz

Member

Registered: 2012-11-04

Posts: 8

Website

Re: [Solved] Cannot connect to https websites with IPv6

Ah good. I saw your IPv6 in the output, that was the reason to include the curl "-4" flag. Now knowing that, you can see what happens when you explicitly use IPv6, e.g. https://wiki.archlinux.org/index.php/Ip … ic_Address
Or you can surely set dhcpcd to ignore IPv4 for testing. Also how does the _IPv6_ route look like when not disabled.

For the time being, I suggest you either add a [solved] to your thread or add something like "with IPv6" to it

Well i found out where the problem was and i feel like total idiot. My IPv4 changed and because I use Hurricane Electric IPv6 Tunnel and I forgot to update IP there.... x.x

So the whole problem was elsewhere ... on the other end of tunnel.

Sorry for wasting your time.

Last edited by Dukecz (2012-11-06 18:33:15)

Strike0

Member

From: Germany

Registered: 2011-09-05

Posts: 1,491

Re: [Solved] Cannot connect to https websites with IPv6

That tunnel would indeed been some important information in your thread start. You might have stumbled over it yourself then already. Good it's sorted now & good luck with your fresh install.