Hacker News Reader

Hacker News

Comment by jjeaff | Hacker News Reader

Parent Full thread

jjeaff

Then the odds appear to not be in our favor.

CF CEO tweets that 1.0.0.1 is also blocked.

https://twitter.com/eastdakota/status/991718955021623296

Others have confirmed that the ipv6 address belonging to CF appears to be blocked.

View on HN

Do you have a reference for the ipv6 address being blocked? That would be a much bigger smoking gun

https://blog.cloudflare.com/dns-resolver-1-1-1-1/

> For IPv6, we have chosen 2606:4700:4700::1111 and 2606:4700:4700::1001 for our service. It’s not as easy to get cool IPv6 addresses; however, we’ve picked an address that only uses digits.

For me up in Canada, ping 1.1.1.1 works. But

    ping6 2606:4700:4700::1111
    ping6 2606:4700:4700::1001

shows "connect: Network is unreachable". Am I using ping6 wrong?

We also need to confirm IPV6 works outside AT&T's network.

Edit: Just tried Google's DNS. 8.8.8.8 works, but their IPv6 doesn't, so I guess this was a bad test.

Edit2: Learned about nslookup, but it does not seem to work with either Google or CloudFlare's DNS.

    nslookup reddit.com                       # Works
    nslookup reddit.com 1.1.1.1               # Works
    nslookup reddit.com 1.0.0.1               # Works
    nslookup reddit.com 2606:4700:4700::1111  # Does not
    nslookup reddit.com 8.8.8.8               # Works
    nslookup reddit.com 2001:4860:4860::8888         # Does not
    nslookup reddit.com 2001:4860:4860:0:0:0:0:8888  # Does not

Edit3: Apparently my ISP doesn't support IPv6 yet.

You're using the IPV6 address correctly, does https://test-ipv6.com report everything's dandy for you? If it does maybe they're blocking traffic or there's something else going on.

> No IPv6 address detected. Connections to IPv6-only sites are timing out. Any web site that is IPv6 only, will appear to be down to you.

Okay, guess my PC/LAN/ISP doesn't support IPv6 yet.

If you're in Ontario, Rogers doesn't support IPv6 yet. If you want IPv6, then your only option is Bell (or a reseller, like Teksavvy).

I'm using Bell in Ontario. It could be either my Router doesn't support it, the Apartment isn't wired up to support it (if that's required?), my ISP doesn't support it in my area, or my Bell internet plan doesn't cover IPv6...

I'll ask them about it when they ring me up next time asking for more money.

Hmm... looked at this again and it looks like Rogers may have rolled out IPv6 last year.

I recall on Teksavvy I had to pay extra for a "static IP" to get IPv6. Not sure if you're with Bell directly, though.

Everyone in Ontario on TekSavvy should have IPv6 now without having to pay for a static IP address but at least for me it's still wonky at best.

most modern linux distros regular `ping` will work for ipv6.

(US based) frontier, vz, and spectrum all can ping that ipv6 address (though all have way over 10ms latency)

I tested out both addresses via my phone's web browser just now.

Connecting to WiFi (Time Warner), I got a 403 from cloudflare (presumably there just isn't a web server set up on that address).

Using mobile data (AT&T), I got ERR_ADDRESS_UNREACHABLE. However, 1.1.1.1 actually works on AT&T cellular, so I'm not sure what to think.

ipv6 supports traceroute too

> Am I using ping6 wrong?

I'm pretty sure the other end has to be running `pingd` to get a response from ping. Some do, some don't.

I might be wrong but that's always been my understanding.

You are definitely wrong. No daemons have to be running, ping operates using standard ICMP echo messages that are a part of any complete IP stack. Any meaningful OS will respond to pings unless prevented from receiving them by a firewall. It wouldn't surprise me to find that some embedded implementations skip that part for size reasons, but even in that category most devices I have available to me still respond. It's a basic network connectivity diagnostic tool.

What is unfortunately common though is people blocking ICMP at their firewall, either at the host level itself or further upstream. Sometimes they just block echo requests, but often they block ICMP entirely which breaks things in very weird ways from time to time.

Blocking ICMP in any way is generally to be considered harmful. It's not 1997 anymore, the "ping of death" is not a thing on any OS you should actually be connecting to the internet.

Missing brackets probably:

  ping6 '[2606:4700:4700::1111]'

fwiw, I am an AT&T customer in Atlanta on their fiber service.

the nslookup reddit.com 1.1.1.1 does not return for me, if I connect to work via VPN it does. 1.0.0.1 and 8.8.8.8 do work without VPN. while the AT&T modem shows IPV6 I did not test.

System Information Type Value Manufacturer Pace Plc Model 5268AC

I have AT&T internet, and the BGW-210 gateway with the latest firmware. And my area was upgraded to native dual stack ipv6 about a year ago. So I tested it out and the ipv6 CloudFlare DNS (2606:4700:4700::1111 , 2606:4700:4700::1001) works perfectly fine. https://imgur.com/a/grUzeDD Its only the ipv4 1.1.1.1 that dose not. And AT&T made a statement why that is.

""With the recent launch of Cloudflare's 1.1.1.1 DNS service, we have discovered an unintentional gateway IP address conflict with 1 of their 4 usable IPs and are working to resolve the issue,"

https://arstechnica.com/information-technology/2018/05/att-i...

A few of you will be disappointed to know its not a evil attempt to block you from using it. Same way they have literally never blocked the ability to use any other DNS service before.It's simply a bug caused by the way the BGW-210, and Pace 5268AC operate and make use of 1.1.1.1 internally in some way and it will be fixed with a firmware update.

Just curious - can cloudflare blackhole all of Att traffic?

Could they physically? Yes. But they'd be screwing over their own customers who rely on that traffic.

Isn’t AT&T screwing their own customers by blocking 1.1.1.1 as well ?

AT&T isn’t blocking 1.1.1.1, just tested it on my uverse connection. As much as I hate AT&T their internet is pretty solid with the exception of datacaps

A more interesting use case though it would have its dangers is them showing a message to AT&T users that their ISP is doing things to damage the internet and that they should call and complain. People got mad at the idea of CloudFlare slowing down network requests by FCC members in protest of their shenanigans.

Reply on news.ycombinator.com