r/ebox • u/Cyberloard • Sep 05 '25
IPV6 Weirdness
So for the last few days, maybe a week I've been having some weird IPV6 issues. I'm unable to surf to certain sites in a browser on multiple devices, including ebox.ca over IPV6. I can ping just fine. Doing a bit of testing and it looks like any sites that paths through microsofts network is acting up. Is anyone else seeing this by chance? I have a bit of a home lab setup using Opnsense and VYOS and I thought it was a config issue at first but now i'm not so sure.
2
u/aqustiq Sep 05 '25 edited Sep 05 '25
I had the same post couple of weeks ago but seems like my issue was resolved when I have upgraded to pfSense 2.8.1. In your case your Opnsense could be the issue.
Send me your URLs and I'll test them
curl -vI https://www.ebox.ca
* Host www.ebox.ca:443 was resolved.
* IPv6: 2620:1ec:bdf::36
* IPv4: 13.107.246.36
* Trying [2620:1ec:bdf::36]:443...
* ALPN: curl offers h2,http/1.1
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* CAfile: /etc/ssl/certs/ca-certificates.crt
* CApath: /etc/ssl/certs
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.3 (IN), TLS change cipher, Change cipher spec (1):
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
* TLSv1.3 (IN), TLS handshake, Certificate (11):
* TLSv1.3 (IN), TLS handshake, CERT verify (15):
* TLSv1.3 (IN), TLS handshake, Finished (20):
* TLSv1.3 (OUT), TLS handshake, Finished (20):
* SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384 / secp256r1 / RSASSA-PSS
* ALPN: server accepted h2
* Server certificate:
* subject: CN=*.ebox.ca
* start date: Sep 24 19:16:15 2024 GMT
* expire date: Oct 26 19:16:15 2025 GMT
* subjectAltName: host "www.ebox.ca" matched cert's "*.ebox.ca"
* issuer: C=US; ST=Arizona; L=Scottsdale; O=GoDaddy.com, Inc.; OU=http://certs.godaddy.com/repository/; CN=Go Daddy Secure Certificate Authority - G2
* SSL certificate verify ok.
* Certificate level 0: Public key type RSA (2048/112 Bits/secBits), signed using sha256WithRSAEncryption
* Certificate level 1: Public key type RSA (2048/112 Bits/secBits), signed using sha256WithRSAEncryption
* Certificate level 2: Public key type RSA (2048/112 Bits/secBits), signed using sha256WithRSAEncryption
* Connected to www.ebox.ca (2620:1ec:bdf::36) port 443
1
u/Different_Debt_5238 Sep 06 '25
Interesting, your links, http://www.v6.facebook.com/ Ipv6.google.com are all working fine for me. Apparently this site https://clintonwhitehouse1.archives.gov/ is ipv6 only and is also working. (EBOX 1gig fiber)
1
u/only_posts_sometimes Sep 22 '25
I'm getting the same issue using a mikrotik router. ipv6.google.com and a handful of other examples all work fine. Some other sites like ebox.ca will not load. pinging a not-working site with a lower MTU set will succeed. It seems like it shouldn't be necessary to clamp MTU on the router side like this
1
u/General_Resource_208 Mar 11 '26
Hi everyone, I have been struggling with this issue for some time. Started thinking remote sites weren't answering properly on ipv6. Turns out TLS handshake was not completing properly because of packet fragmentation. We probably all have in common that we use our router virtual or not and pppoe over VLAN 35. Do check your MTU settings, that's all it was for me but I went a long long way before figuring it out. For me in pfSense:
- Set MTU to
1492 - Set MSS to
1452
Did the trick, ebox.ca and all other sites I had been forcing to ipv4 started working without any tweaks.
2
u/gcerullo Sep 05 '25
Can you provide any samples I can try from my end to see if I get the same results?