Nginx configuration with IPv6

Setup, Configuration and Use Installation
1

Hello all,

I got my openhab 3.4 running on openhabian and I am very pleased with it.
It is running behind nginx, with my own domain registered an with valid certificates.
All well.

BUT: I got my „Deutsche Glasfaser“ this week an now I am on a IPv6 connection.
Which is cool, but the nginx which is installed on the openhabian does no IPv6.
I am confident, that I placed the correct listen directives in the configuration and the dyndns resolves to the correct IP address, IPv4 and IPv6.
Running the IOS App in my local network, which is IP4, does all the magic. Outside , in WAN, the portforwarding does not happen.
Is there a way to enable IPv6 in nginx? If I do nginx -V there is no --withIPv6 listed.
Thanks for your help!
Thomas

2

I don’t know if this is valid for your router but I would assume that you have to enable something on your router/modem to forward the request into your network.
See https://www.deutsche-glasfaser.de/fileadmin/content/pdf/downloads/anleitungen/DG_anleitung_fernzugriff_DGrouter_IPv6.pdf

But be CAREFULL allowing access from the internet to your equipment may allow users from the internet to get into your network.

How to Enable IPv6 in Nginx & Apache? describes a few steps to be done during configuration. I assume that you are already aware of them.

What does ‘all the magic’ mean ? In case the app runs on a device using IPv4 then I would say there is no magic behind.

3

I would go the other way and disable IPv6. At this point in time, there’s no real benefit to it on a home network. I disabled IPv6 when I installed openHABian (I think it was an option in the Raspberry Pi installer).

Maybe an IPv6 option would be useful to add to openhabian-config?

4

Good morning, thanks for your replies.

Just to clarify: it does all the magic means it working as expected :innocent:
The portforewarding on the FRITZ!box is set up for IPv4 and IPv6 for just one port.
That’s the port nginx listens to. With IPv4 it’s working well, with IPv6 not.

It think enabling IPv6 on nginx would do the trick. But the one I get with apt-get install nginx is without IPv6.

I found a description using the configure procedure to build a IPv6 capable version.
But I hope to find an easier solution.

Am I the first with this task?

Happy weekend 4 all :grinning:

5

How do you know that it is not supported ?
In case IPv6 is not supported by nginx then I would expect to see an error message during startup of nginx due to the fact that the configuration for IPv4 and IPv6 is different.
If you configured nginx to use IPv6 and the startup does not complain about the included IPv6 syntac/configuration then it must be supported.

An easy test should be to configure nginx to use a port for IPv6 locahost or even on the IPv6 ethernet address of your device. Bind a web page to it ( should be supported by nginx ).
Then use your browser ( pay attention if localhost is used or the ethernet address with localhost the browser needs to run on the same device ) or telnet -6 command to connect to the port listening on IPv6/TCP6 protocol.

6

…

7

It is safer to block requests from the WAN and instead use a VPN to access hosts on your LAN. I use Wireguard for this, it’s quite easy to set up, there are a lot of guides on the internet.

8

My installation also uses openhabian and does not show --withIPv6 but does support IPv6.
See last line returned by following command:

netstat -tulpn | grep nginx
tcp        0      0 0.0.0.0:80              0.0.0.0:*               LISTEN      3187/nginx: master  
tcp        0      0 0.0.0.0:443             0.0.0.0:*               LISTEN      3187/nginx: master  
tcp6       0      0 :::8888                 :::*                    LISTEN      27275/nginx: master
1 Like
9

Thanks for ideas. I will give them a try when I am back home on Sunday.
I use WireGuard VPN in my setup and I did all the security considerations VPN vs. portforewarding to nginx.
I want both. The one port for a convenient access for the openhab app, and WireGuard for alle other access to my local network, which is seldom.

Thanks, Thomas