0

We have an Apache server running, where it serves well any IPV4 address, but all access from IPV6 is blocked with "403 Forbidden". Any possible most likely causes to that?

EDIT

Thanks for the directions below.

I just checked which conf files there are for the httpd server.

This is the list below.

They all include a single LoadModule to a corresponding .so file, nothing out of the ordinary, except for the limitip one which has:

<IfModule limitipconn_module> MaxConnPerIP 30 CustomLog /var/lcfg/log/apacheconf.ipdenied combinedsite env=LIMITIP </IfModule> 

which I don't think is related.

There is also this bit somewhere:

# Apache 2.4 defaults to a more strict "default deny", so you have # to be more explicit about which bits should be accessible. <IfVersion >= 2.4 > <Directory [path-to-html-files]> Require all granted </Directory> </IfVersion> 

Maybe I need to change the "Require all granted" to something else that include IPv6?

All other configuration is absorbed from the original configuration files that came with the Apache server, it seems.

access_compat.conf authn_dbm.conf autoindex.conf env.conf logio.conf setenvif.conf unique_id.conf access_compat.conf~ authn_file.conf cache.conf expires.conf mime.conf slotmem_plain.conf unixd.conf actions.conf authn_socache.conf cache_disk.conf ext_filter.conf mime_magic.conf slotmem_shm.conf userdir.conf alias.conf authz_core.conf cgi.conf filter.conf mpm.conf socache_dbm.conf version.conf allowmethods.conf authz_dbm.conf data.conf headers.conf negotiation.conf socache_memcache.conf vhost_alias.conf auth_basic.conf authz_groupfile.conf deflate.conf include.conf php5.conf socache_shmcb.conf waklog.conf auth_digest.conf authz_host.conf dir.conf info.conf remoteip.conf status.conf authn_anon.conf authz_owner.conf dumpio.conf limitipconn.conf reqtimeout.conf substitute.conf authn_core.conf authz_user.conf echo.conf log_config.conf security2.conf systemd.conf 
1
  • 1
    It's not really possible to diagnose without seeing the configuration. But first guess would be to check the access control. It might be configured to allow some IPs and not others. If it lacks IPv6 configuration, clients might get rejected. It's best to check the error logs and see what's reported. Commented Apr 24, 2019 at 15:38

1 Answer 1

0

Check for vhosts and see if the ip6 address is used.

NameVirtualHost 192.168.1.13:80 NameVirtualHost 192.168.1.13:443

NameVirtualHost [fd00::021e:2aff:fe49:522c]:80 NameVirtualHost [fd00::021e:2aff:fe49:522c]:443

ServerAdmin [email protected] ServerName server3.robkalmeijer.nl

Yhis works for me.

4
  • NameVirtualHost is deprecated and has no effect in Apache >=2.3.11. Any VirtualHost with ip and port will do. Commented Apr 24, 2019 at 20:03
  • This is what I could found and it still works. Do you mean you can remove those lines? I use multiple subdomains on 1 ip address. Commented Apr 26, 2019 at 1:38
  • That's what the documentation says, so I would guess that's right. If you run apachectl configtest there should be a line like this: NameVirtualHost has no effect and will be removed in the next release /etc/apache2/sites-enabled/000-default.conf:1 Syntax OK. Commented Apr 26, 2019 at 5:23
  • I had some trouble with apache vhosts, but NameVirtualHost gave no error. httpd -S shows your vhosts. Commented Apr 27, 2019 at 18:09

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.