Cannot connect to Mesh server via ipv6

[Suncatcher]

Previously I had problems with connecting to Mesh server which was beautifully resolved by the community and we found out this was related to the fact that letsencrypt certificates do not support AWS.
This was successfully resolved by setting up a dedicated domain on Cloudflare and linking it to the EC2 instance with Mesh. This worked fine, until I decided to switch to IPv6 (because they started to charge for IPv4). Now I cannot connect to the Mesh server neither by IPv6 address nor by domain. The connection types I tried (these IP and domain are fake samples):

1. http://[e456:f251:e0c3:71b9:96cc:6afa:5c19:025c]
2. https://[e456:f251:e0c3:71b9:96cc:6afa:5c19:025c]
3. https://mymeshdomain.com

None of these addresses are reachable.

Meanwhile, this is what I get when I query my Cloudflare domain via dig:

 ; <<>> DiG 9 <<>> @localhost mymeshdomain.com AAAA
 ; (1 server found)
 ;; global options: +cmd
 ;; Got answer:
 ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 6026
 ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0
 
 ;; QUESTION SECTION:
 ;mymeshdomain.com.			IN	AAAA
 
 ;; ANSWER SECTION:
 mymeshdomain.com.		300	IN	AAAA	[e456:f251:e0c3:71b9:96cc:6afa:5c19:025c]
 
 ;; Query time: 13 msec
 ;; SERVER: 127.0.0.1#53(127.0.0.1)
 ;; WHEN: Tue Mar  5 08:43:13 2024
 ;; MSG SIZE  rcvd: 58
 

This seems to be OK and the DNS record exist for that domain.
Checking inside EC2 instance also shows the IPv6 interface is up and running:

[root@ip-XXX-XX-XX-XX meshcentral-data]# ip -6 addr show scope global
2: ens5: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 9001 state UP qlen 1000
    inet6 e456:f251:e0c3:71b9:96cc:6afa:5c19:025c/128 scope global dynamic noprefixroute 
       valid_lft 446sec preferred_lft 136sec

Security rules in AWS also seem fine for IPv6

Do we need any changes in config.js to enable IPv6? Now my config looks like below

  "$schema": "https://raw.githubusercontent.com/Ylianst/MeshCentral/master/meshcentral-config-schema.json",
  "__comment1__": "This is a simple configuration file, all values and sections that start with underscore (_) are ignored. Edit a section and remove the _ in front of the name. Refer to the user's guide for details.",
  "__comment2__": "See node_modules/meshcentral/sample-config-advanced.json for a more advanced example.",
  "settings": {
    "cert": "XXXXXXXXXXXXX",
    "WANonly": true,
    "_LANonly": true,
    "_sessionKey": "MyReallySecretPassword1",
    "_port": 443,
    "_aliasPort": 443,
    "_redirPort": 80,
    "_redirAliasPort": 80,
    "mpsport": 0
  },
  "domains": {
    "": {
      "_title": "MyServer",
      "_title2": "Servername",
      "_minify": true,
      "_newAccounts": true,
      "_userNameIsEmail": true
    }
  },
  "letsencrypt": {
    "__comment__": "Requires NodeJS 8.x or better, Go to https://letsdebug.net/ first before trying Let's Encrypt.",
    "email": "XXXXXXXXXXX",
    "names": "XXXXXXXXXXX",
    "skipChallengeVerification": true,
    "production": true
  }
}

[Suncatcher]

@si458 maybe you have any idea?

[si458]

I have ipv6 in our rack now in the datacenter so I'll try get it setup and have a look when I can
I know the is a few issues in relation to ipv6,
like the meshcentralassistant sometimes doesn't work at all!

[si458]

Sorry very early here 5am (couldnt sleep n tired, misread ur msg)
That ipv6 address doesn't look right???
I would check in the ec2 web panel for the public ipv6 address
https://docs.aws.amazon.com/vpc/latest/userguide/vpc-migrate-ipv6.html
https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-instance-addressing.html#assign-ipv6-address

[Suncatcher]

thanks for a prompt response. Suddenly it started working, maybe the routes in VPC IGW were the reason. I added them like this guy and suddenly was able to open Mesh

I will keep you posted if smth gets wrong again. Thanks a ton for your support!!!

[Suncatcher]

just FYI, after switching to IPv6 the agent suddenly stopped working for some reason, the reinstallation helped.
The old agent in the left, the new agent is in the right

Is the agent hardly linked to server address?

[si458]

No the agents are linked to mac addresses.
But if you uninstall the agent and reinstall it will delete/create the db file,
This is why you suddenly had a second agent

[Suncatcher]

No the agents are linked to mac addresses

got it. This explains everything. To get rid of public IPv4 and switch to IPv6 I had to relaunch the EC2 instance from AMI which probably changed its MAC. Now it's more clear, thanks.

[si458]

Yep! That indeed does explain it