IPv6 Only site encounter 522 error

[dnwk]

I am trying to run a site on a server that only IPv6 is public. I was able to access it without Cloudflare Proxy when using a IPv6 capable network. However, when I turn on Cloudflare on the site, I get 522 error. I thought it was suppose to be able to connect to IPv6 only site. Any idea?
From one of the error: Ray ID: 6d02a915c8ec7bc

[fritex]

Greetings,

Thank you for asking and I am sorry you are experiencing an issue with 522 error while using IPv6 only at your origin host/server.

@dnwk

I get 522 error

Regarding Cloudflare 522 error, may I suggest you to look into below article to troubleshoot the issue and find out more useful information about this error:

• Error 522: connection timed out | Troubleshooting Cloudflare 5XX errors

Community Tip - Fixing Error 522: Connection timed out

Error Try the suggestions in this Community Tip to help you fix Error 522 “ERR CONNECTION TIMED OUT” in Google Chrome or “The connection has timed out” in Firefox. Background A 522 error happens when a TCP connection to the web server could not be established. This typically happens when Cloudflare requests to the origin (your webserver) get blocked. When this happens, you’ll see “ERR_CONNECTION_TIMED_OUT”. [image] Quick Fix Ideas Make sure that you’re not blocking Cloudflare IPs in .hta…

@dnwk

trying to run a site on a server that only IPv6 is public

This sounds familiar to me, recently Hetzner started to provide dedicated servers (and Cloud soon if not already) with IPv6-only “by default”.

And I am running an IPv4 and IPv6 on my server, while have successfully added both IPs which are proxied at Cloudflare.

Nevertheless, may I ask have you tried pinging some IPv6 hostname like ipv6test.google.com or an outside IPv6 address from your origin host/server which is already running and hopefully configured to work with IPv6?

May I ask over which port does your Web app work?
Kindly, check if you are using a supported and compatible one with Cloudflare proxy as follows at the link from below:

• Network ports · Cloudflare Fundamentals docs

If so and if it’s returning result, you are good.

Furthermore, from what you are saying, I can assume you have successfully added your domain name to your Cloudflare account, correct?

May I ask if you have added the required AAAA type DNS record (hostname’s like yourdomain.com and www) pointed to the IPv6 address of your server under the DNS tab of Cloudflare dashboard for your domain name and set it to proxied ?

If all above yes and you are still getting 522 errors, may I ask before moving to Cloudflare, was your Website and webserver working over HTTPS connection?
Do you have a valid SSL certificate installed at your origin host/server for your domain name, which covers both non-www and www (possible any other sub-domain if using)?

If yes, may I ask you to check which SSL option have you got selected under the SSL/TLS tab at Cloudflare dashboard for your domain ( Flexible, Full, Full Strict … )?

• → It should be selected at Full (Strict) SSL

Did you tried accessing your Website using a different Web browser, using a Private Window (Incognito mode), or maybe using a different network connection like mobile phone data (LTE, cellular) or even a VPN connection? Is it the same error showing up to you?

Just in case, here is a way to re-check if you correctly set up the SSL for your domain with Cloudflare:

Deprecated - Step 2: Setting up SSL with Cloudflare

This tutorial is deprecated in favour of Get started with SSL/TLS · Cloudflare SSL/TLS docs

Archive

This tutorial covers getting SSL working with Cloudflare in various different scenarios. This assumes you already have your website set up on Cloudflare with all your DNS records set to , if not - please visit <a href="https://community.cloudflare.com/t/64309">Step 1</a>. Do you want the website to use HTTPS? Yes Do you already have a valid SSL certificate installed…

In case you do not have an SSL certificate, you can use Cloudflare SSL, if so, kindly make sure you follow the instructions as follows on the below article to set up an SSL certificate using Cloudflare Origin CA Certificate:

• Origin CA certificates · Cloudflare SSL/TLS docs

Last but not least, kindly have a look at the below article for more information regarding correct SSL settings at the SSL/TLS tab on the Cloudflare dashboard:

Why you should choose Full Strict, and only Full Strict

Unencrypted & unverified connections Imagine you open Paypal and suddenly get that warning [image] Would you continue? Probably not. For decades leaders in IT security have advocated that people upgrade their sites from unencrypted HTTP to secure HTTPS. And for a reason, everything you send via an HTTP connection is sent in plain text and can be intercepted at any point between you and the server. Equally, you’d probably not proceed if you got such a warning, right? [image] That’s when th…

Furthermore, maybe some firewall is blocking Cloudflare requests. If so, kindly re-check if Cloudflare is allowed to connect to your origin host as follows in the below article:

• https://support.cloudflare.com/hc/en-us/articles/201897700-Allowing-Cloudflare-IP-addresses

Nevertheless, Cloudflare IP addresses list can be found here:

• IP Ranges

Similar topic can be found:

Get 522 error trying to connect to a proxied IPv6 only origin server

I configured an ipv6-only origin server and gave it a name in the cloudflare DNS. I made sure that proxying was off and I could connect to the server using that DNS name. This is GOOD. However, turning proxying on for the single AAAA record (there is no A record for this name) just makes all connections fail with a 522 error. As far as I can see, no packets are received by the firewall in front of the origin server. This is BAD. If I add an A record that points to another server, and then try …

After troubleshooting, if you have been through all these above suggestions and are not seeing corresponding issues on your network/server, kindly reply with any feedback information and we will get it resolved as soon as possible.

Nevertheless, if nothing from the above works I would suggest you write a ticket to Cloudflare support due to your account and/or domain issue and share the ticket number here with us so we could escalate this issue:

• Login to Cloudflare and then contact Cloudflare Support by clicking on the Get More Help button. If you get automatic reply, reply and indicate to it you need more help and reference to this topic
• Or send an an e-mail to support[at]cloudflare[dot]com from your e-mail associated with your Cloudflare account

[dnwk]

Thanks for the detailed report. So far this is what I have tested:

1. This is a home server running HE Tunnelbroker. The machine gets its own /64 IPv6.
2. It is using port 80 and 443. There is no firewall blocking specific IP.
3. It can be pinged from other machines
4. When just use AAAA record without Cloudflare proxy, I can visit the site from another network. So I know it is reachable from outside.
5. It has valid SSL certificates and when I visiting the site from another network it shows up normally.
6. It’s currently just on a free account so I can’t open a ticket.

[fritex]

@dnwk

HE Tunnelbroker

I am sorry to say but there were some issue with it as I remember:

Get 522 error trying to connect to a proxied IPv6 only origin server

It turned out that Hurricane Electric blocks traffic to tunnels from Cloudflare. However, they don’t document this anywhere that I could find… This was the root cause of my problems! Philip

@dnwk

It’s currently just on a free account so I can’t open a ticket.

May I suggest you doing it as follows below and kindly to share your ticket number here with us in your next reply so I could escalate this:

@fritex

Or send an an e-mail to support[at]cloudflare[dot]com from your e-mail associated with your Cloudflare account