IPv6-only VPS: three weeks of discovering what still breaks

Three weeks ago I migrated my personal Infrastructure to an IPv6-only VPS at RackNerd actually because the Price was unbeatable and I wanted to learn what would break or? I expected the obvious Things like some Websites and old Gameservers but the Reality was much more depressing actually

• Docker Hub pulls fail without explicit --ipv6 flag in daemonjson
• Lets Encrypt validation breaks if your DNS has AAAA but your Webserver listens only on IPv4-mapped-IPv6 actually
• GitHub Actions runners cannot ssh to the Host for Deployment without a ProxyJump through a DualStack Box
• My own Banks mobile App hardcodes 104.16.249.249 as API Endpoint literal IPv4 Address no DNS Resolution at all

The Bank was the Surprise actually I can live without Netflix or? But I cannot live without Money or? I run a WireGuard Tunnel to a cheap DualStack VPS at Hetzner https://www.hetzner.com for IPv4 Egress but this feels like Defeat actually

I will not switch back out of Stubbornness now or?

What else breaks? I want the full List before I recommend this to Enemies.

Fighting rudi3!!

ipv6 only is FUTURE

But yeah many things break kk

My list
Github git clone SLOW
npm registry timeout sometimes
apt mirrors half broken

Keep going

The German Federal Network Agency actually mandates IPv6 Support since 2021 so Providers must offer it but nobody said it has to work gemütlich

I tried IPv6-only for my Kubernetes Cluster actually the Control Plane was fine but so many Helm Charts assume IPv4 for Pod-CIDR defaults and Metrics Scraping na ja

Your WireGuard Tunnel is not Defeat it is pragmatic Engineering actually I run the same Setup at Vultr with a /48 Delegation to my Home Router gemütlich except when Vultr has Routing Issues then it is not

We've updated our IPv6 documentation based on threads like this.

This is more common than expected. We're compiling a community list of hardcoded IPv4 services.

Current confirmed:

• Several major payment processors
• One government ID verification API
• Multiple mobile banking apps

If you find more, please report in our network section. We'll publish without naming specific institutions for responsible disclosure.

— Admin

MTR from my IPv6-only HostHatch to your RackNerd:

Host                                    Loss%   Snt   Last   Avg  Best  Wrst StDev
  1. 2a0f:xyz::1                         0.0%    10    0.3   0.4   0.3   0.6   0.1
  2. 2001:db8::beef                      0.0%    10    0.8   1.2   0.7   3.4   0.8
  3. ???                                  100    10    0.0   0.0   0.0   0.0   0.0
  4. 2a0f:abc::1                         0.0%    10   12.4  15.6  12.1  45.2   9.8

Hop 3 is AS64500. Peer better, RackNerd. Your upstream deaggregates poorly.

Data table of IPv4 fallback success rate via your Hetzner tunnel: 94.7% over 72 hours. The 5.3% is DNS timeout to quad9 over v6.

Docker Hub needing a flag in 2024 is embarrassing actually

It is not only Docker Hub actually. Podman with default settings tries to pull from registry.access.redhat.com over IPv4 first and falls back only after 30 seconds timeout. My CI Pipelines were 8 minutes longer until I found this.

Also GitLab Container Registry has the same Issue if you use their IPv6 Endpoint but the Certificate SAN list does not match. Reported, closed as wontfix.

This is the real Cost actually. The VPS is cheap but the Time debugging is not. I spent one Evening tracing why my Matrix Server could not federate with half the Network. Turns out matrix.org Delegation Server has no AAAA Record for the .well-known Host. You must use the Fallback Server which does.

My Wife asked why I was shouting at a Terminal.

Confirmed from here. Also half the Singapore IX peers still do not accept IPv6 prefixes longer than /48 which makes Vultr's /64 per Instance annoying for anything serious. I asked their Support, they said "use multiple Instances" which is not an Answer — https://www.vultr.com/pricing/.

Your Hetzner Tunnel runs through Frankfurt or Helsinki? I see different Latency depending on Time of Day.

I run IPv6-only on Hetzner since 2022 actually. The Auction Servers are fine but their Cloud Load Balancer still charges extra for IPv4 Address and you cannot disable it completely. You pay 0.80 EUR for a thing you do not want.

The real Trick is their DNS API. Works over IPv6 natively unlike some Providers who manage DNS but the API Endpoint is IPv4-only. Looking at you, Namecheap.