Unable to reach security.debian.org through an HurricaneElectric IPv6 pipe

Hi,

I'm currently unable to reach security.debian.org
(2001:8d8:2:1:6564:a62:0:2) through IPv6.

donald:~# traceroute -M tcpconn -p 80 wieck.debian.org -n -6
traceroute to wieck.debian.org (2001:8d8:2:1:6564:a62:0:2), 30 hops max, 80 byte packets
1 2001:7a8:820:1::1 0.170 ms 0.151 ms 0.126 ms
2 2001:7a8:820::1 0.317 ms 0.274 ms 0.515 ms
3 2001:7a8:1:9ff2::1 1.753 ms 1.745 ms 1.724 ms
4 2001:7a8:0:ff22::1 2.384 ms 2.374 ms 2.355 ms
5 2001:7a8:1:91::1 48.524 ms 48.530 ms 48.495 ms
6 2001:7a8:0:ffe1::fffe 10.203 ms 10.345 ms 10.270 ms
7 2001:7f8:4::2170:1 10.457 ms 10.390 ms 10.572 ms
8 2001:8d8:0:2::6 20.535 ms 19.820 ms 20.003 ms
9 2001:8d8:0:2::a 19.953 ms 20.517 ms 20.458 ms
10 2001:8d8:0:2::12 22.901 ms 2001:8d8:0:2::2a 22.333 ms 22.707 ms
11 2001:8d8:0:4::11 23.908 ms 2001:8d8:0:4::10 23.388 ms 2001:8d8:0:5::11 23.338 ms
12 * * *
13 * * *
14 * * *
15 * * *
16 * * *
17 * * *
18 * * *
19 * * *
20 * * *
21 * * *
22 * * *
23 * * *
24 * * *
25 * * *
26 * * *
27 * * *
28 * * *
29 * * *
30 * * *
donald:~# traceroute -M tcpconn -p 25 wieck.debian.org -n -6
traceroute to wieck.debian.org (2001:8d8:2:1:6564:a62:0:2), 30 hops max, 80 byte packets
1 2001:7a8:820:1::1 0.185 ms 0.147 ms 0.128 ms
2 2001:7a8:820::1 0.435 ms 0.417 ms 0.396 ms
3 2001:7a8:1:9ff2::1 1.633 ms 1.860 ms 1.849 ms
4 2001:7a8:0:ff22::1 2.317 ms 2.305 ms 2.287 ms
5 2001:7a8:1:91::1 108.936 ms 108.943 ms 108.926 ms
6 2001:7a8:0:ffe1::fffe 10.407 ms 10.354 ms 10.305 ms
7 2001:7f8:4::2170:1 14.970 ms 15.158 ms 15.114 ms
8 2001:8d8:0:2::6 20.555 ms 20.161 ms 19.901 ms
9 2001:8d8:0:2::a 19.862 ms 19.425 ms 20.330 ms
10 2001:8d8:0:2::2a 22.282 ms 2001:8d8:0:2::12 23.129 ms 2001:8d8:0:2::2a 22.314 ms
11 2001:8d8:0:4::10 23.035 ms 2001:8d8:0:5::10 22.910 ms 2001:8d8:0:4::10 23.190 ms
12 * * *
13 * * *
14 * * *
15 * * *
16 * * *
17 * * *
18 * * *
19 * * *
20 * * *
21 * * *
22 * * *
23 * * *
24 * * *
25 * * *
26 * * *
27 * * *
28 * * *
29 * * *
30 * * *

Judging from the traceroute, it seems that Hurricane Electric and OneAndOne are peering, but perhaps there's a problem between Nerim and one of the other two? My traceroutes reach wieck, but the Nerim sTLA (2001:7a8::/32) isn't in my routing tables.

Have you contacted Nerim NOC?

wfms

Thanks for your input.

I'm gonna check with HE as I already checked with Nerim NOC.

Thanks

* Laurent CARON:

I'm currently unable to reach security.debian.org
(2001:8d8:2:1:6564:a62:0:2) through IPv6.

donald:~# traceroute -M tcpconn -p 80 wieck.debian.org -n -6
traceroute to wieck.debian.org (2001:8d8:2:1:6564:a62:0:2), 30 hops max, 80 byte packets

It helps if you mention your own IP address. Using 2001:7a8:820:1::1
instead, I get this in the reverse direction (from wieck):

traceroute to 2001:7a8:820:1::1 (2001:7a8:820:1::1), 30 hops max, 40 byte packets
1 vl-121.gw-dists-a.bs.ka.oneandone.net (2001:8d8:2:1::1) 1.530 ms 1.614 ms 1.709 ms
2 te-1-2.bb-c.bs.kae.de.oneandone.net (2001:8d8:0:5::1) 1.116 ms 1.169 ms 1.104 ms
3 te-4-2.bb-c.act.fra.de.oneandone.net (2001:8d8:0:2::11) 3.479 ms 3.540 ms 3.591 ms
4 te-1-1.bb-c.nkf.ams.nl.oneandone.net (2001:8d8:0:2::9) 10.139 ms 10.200 ms 10.247 ms
5 te-1-2.bb-c.the.lon.gb.oneandone.net (2001:8d8:0:2::5) 17.257 ms 17.321 ms 17.377 ms
6 linx.he.net (2001:7f8:4::1b1b:1) 17.281 ms 16.399 ms 16.456 ms
7 gige-g0-1.tserv17.lon1.ipv6.he.net (2001:470:0:a3::2) 16.546 ms 16.562 ms 16.512 ms
8 * * *
[and nothing more]

A traceroute from 2001:14b0:200:6::4 looks similar, despite taking a
different entry point into HE:

traceroute to 2001:7a8:820:1::1 (2001:7a8:820:1::1) from 2001:14b0:200:6::4, 30 hops max, 24 byte packets
1 2001:14b0:200:6::3 (2001:14b0:200:6::3) 27.324 ms 29.593 ms 26.593 ms
2 2a01:1e8:2:3::1 (2a01:1e8:2:3::1) 26.827 ms 26.772 ms *
3 2a01:1e8:2:4::1 (2a01:1e8:2:4::1) 30.685 ms 30.684 ms 30.767 ms
4 de-cix.he.net (2001:7f8::1b1b:0:1) 31.821 ms 35.31 ms 33.465 ms
5 gige-g0-1.tserv18.fra1.ipv6.he.net (2001:470:0:a5::2) 33.738 ms 33.368 ms 30.792 ms
6 * * *

So this seems to be something beyound our (that is, Debian's) control,
assuming that 2001:7a8:820:1::1 is as good as the IP address you've
actually been assigned.

It helps if you mention your own IP address. Using 2001:7a8:820:1::1
instead, I get this in the reverse direction (from wieck):

My desktop's IP: 2001:7a8:820:1::31

traceroute to 2001:7a8:820:1::1 (2001:7a8:820:1::1), 30 hops max, 40 byte packets
1 vl-121.gw-dists-a.bs.ka.oneandone.net (2001:8d8:2:1::1) 1.530 ms 1.614 ms 1.709 ms
2 te-1-2.bb-c.bs.kae.de.oneandone.net (2001:8d8:0:5::1) 1.116 ms 1.169 ms 1.104 ms
3 te-4-2.bb-c.act.fra.de.oneandone.net (2001:8d8:0:2::11) 3.479 ms 3.540 ms 3.591 ms
4 te-1-1.bb-c.nkf.ams.nl.oneandone.net (2001:8d8:0:2::9) 10.139 ms 10.200 ms 10.247 ms
5 te-1-2.bb-c.the.lon.gb.oneandone.net (2001:8d8:0:2::5) 17.257 ms 17.321 ms 17.377 ms
6 linx.he.net (2001:7f8:4::1b1b:1) 17.281 ms 16.399 ms 16.456 ms
7 gige-g0-1.tserv17.lon1.ipv6.he.net (2001:470:0:a3::2) 16.546 ms 16.562 ms 16.512 ms
8 * * *
[and nothing more]

A traceroute from 2001:14b0:200:6::4 looks similar, despite taking a
different entry point into HE:

traceroute to 2001:7a8:820:1::1 (2001:7a8:820:1::1) from 2001:14b0:200:6::4, 30 hops max, 24 byte packets
1 2001:14b0:200:6::3 (2001:14b0:200:6::3) 27.324 ms 29.593 ms 26.593 ms
2 2a01:1e8:2:3::1 (2a01:1e8:2:3::1) 26.827 ms 26.772 ms *
3 2a01:1e8:2:4::1 (2a01:1e8:2:4::1) 30.685 ms 30.684 ms 30.767 ms
4 de-cix.he.net (2001:7f8::1b1b:0:1) 31.821 ms 35.31 ms 33.465 ms
5 gige-g0-1.tserv18.fra1.ipv6.he.net (2001:470:0:a5::2) 33.738 ms 33.368 ms 30.792 ms
6 * * *

So this seems to be something beyound our (that is, Debian's) control,
assuming that 2001:7a8:820:1::1 is as good as the IP address you've
actually been assigned.

This is the IP of one of my BGP routers.

* Laurent CARON: