Hello RIPE Community,
I am currently experiencing a persistent networking issue with my website where some users are unable to reach the site over IPv6, while the same website remains consistently accessible over IPv4. The core problem is that visitors whose networks prefer IPv6 sometimes experience connection timeouts when attempting to open my website, even though the server itself is online and responding normally to IPv4 requests. The behaviour is intermittent from the user’s perspective because visitors on IPv4-only networks can access the website without any noticeable problem, while users with working IPv6 connectivity may experience a long delay followed by a timeout. I have confirmed that the issue is not related to the website application itself because the same pages load normally when the request reaches the server through IPv4.
I have configured an AAAA record for the website domain and confirmed that it resolves to the IPv6 address assigned to the server. DNS lookups from several external networks return the expected IPv6 address, so the problem does not appear to be a simple missing DNS record. I have also checked the server’s network configuration and verified that IPv6 is enabled at the operating-system level. When I test the website using an IPv4 connection, the HTTP response is returned normally and the server logs show the request as expected. However, when I force an IPv6 connection from a network with IPv6 support, the connection sometimes fails before the web server receives the request, which makes me suspect that the problem is somewhere in the IPv6 network path or server-side IPv6 connectivity rather than in the website code.
The issue is particularly confusing because basic IPv6 tests sometimes succeed. For example, I can occasionally establish a connection to the server’s IPv6 address and retrieve the website successfully, but at other times the same type of test results in a timeout. I have compared results from different networks and noticed that the behaviour is not identical everywhere. Some IPv6-enabled networks can reach the website without any difficulty, while others appear unable to establish a TCP connection to port 443 over IPv6. The website uses HTTPS, and the SSL certificate works correctly over IPv4, so I am trying to determine whether the problem could involve IPv6 routing, firewall rules, MTU behaviour, or another network-level configuration issue that only affects certain paths.
I have also reviewed the firewall configuration on the server because I initially suspected that IPv6 traffic might not be handled by the same rules as IPv4 traffic. The firewall allows inbound HTTPS traffic, and the relevant IPv6 configuration appears to permit connections to the web server. However, I am not completely certain that every layer of the networking stack is configured correctly for IPv6. There may be a difference between the IPv4 and IPv6 firewall policies, or the hosting provider may have additional filtering or routing rules upstream from the server. Since the failed connections do not always appear in the web server logs, I believe some of the affected traffic may not be reaching the application layer at all.
I have avoided making major network changes because I want to identify the actual cause before changing the production configuration. I have been comparing DNS responses, IPv4 and IPv6 connectivity tests, TCP connection behaviour, and web server logs to determine where the connection stops. The most useful clue so far is that IPv4 remains stable while IPv6 is inconsistent, and the problem appears before the HTTP request is fully processed by the web server. I am therefore trying to understand whether there are recommended RIPE or IPv6 troubleshooting methods for determining whether an IPv6 address is correctly routed and reachable from different networks. I would also like to know what information I should collect from traceroute, ping, TCP connection tests, or other IPv6 diagnostic tools to distinguish a local server configuration problem from an upstream routing issue.
I would appreciate guidance from the RIPE community on how to systematically diagnose this intermittent IPv6 reachability problem. Specifically, I would like advice on checking whether the advertised IPv6 prefix and address are correctly routed, verifying that the server is receiving IPv6 traffic, identifying where packets are being dropped, and determining whether the issue could be related to MTU or firewall configuration. If there are recommended RIPE Atlas measurements or other tools that can help compare IPv6 reachability from multiple locations, I would also be interested in using them to identify a geographic or network-specific pattern. My goal is to make the website reliably reachable over IPv6 for all users whose networks support it, without affecting the existing IPv4 connectivity.