Community discussions

MikroTik App
 
ddejager
Member Candidate
Member Candidate
Topic Author
Posts: 135
Joined: Tue Oct 18, 2011 5:13 am

IPV6 disabled, clients still prefer IPV6 DNS servers

Thu Oct 23, 2014 3:30 am

I'm running 6.19. The MikroTik router is my default gateway, my DHCP server, and my DNS server. I have the IPv6 package disabled on the router. I observe that my client machines list three DNS servers. The first two are IPv6 addresses that do not work. The third one is the IPv4 address of the router. I have not observed this behavior in the past (only the IPv4 DNS address showed up) but I'm not sure when it started. I can find no place where this configuration can be changed in the router.

Why are the IPv6 DNS servers showing up? How can I prevent them from being advertised and configure in the clients?
 
User avatar
bajodel
Long time Member
Long time Member
Posts: 552
Joined: Sun Nov 24, 2013 8:30 am
Location: Italy

Re: IPV6 disabled, clients still prefer IPV6 DNS servers

Thu Oct 23, 2014 8:28 am

maybe ..provide here dhcp server section export..
 
ddejager
Member Candidate
Member Candidate
Topic Author
Posts: 135
Joined: Tue Oct 18, 2011 5:13 am

Re: IPV6 disabled, clients still prefer IPV6 DNS servers

Thu Oct 23, 2014 4:51 pm

Not much in the DHCP server export to show:
/ip dhcp-server> export
# oct/23/2014 09:49:28 by RouterOS 6.19
# software id = NWP1-5CXD
#
/ip dhcp-server
add address-pool=default-dhcp authoritative=yes disabled=no interface=\
    bridge-local name=default
add address-pool=Guest-pool authoritative=yes disabled=no interface=\
    bridge-guest lease-time=1h name=Guest
/ip dhcp-server network
add address=192.168.88.0/24 comment="default configuration" dns-server=\
    192.168.88.1 gateway=192.168.88.1 netmask=24
add address=192.168.89.0/24 dns-server=192.168.89.1 gateway=192.168.89.1 \
    netmask=24
 
guipoletto
Member Candidate
Member Candidate
Posts: 199
Joined: Mon Sep 19, 2011 5:31 am

Re: IPV6 disabled, clients still prefer IPV6 DNS servers

Sat Oct 25, 2014 9:06 am

Same going on here. There should be an option not to forward ipv6 dns addresses, even if the parent (DNS)server gives them.
 
Nexor
just joined
Posts: 2
Joined: Mon Feb 03, 2014 5:34 am

Re: IPV6 disabled, clients still prefer IPV6 DNS servers

Mon Oct 27, 2014 6:47 am

I've installed OpenWRT 14.07 because of stupid problems with on ipv6+ipv4 :(
 
User avatar
janisk
MikroTik Support
MikroTik Support
Posts: 6263
Joined: Tue Feb 14, 2006 9:46 am
Location: Riga, Latvia

Re: IPV6 disabled, clients still prefer IPV6 DNS servers

Mon Oct 27, 2014 10:33 am

and who/what is advertising IPv6 in your network?

Anyway, DNS advertising is not on by default in RouterOS. You have to head over to /ipv6 nd to set it to be included in the RA. Also, ipv6 DHCP is not capable to do that if ipv6 package is disabled as there are nothing ipv6 related underneath that would allow DHCP server to bind and send out MLD packets.
 
guipoletto
Member Candidate
Member Candidate
Posts: 199
Joined: Mon Sep 19, 2011 5:31 am

Re: IPV6 disabled, clients still prefer IPV6 DNS servers

Wed Oct 29, 2014 2:22 am

I don't think he is talking about advertising.

In my case i have ipv6 packages disabled, as my network is fully ipv4. There are no ipv6 enabled anything anywhere in the network.

Yet, when i nslookup facebook, the mikrotik gives out the AAAA entrys preferentially, as follows:
C:\Users\Ângela>nslookup facebook.com
Servidor:  UnKnown
Address:  192.168.234.17

Não é resposta autoritativa:
Nome:    facebook.com
Addresses:  2a03:2880:2130:cf05:face:b00c:0:1
          173.252.120.6

There you have a tracert, This .234.X subnet is behind a rb951-2n, running 6.21RC, but the same is valid for 6.20
C:\Users\Ângela>tracert facebook.com

Rastreando a rota para facebook.com [173.252.120.6]
com no máximo 30 saltos:

  1     1 ms     1 ms     1 ms  192.168.234.17
  2     2 ms     1 ms     1 ms  200.214.148.224
  3     *        *        *     Esgotado o tempo limite do pedido.
  4    29 ms    36 ms    28 ms  200.216.88.2
  5    39 ms    51 ms    41 ms  200.223.41.53
  6    38 ms    38 ms    57 ms  so-0-1-0.0-gua-sp-rotn-j01.telemar.net.br [200.1
64.197.213]
  7    41 ms    42 ms    41 ms  pos2-0-0-ptt-sp-rotb-01.telemar.net.br [200.223.
254.166]
  8    40 ms    41 ms    41 ms  ae6.br01.gru1.tfbnw.net [103.4.96.86]
  9   160 ms   159 ms   159 ms  ae12.bb01.mia1.tfbnw.net [31.13.26.8]
 10   184 ms   185 ms   184 ms  ae14.bb02.atl1.tfbnw.net [31.13.29.74]
 11   195 ms   193 ms   196 ms  ae15.bb03.frc3.tfbnw.net [31.13.27.120]
 12   210 ms   200 ms   201 ms  ae1.dr09.frc3.tfbnw.net [31.13.29.43]
 13     *        *        *     Esgotado o tempo limite do pedido.
 14     *        *        *     Esgotado o tempo limite do pedido.
 15     *        *        *     Esgotado o tempo limite do pedido.
 16   197 ms   199 ms   196 ms  edge-star-shv-12-frc3.facebook.com [173.252.120.
6]

Rastreamento concluído.

C:\Users\Ângela>
The main headache here is that every time the dns relay gives the AAAA addresses preferentially, istead of the ipv4 address, the client on the wireless side (actually everything behind the mikrotik), gets a white page until something times out, and falls back to the ipv4 dns answer.

That requires a lot of F5'ing the page.

For whatever reason the forum says .rif is not an allowed extension, so the file follows zipped.
192-168-234-17.zip
You do not have the required permissions to view the files attached to this post.
 
ddejager
Member Candidate
Member Candidate
Topic Author
Posts: 135
Joined: Tue Oct 18, 2011 5:13 am

Re: IPV6 disabled, clients still prefer IPV6 DNS servers

Wed Oct 29, 2014 2:53 am

and who/what is advertising IPv6 in your network?

Anyway, DNS advertising is not on by default in RouterOS. You have to head over to /ipv6 nd to set it to be included in the RA. Also, ipv6 DHCP is not capable to do that if ipv6 package is disabled as there are nothing ipv6 related underneath that would allow DHCP server to bind and send out MLD packets.
I believe that the DNS servers being configured by the clients are coming from the DHCP response they get from the MikroTik. There are no other DHCP servers on the network, nor is anything else advertising IPv6 that I know of.

This causes the nslookup problem documented above by guipoletto for me as well.
 
User avatar
janisk
MikroTik Support
MikroTik Support
Posts: 6263
Joined: Tue Feb 14, 2006 9:46 am
Location: Riga, Latvia

Re: IPV6 disabled, clients still prefer IPV6 DNS servers

Wed Oct 29, 2014 10:54 am

you can always flush cache on the router with DNS cache and see what response you get. If you do not have static entries made - DNS cache will respond with what its parent DNS server provides.
 
guipoletto
Member Candidate
Member Candidate
Posts: 199
Joined: Mon Sep 19, 2011 5:31 am

Re: IPV6 disabled, clients still prefer IPV6 DNS servers

Wed Oct 29, 2014 7:37 pm

That's the problem, i cannot control the parent DNS.

Is it possible to make mikrotik DNS cache ignore the AAAA lines?

If it's not, can it be added as a feature request?
 
ddejager
Member Candidate
Member Candidate
Topic Author
Posts: 135
Joined: Tue Oct 18, 2011 5:13 am

Re: IPV6 disabled, clients still prefer IPV6 DNS servers

Wed Oct 29, 2014 8:21 pm

I agree that if IPv6 is disabled on the router and the router is functioning as the DHCP server it should not pass through any IPv6 addresses for DNS from upstream....they will never work.
 
Sob
Forum Guru
Forum Guru
Posts: 9188
Joined: Mon Apr 20, 2009 9:11 pm

Re: IPV6 disabled, clients still prefer IPV6 DNS servers

Thu Oct 30, 2014 9:10 pm

Sounds like something misconfigured to me. Network, client, program, ...

I see that your nslookup output is from Windows and it has these default rules:

- if there is native IPv6 available to system, IPv6 addresses are preferred (it doesn't really have to be working, it's enough if the global IPv6 adress is present)
- if there is only 6to4 IPv6 available, IPv6 addresses are returned, but IPv4 ones are preferred
- if there is no good IPv6 (that includes link-local and Teredo), then only IPv4 addresses are returned

That is, if the program is written properly, i.e. it's getting the addresses by calling getaddrinfo() with AF_UNSPEC. It's no problem with any standard program like web browser (unless you use some really obscure one).

Don't mind nslookup output, it's no indication about what addresses will the programs actually use.
 
SystemErrorMessage
Member
Member
Posts: 390
Joined: Sat Dec 22, 2012 9:04 pm

Re: IPV6 disabled, clients still prefer IPV6 DNS servers

Tue Nov 04, 2014 10:21 pm

Some servers like google and probably facebook have implemented ipv6 so you will see an ipv6 address if your PC has got ipv6 enabled. This has nothing to do with mikrotik and is something your PC already supports and uses where possible.
 
ddejager
Member Candidate
Member Candidate
Topic Author
Posts: 135
Joined: Tue Oct 18, 2011 5:13 am

Re: IPV6 disabled, clients still prefer IPV6 DNS servers

Tue Nov 04, 2014 10:31 pm

Some servers like google and probably facebook have implemented ipv6 so you will see an ipv6 address if your PC has got ipv6 enabled. This has nothing to do with mikrotik and is something your PC already supports and uses where possible.
This does not explain why my DHCP client on the PC picks up a IPv6 DNC address from the MikroTik DHCP Server when IPv6 is disabled on the MikroTik. Since it is disabled on the MikroTik, the router will not pass IPv6 packets and any attempt to use such a DNS server will timeout and fail.
 
Sob
Forum Guru
Forum Guru
Posts: 9188
Joined: Mon Apr 20, 2009 9:11 pm

Re: IPV6 disabled, clients still prefer IPV6 DNS servers

Wed Nov 05, 2014 12:55 am

If you have IPv6 disabled on router, IPv6 DNS addresses can hardly come from there. What are those addresses anyway? Something "real-looking" of just automatic fec0:0:0:ffff::1-3? And more importantly, if you run "ipconfig /all" on client, do you see any IPv6 addresses besides fe80::* link-locals?
 
ddejager
Member Candidate
Member Candidate
Topic Author
Posts: 135
Joined: Tue Oct 18, 2011 5:13 am

Re: IPV6 disabled, clients still prefer IPV6 DNS servers

Wed Nov 05, 2014 1:37 am

The IPv6 addresses that are listed for DNS on the clients are:
2001:558:feed::2
2001:558:feed::1

These addresses are coming from the MikroTik DHCP server. (Along with the IPv4 address of 192.168.88.1)

What is weird about these addresses is that when I do a lookup on them they are Comcast addresses, but my ISP is Charter.

Others in this thread seem to indicate that even if IPv6 is disabled on the router it will pass through any IPv6 DNS address the router gets from it upstream DHCP server. If so, this seems to be a MikroTik bug, since it will never relay traffic back upstream with IPv6 disabled in the router.
 
SystemErrorMessage
Member
Member
Posts: 390
Joined: Sat Dec 22, 2012 9:04 pm

Re: IPV6 disabled, clients still prefer IPV6 DNS servers

Wed Nov 05, 2014 8:21 am

at times windows uses the last known working configuration on the network so even without a DHCP server it will still use the same settings on the same network. At one point you had ipv6 on mikrotik so the client shows that whenever it connects. The DHCP server only gives out details, it doesnt control what happens after. Clear your client cache and settings.

open winbox and search for your routerboard. If you dont see an ipv6 address from it that means that ipv6 isnt running on it and your client settings need to be cleared. If you do see it than it is a routerOS bug.
 
User avatar
janisk
MikroTik Support
MikroTik Support
Posts: 6263
Joined: Tue Feb 14, 2006 9:46 am
Location: Riga, Latvia

Re: IPV6 disabled, clients still prefer IPV6 DNS servers

Wed Nov 05, 2014 3:23 pm

RouterOS with ipv6 package disable is not capable of transmitting anything ipv6. ipv4 DHCP configuration is not capable of IPv6 address distribution even if IPv6 package is enabled. I can assure you - it is not coming from RouterOS.

Only thing you can get is if you request AAAA DNS entry. But that is not in any way used as some auto-configuration magic of any sorts.

Check your network.

ipv6 DHCP uses MLD - IPv6 equivalent of multicast in IPv4, for that you have to be able to create ipv6 socket that RouterOS w/o IPv6 package is not capable of.
 
Sob
Forum Guru
Forum Guru
Posts: 9188
Joined: Mon Apr 20, 2009 9:11 pm

Re: IPV6 disabled, clients still prefer IPV6 DNS servers

Wed Nov 05, 2014 3:54 pm

@ddejager: What about the second question? If you run ipconfig /all, do you see any IPv6 addresses?

You have two different problems here:

1) IPv6 DNS servers addresses

This alone should not matter at all. If system does not have any IPv6 address, it won't use those servers. It can try, but as there is no route to them, it will fail immediately and move to using some reachable IPv4 DNS server.
I tried it, I manually added two IPv6 DNS servers to system without IPv6 addresses and even though nslookup tries to use one of them, the failure is instant.

2) Clients trying to connect to IPv6 addresses

Unless your client is haunted or something ;), it simply can't happen. If system does not have any IPv6 address, no correctly written program will get IPv6 address from hostname, unless it specifically asks for IPv6. But even if it did, the result would be exactly the same as in 1). No IPv6 route => instant failure => no slowdown.
 
ddejager
Member Candidate
Member Candidate
Topic Author
Posts: 135
Joined: Tue Oct 18, 2011 5:13 am

Re: IPV6 disabled, clients still prefer IPV6 DNS servers

Wed Nov 05, 2014 5:01 pm

at times windows uses the last known working configuration on the network so even without a DHCP server it will still use the same settings on the same network. At one point you had ipv6 on mikrotik so the client shows that whenever it connects. The DHCP server only gives out details, it doesnt control what happens after. Clear your client cache and settings.

open winbox and search for your routerboard. If you dont see an ipv6 address from it that means that ipv6 isnt running on it and your client settings need to be cleared. If you do see it than it is a routerOS bug.
I do not see any IPv6 addresses assigned to the MikroTik when I scan via winbox. I do clear the cache on the PC and disable the adapter and renable it. I still then get the two IPv6 DNS Servers showing up for that adapter. I'm willing to accept that they might not be from the MikroTik. I guess I need to figure out where else they are coming from.
 
ddejager
Member Candidate
Member Candidate
Topic Author
Posts: 135
Joined: Tue Oct 18, 2011 5:13 am

Re: IPV6 disabled, clients still prefer IPV6 DNS servers

Wed Nov 05, 2014 5:05 pm

@ddejager: What about the second question? If you run ipconfig /all, do you see any IPv6 addresses?

You have two different problems here:

1) IPv6 DNS servers addresses

This alone should not matter at all. If system does not have any IPv6 address, it won't use those servers. It can try, but as there is no route to them, it will fail immediately and move to using some reachable IPv4 DNS server.
I tried it, I manually added two IPv6 DNS servers to system without IPv6 addresses and even though nslookup tries to use one of them, the failure is instant.

2) Clients trying to connect to IPv6 addresses

Unless your client is haunted or something ;), it simply can't happen. If system does not have any IPv6 address, no correctly written program will get IPv6 address from hostname, unless it specifically asks for IPv6. But even if it did, the result would be exactly the same as in 1). No IPv6 route => instant failure => no slowdown.
If I use ipconfig /all I see no other IPv6 addresses (other than the link local fe80: type). I agree with your assessment. What I observe is that after I reset things it often takes a while for the first DNS query to be successful because the IPv6 entries time out. I noticed this when I used nslookup once and saw those entries.

I'd still like to know where the bad IPv6 DNS entries are coming from...
 
User avatar
mrz
MikroTik Support
MikroTik Support
Posts: 7169
Joined: Wed Feb 07, 2007 12:45 pm
Location: Latvia
Contact:

Re: IPV6 disabled, clients still prefer IPV6 DNS servers

Wed Nov 05, 2014 5:19 pm

Unless there is default ipv6 route to link-local address?
 
Sob
Forum Guru
Forum Guru
Posts: 9188
Joined: Mon Apr 20, 2009 9:11 pm

Re: IPV6 disabled, clients still prefer IPV6 DNS servers

Wed Nov 05, 2014 11:11 pm

Ok, that might do something. I tested it and when trying to connect to some IPv6 address, system tries for a few seconds before failing.

So check "route print" or "netsh interface ipv6 show route".

This would explain some initial delay, while the system is trying to use IPv6 DNS servers, before realizing that it's not going to work. And it can probably happen again, if system decides to rotate DNS servers (I'm not sure if or how often it does that).

Still, no well-behaving program will try to connect to IPv6 address, because it won't get it from system resolver. On the other hand, I see no proof in this thread, that any actually does that. Problems could be caused just by resolver trying to use IPv6 DNS servers.

Now the questions is, how could system have such default IPv6 route. If it's not static, something must advertise it. But in that case, I'd expect the client to get an address too. Unless that something perhaps advertises to use DHCPv6 and it's not reachable or does not give any address to client.
 
guipoletto
Member Candidate
Member Candidate
Posts: 199
Joined: Mon Sep 19, 2011 5:31 am

Re: IPV6 disabled, clients still prefer IPV6 DNS servers

Thu Nov 06, 2014 3:07 am

And that get us back to the golden question:

Why not to put the intelligence in the router, making dns relay filter out ipv6 dns addresses (That won`t work anyway), so that in fully ipv4 networks we can isolate that problem?

How difficult would be to add that as an option?
 
ddejager
Member Candidate
Member Candidate
Topic Author
Posts: 135
Joined: Tue Oct 18, 2011 5:13 am

Re: IPV6 disabled, clients still prefer IPV6 DNS servers

Thu Nov 06, 2014 3:34 am

sob: not sure that the v6 route table helps:

IPv6 Route Table
===================================================
Active Routes:
If Metric Network Destination Gateway
25 58 ::/0 On-link
1 306 ::1/128 On-link
25 58 2001::/32 On-link
25 306 2001:0:5ef5:79fd:a5:32c1:b479:2a86/128
On-link
15 281 fe80::/64 On-link
25 306 fe80::/64 On-link
25 306 fe80::a5:32c1:b479:2a86/128
On-link
15 281 fe80::591d:8168:9bc8:9412/128
On-link
1 306 ff00::/8 On-link
25 306 ff00::/8 On-link
15 281 ff00::/8 On-link
===================================================
Persistent Routes:
None

guipoletto:

MikroTik Support says that their DHCP server will not forward any IPv6 addresses....still begs the question of how did this pair of DNS server addresses get into the list of servers.
 
Sob
Forum Guru
Forum Guru
Posts: 9188
Joined: Mon Apr 20, 2009 9:11 pm

Re: IPV6 disabled, clients still prefer IPV6 DNS servers

Thu Nov 06, 2014 4:59 am

Yep, it helps a little. There is indeed default route and I verified here that it's set by Teredo.

It still does not explain, where those IPv6 DNS servers come from. I'm not completely sure, but I think that Teredo can't set them. Even if it could, it would be strange, because the address of your Teredo server (5ef5:79fd => 94.245.121.253) belongs to Microsoft, while DNS addresses belong (as you already know) to Comcast.

You could disable Teredo, but it's not a solution, just a workaround. But I just found this nice command and it should show something interesting:

netsh interface ipv6 show dnsserver
 
User avatar
janisk
MikroTik Support
MikroTik Support
Posts: 6263
Joined: Tue Feb 14, 2006 9:46 am
Location: Riga, Latvia

Re: IPV6 disabled, clients still prefer IPV6 DNS servers

Thu Nov 06, 2014 10:38 am

well, we checked on our part DHCP-PD server and RA that can distribute DNS servers. Microsoft creation does not accept DNS from RA, so that is out. We are left with DHCP-PD server that in compatibility mode can attempt to distribute DNS servers. However as i have written before - DHCP-PD server to send out any packet will require IPv6 socket from the system. And that will always fail as the system knows nothing about IPv6 sockets.

If you are receiving DNS servers you can attempt to sniff traffic for ipv6 packets and see from where you are receiving them.

feature of disabling ipv6 records in DNS is just wrong and will brake more than it could possibly fix.
 
ddejager
Member Candidate
Member Candidate
Topic Author
Posts: 135
Joined: Tue Oct 18, 2011 5:13 am

Re: IPV6 disabled, clients still prefer IPV6 DNS servers

Thu Nov 06, 2014 5:45 pm

Yep, it helps a little. There is indeed default route and I verified here that it's set by Teredo.

It still does not explain, where those IPv6 DNS servers come from. I'm not completely sure, but I think that Teredo can't set them. Even if it could, it would be strange, because the address of your Teredo server (5ef5:79fd => 94.245.121.253) belongs to Microsoft, while DNS addresses belong (as you already know) to Comcast.

You could disable Teredo, but it's not a solution, just a workaround. But I just found this nice command and it should show something interesting:

netsh interface ipv6 show dnsserver
The output of the above netsh command for the wireless interface that is in use when this DNS is configured is:

Configuration for interface "Wireless Network Connection"
DNS servers configured through DHCP: 2001:558:feed::2
2001:558:feed::1
Register with which suffix: Primary only

This seems to confirm that the servers are coming at least via the MikroTik, since the MikroTik is my DHCP server.
 
Sob
Forum Guru
Forum Guru
Posts: 9188
Joined: Mon Apr 20, 2009 9:11 pm

Re: IPV6 disabled, clients still prefer IPV6 DNS servers

Thu Nov 06, 2014 7:56 pm

I don't think so, it says "DHCP" but means "DHCPv6" and without ipv6 package, you don't have one on router. It's probably some other device in network advertising this. Unfortunately, stupid as it may sound, there doesn't seem to be a way on Windows to find out address of DHCPv6 server (or my searching skills went really bad).

You might look at "netsh interface ipv6 show neighbors" right after you connect to network and with some luck, the address may be among the neighbors, perhaps even marked as router (that would be in last Type column).

Or use janisk's idea, get a packet sniffer and see what's going on. Disconnect from network, start the sniffer, set the filter (all IPv6 is probably enough, there should not be too many packets), connect to network and configuration should happen very fast.
 
ddejager
Member Candidate
Member Candidate
Topic Author
Posts: 135
Joined: Tue Oct 18, 2011 5:13 am

Re: IPV6 disabled, clients still prefer IPV6 DNS servers

Fri Nov 07, 2014 2:13 am

I used a sniffer and found that no devices were responding to the IPv6 DHCP request and that the MikroTik was only giving back the expected DNS address of 192.168.88.1. So I dug deeper...

This appears to be a windows problem on this specific computer. On this computer only, "netsh interface ipv6 show dns" shows the two rogue IPv6 DNS servers as being "configured through DHCP" on the Wireless interface only. It is not possible to delete them using netsh. Another Windows 7 machine on the same network, does not display these rogue IPv6 DNS servers.

So I suspect that at some time in the past when I connected my laptop to a wireless network that was using Comcast (not my ISP) my computer picked up those addresses and for reasons unknown is unable to forget them. I've not found a way to fix this as I searched the internet.
 
guipoletto
Member Candidate
Member Candidate
Posts: 199
Joined: Mon Sep 19, 2011 5:31 am

Re: IPV6 disabled, clients still prefer IPV6 DNS servers

Fri Nov 07, 2014 9:45 pm

Still something wrong here.

In a brand new win8.1 install, that has never ever connected to any network, i disabled every protocol except for ipv4.

Nslookup google.com still returns an ipv6 address, along with the ipv4 poll.
Microsoft Windows [versão 6.3.9600]
(c) 2013 Microsoft Corporation. Todos os direitos reservados.

C:\Users\Guilherme>nslookup google.com
Servidor:  UnKnown
Address:  192.168.234.17

Não é resposta autoritativa:
Nome:    google.com
Addresses:  2800:3f0:4001:811::100e
          173.194.119.32
          173.194.119.34
          173.194.119.41
          173.194.119.46
          173.194.119.40
          173.194.119.37
          173.194.119.39
          173.194.119.38
          173.194.119.33
          173.194.119.35
          173.194.119.36
Thishttps://wikispaces.psu.edu/display/ipv6 ... IPv6+Notes article tough, may point us some way.
Hostnames are mapped to IPv6 addresses by AAAA records in the DNS. Not all nameservers properly support queries for AAAA records.

There are two categories of bugs:

1) Nameservers which silently ignore AAAA queries. BIND 4 is notorious for this bug. This bug causes clients to wait for their AAAA query to timeout and frequently leads to the perception that "IPv6 is slow."

2) Nameservers which improperly respond to AAAA queries. It is common for a host to have an A record, but not AAAA records. When a namserver received a AAAA query, it should respond with NODATA, indicating that it does not have an AAAA record, but does have records of other type. Some nameservers are broken and return NXDOMAIN, which indicates that the server does not have records of any type for the hostname. This causes clients not to query for A records. Microsoft has a KB article about this issue. See RFC 2308 for more on NXDOMAIN -vs- NODATA.
 
Sob
Forum Guru
Forum Guru
Posts: 9188
Joined: Mon Apr 20, 2009 9:11 pm

Re: IPV6 disabled, clients still prefer IPV6 DNS servers

Sat Nov 08, 2014 2:16 am

What nslookup returns, doesn't mean anything. It's diagnostic tool, it can show all kinds of DNS records, e.g. you can run "nslookup -type=MX google.com" to get mail servers. It just happens to default to A+AAAA, but it does not mean that programs will try to use all displayed addresses.

If you want to test that, use simple "ping <hostname>". On your system without IPv6, it will always ping IPv4 address. With IPv6 protocol enabled, but without IPv6 address, it will still ping IPv4. If Teredo or 6to4 (in case of public IPv4 address) kicks in, ping will still prefer IPv4 (except when you have 6to4 and target has also 6to4 address). Only if you get public IPv6 address, ping will prefer IPv6. You can test that by manually adding 2001:db8::2/64 and gw 2001:db8::1 (it won't work, but it will be enough for system to think that it has IPv6 connectivity). Try the ping again and it will go for IPv6. Remove the fake address and it will again prefer IPv4. And most programs (except for few broken or misconfigured ones) will do exactly the same.

-

@ddejager: Funny thing happened here, after some testing, my test VM got stuck with IPv6 DNS server from DHCPv6 too. :) It refused to go away, when I wanted to delete it using netsh. But there's a way, if you are feeling adventurous, you can go to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\TCPIP6\Parameters\Interfaces\{<some guid>} (there will be several subkeys under Interfaces, look for one with many Dhcpv6* entries). I'm not sure what is safe to do there, but clearing "Dhcpv6DNSServers" and restarting helped here. But as this was only a test VM, I don't care much if it breaks, so just FYI and no warranties. There are also some other interesting values like "Dhcpv6MaxLeaseExpireTime" or "Dhcpv6LeaseObtainedTime", so it could be possible to find out when you got it and when it would expire by ifself.
 
ddejager
Member Candidate
Member Candidate
Topic Author
Posts: 135
Joined: Tue Oct 18, 2011 5:13 am

Re: IPV6 disabled, clients still prefer IPV6 DNS servers

Sat Nov 08, 2014 2:23 am

Sob: thanks for the tip. I found the IPv6 branch in the registry and all the interface IDs, but even searching the registry there are no keys for the DNS servers or leases. I've started a thread on this in a Microsoft forum and will see what advice I get there
 
ddejager
Member Candidate
Member Candidate
Topic Author
Posts: 135
Joined: Tue Oct 18, 2011 5:13 am

Re: IPV6 disabled, clients still prefer IPV6 DNS servers

Fri Nov 14, 2014 4:43 pm

Solution! I posted a thread about this on the Microsoft board: https://social.technet.microsoft.com/Fo ... f=required

It was suggested that I manually configure the IPv6 DNS and then clear the configuration.

I tried manually configuring the IPv6 DNS servers with different, fake addresses. The fake addresses showed up as the only IPv6 DNS addresses. I then removed the manual, fake addresses. The bad IPv6 addresses showed up again. I then disabled IPv6. As expected, no IPv6 DNS addresses appeared. I then re-enabled IPv6 and no IPv6 DNS addresses appeared! I then rebooted and it continued to work properly (no IPv6 DNS addresses).

Strange thing is that I had previously tried only disabling IPv6 and re-enabling and it did not fix the problem. So it appears that it was the combination of manual configuration, manual clearing, disabling IPv6 and re-enabling IPv6 that cleared the problem.

Who is online

Users browsing this forum: anav, ekinsl, Josephny, Paternot and 34 guests