IPv6 upstream problem

[Maxim Dounin]

Hello!

On Tue, Feb 28, 2017 at 10:57:01PM +0700, Dewangga Bachrul Alam wrote:

> Currently I have problem with upstream with IPv6. For example I have
> an origin with subdomain dual-stack-ipv4-ipv6.xtremenitro.org.
> 
> dual-stack-ipv4-ipv6.xtremenitro.org IN A 192.168.1.1
> dual-stack-ipv4-ipv6.xtremenitro.org IN AAAA 2001:xx:xx::1;

[...]

> resolver 103.52.3.72 ipv6=off;
> 
> upstream cf {
>         server dual-stack-ipv4-ipv6.xtremenitro.org;

[...]

> I see on error log, all error was came from IPv6 upstream.
> 
> 2017/02/28 22:13:15 [error] 24079#24079: *429979 upstream timed out
> (110: Connection timed out) while connecting to upstream, client:
> 114.120.233.8, server: dual-stack-ipv4-ipv6.xtremenitro.org, request:
> "GET /2015-09/thumbnail_360/wd/d7d63419f8ac6b6981cec72c8a6644ea.jpg
> HTTP/2.0", subrequest:
> "/2015-09/thumbnail_360/wd/d7d63419f8ac6b6981cec72c8a6644ea.jpg",
> upstream:
> "http://[2600:9000:2031:4000:6:24ba:3100:93a1]:80/2015-09/thumbnail_360/
> wd/d7d63419f8ac6b6981cec72c8a6644ea.jpg?of=webp&q=50",
> host: "dual-stack-ipv4-ipv6.xtremenitro.org", referrer: "[REMOVED]"

It looks like you assume that "resolver ... ipv6=off" is expected 
to prevent nginx from using IPv6 addresses of all names written in 
the configuration.  This is not how it works though.

The "resolver" directive is only used for dynamic resolution of 
names not known during configuration parsing.  Most notably, it is 
used to resolve names in proxy_pass with variables.

The name in the "server dual-stack-ipv4-ipv6.xtremenitro.org;" is 
known while configuration parsing, and nginx will simply use the 
getaddrinfo() function to resolve it.  You have to tune your OS 
name resolution settings if you want it to return IPv4 addresses 
only.

-- 
Maxim Dounin
http://nginx.org/