1

I have a VPN (WireGuard right now, but the same behaviour manifested with OpenVPN) that provides me with an IPv6 address. I can confirm that it is working because pings (both from the android terminal with ping6 and to the android terminal from the other side of the VPN) work. This also confirms that the VPN is establishing the DNS server properly, as I am using an internal domain while pinging from Android.

However, the browser (both Chrome and Firefox) only work properly when the main connectivity has also IPv6 enabled. That means that if I am connected to a WiFi that provides IPv6 connectivity, then the VPN works properly. But if I am using mobile data (my ISP doesn't provide IPv6) or I am using a IPv6-less WiFi, then the browser doesn't work for IPv6-only URLs. The android terminal ping6 command keeps working in all scenarios, meaning that the VPN is properly connected and working, but it's as if the browser/android machinery refuses to use AAAA records and the browser gives me an error.

Is that a known issue? I am using Android 11. Can I change something or force Android to believe that there is an IPv6 connection established? Is the browser's fault? Is the DNS resolver fault?

Edit: Forgot to mention: if I manually enter the IPv6 into the browser, it loads the web properly. So it seems that there is a DNS issue there, but the DNS is properly set up. So I assume that Android (or both browsers) are misjudging when to use AAAA records, hence the title of this question.

Improve this question

1 Answer 1

Reset to default
2

Configure your VPN to route the entire IPv6 address space. The requirement is that you need a default route for IPv6 for chrome to consider AAAA.

I was having the exactly same problem on android 12 and my VPN was configured to only route a ULA /56. Setting a default route through the VPN should cause chrome to start resolving domains with AAAA.

The caveat is of course all IPv6 traffic now goes through the VPN even when your WiFi/Cellular has native IPv6. I guess I just have to prepare two profiles now.

Improve this answer
2
  • Thanks, this solved the problem for me. I'm curious to understand the reasoning for this behaviour. Do you know if there is any documentation about it?
    – IanB
    Commented Jul 2 at 11:50
  • 1
    @IanB No documentation as I am aware of, but this behavior does make some sense. If you don't have a IPv6 default route you most likely aren't connected to the wider IPv6 address space (by extension the Internet). No point to resolve an AAAA if it can't be routed. In my case, the VPN route a IPv6 internal network w/ a local AAAA resolver that only resolves some internal domains into ULAs. I think android can still attempt to resolve AAAA and fallback to A records if it turns out to match no routes IMHO, but google is google.
    – cth451
    Commented Aug 4 at 2:47

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .