-1

I'm running a Raspbian client connecting via HTTP to a Raspbian server. Apache on server is setup to not require authentication for local IPs- both ip4 and ip6. Both client and server are attached to single FritzBox router.

Client has multiple IPs available:

wlan0     Link encap:Ethernet  HWaddr 80:1f:02:7c:de:8c
      inet addr:192.168.0.46  Bcast:192.168.0.255  Mask:255.255.255.0
      inet6 addr: fe80::821f:2ff:fe7c:de8c/64 Scope:Link
      inet6 addr: 2a02:8108:xxxx:xxxx:xxxx:xxxx:xxxx:8a0a/64 Scope:Global
      UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
      RX packets:389873 errors:0 dropped:1009 overruns:0 frame:0
      TX packets:265130 errors:0 dropped:1 overruns:0 carrier:0
      collisions:0 txqueuelen:1000
      RX bytes:186117464 (177.4 MiB)  TX bytes:35864729 (34.2 MiB)

Server's Apache access log shows that client uses 2a02:8108... which is not in the allowed local IP range.

Why does the client chose a global IP for connecting inside the local subnet and how can this be influenced?

Update

Both server and client are in the same local network and both have link-local addresses:

client

eth0      Link encap:Ethernet  HWaddr b8:27:eb:a9:e8:80
      inet addr:192.168.0.48  Bcast:192.168.0.255  Mask:255.255.255.0
      inet6 addr: fe80::3e43:e197:e064:1be8/64 Scope:Link
      inet6 addr: 2a02:8108:9c40:...:1192/64 Scope:Global

server

eth0      Link encap:Ethernet  HWaddr b8:27:eb:50:df:c6
      inet addr:192.168.0.21  Bcast:192.168.0.255  Mask:255.255.255.0
      inet6 addr: fe80::ba27:ebff:fe50:dfc6/64 Scope:Link
      inet6 addr: 2a02:8108:9c40:...:dfc6/64 Scope:Global

server apache log

2a02:8108:9c40:...:1dcd:8339 - - [11/Dec/2016:13:30:30 +0000] "GET /middleware.php/capabilities/definitions.json HTTP/1.1" 401 387 "http://keller.fritz.box/frontend/" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:50.0) Gecko/20100101 Firefox/50.0"
andig
  • 171
  • 9

1 Answers1

0

The address selection algorithm is described in https://www.rfc-editor.org/rfc/rfc6724.

Unless the address of the server is a link-local address (fe80:...) then the client is correct in using its global scope address as the source address. It won't use a link-local source address with a global destination.

Take a look at the examples in https://www.rfc-editor.org/rfc/rfc6724#section-10.1. They seem to exactly match your situation.

Sander Steffann
  • 7,712
  • 19
  • 29