GIT via SSH stopped working on IPv6

[armujahid]

I am unable to do git via ssh operations from a specific ISP (since yesterday). As per ISP (Stormfiber/ Cyber Internet Services, AS9541), there is no blocking or routing issue from their end and they are claiming that bitbucket is blocking my IPv6. 

ssh -T -vvv git@bitbucket.org in which you can see that the connection is stuck and I don't get "Connection established." message.

debug1: Connecting to bitbucket.org [2406:da00:ff00::22c0:3470] port 22. debug3: set_sock_tos: set socket 3 IPV6_TCLASS 0x48 debug1: connect to address 2406:da00:ff00::22c0:3470 port 22: Connection timed out debug1: Connecting to bitbucket.org [2406:da00:ff00::22e9:9f55] port 22. debug3: set_sock_tos: set socket 3 IPV6_TCLASS 0x48

Any idea what could be the issue and how to get this resolved? Can anyone from bitbucket check to see if there is any IP blocking on their end? if not then please respond here so that I can forward the details to my ISP.

1) I don't want to disable IPv6 (ssh is working fine on IPv4)

2) it's also working fine on IPv6 using a different ISP. (successfully connecting to bitbucket.org [2406:da00:ff00::22cd:e0db] port 22)

Twitter thread:

https://x.com/armujahid/status/1801681491086176710

[Patrik S]

Hello @armujahid ,

thank you for reaching out to the Community!

Bitbucket Cloud may block IP addresses based on US sanctioned countries (although that article is for Trello, it's also applicable for Bitbucket Cloud).

In this case, as you're trying with multiple ISP connections, are each of the ISP IP addresses identified as the same country when you provide them to the following IP geo tool, or is the non-working ISP showing a different country than the other ones?

• https://www.iplocation.net/

Also, the fact that it happens only with a particular ISP suggests an issue with the ISP themselves. However, I see you mentioned that the bitbucket.org domain resolves to different IPv6 addresses in each of the ISPs you tried, with the working one resolving to 

2406:da00:ff00::22cd:e0db

With that in mind, could you try making an SSH connection directly to that IP address from the non-working ISP connection and check if it also hangs? 

ssh -Tvvv 2406:da00:ff00::22cd:e0db

 This would help to narrow down if the issue is with a singular IP only.

Thank you, @armujahid !

Patrik S

[armujahid]

1. Both working and non-working ISPs are from Pakistan which isn't sanctioned. in fact, I work for a US based company.
2. I tested direct SSH to all four IPs from both working and non-working ISPs. This is the result.

2400:adc5::  (can't access any IPv6 address of bitbucket. I tested with all three. 104.192.141.1 is accessible )

2404:3100:: (can access all three IPv6 addresses and 104.192.141.1)

You can verify using https://ipinfo.io/ that both IPv6 prefixes belong to Pakistan.

[Patrik S]

Hey @armujahid ,

thank you for the update.

I can confirm that those IPs are not being blocked on Bitbucket's end. As mentioned, IP blocking only happens to sanctioned countries.

I suggest following up with your ISP with that information so they can run a trace and find where in the path between their link and Atlassian infrastructure the packets are being blocked.

Thank you, @armujahid !

Patrik S

[Nicolas Grossi]

@armujahid You might use your company information to file an issue on support.atlassian.com

Nicolas

[Nicolas Grossi]

@armujahid The strange thing is that is working using another ISP. Could you please reach out support.atlassian.com with your issue ?

Nicolas

[armujahid]

I tried using support.atlassian.com but it's only giving me two options. Explore community and view documentation. Does support has an email?

yes it's working on two seperate ISPs but both are using different v6 destination IPs. Bitbucket has 3 IPv6 addresses. The ISP being blocked is using one IP. Other two ISP are using other ips to connect. Details are in my Twitter thread

[Nicolas Grossi]

@armujahid you license type is ?

Nicolas

[armujahid]

I am a free user but the company I am working with is using Paid plan with Jira etc.