IPv6 fails with "tcp-listener.c:284:"

[onehalf3570]

Hi!

What's the way to specify IPv6 addresses correctly in the protocols section?

I've enabled IPv6 on the external interface (by adding another '{ host: }' to the 'listen' section), but the host addresses in the protocols section are still IPv4 only, so the connection fails with:

Feb 28 22:37:07 external_fqdn sslh-ev[60754]: accepting from 5
Feb 28 22:37:07 external_fqdn sslh-ev[60754]: writing deferred on fd -1
Feb 28 22:37:07 external_fqdn sslh-ev[60889]: connect: No child processes
Feb 28 22:37:07 external_fqdn sslh-ev[60754]: hexdump of incoming packet:
Feb 28 22:37:07 external_fqdn sslh-ev[60754]: 0x000000: 53 53 48 2d 32 2e 30 2d 4f 70 65 6e 53 53 48 5f SSH-2.0-OpenSSH_
Feb 28 22:37:07 external_fqdn sslh-ev[60754]: 0x000010: 31 30 2e 30 70 32 20 44 65 62 69 61 6e 2d 37 20 10.0p2 Debian-7
<VersionAddendum skipped>
Feb 28 22:37:07 external_fqdn sslh-ev[60754]: probing for tls
Feb 28 22:37:07 external_fqdn sslh-ev[60754]: Request did not begin with TLS handshake.
Feb 28 22:37:07 external_fqdn sslh-ev[60754]: probed for tls: PROBE_NEXT
Feb 28 22:37:07 external_fqdn sslh-ev[60754]: probing for tls
Feb 28 22:37:07 external_fqdn sslh-ev[60754]: Request did not begin with TLS handshake.
Feb 28 22:37:07 external_fqdn sslh-ev[60754]: probed for tls: PROBE_NEXT
Feb 28 22:37:07 external_fqdn sslh-ev[60754]: probing for tls
Feb 28 22:37:07 external_fqdn sslh-ev[60754]: Request did not begin with TLS handshake.
Feb 28 22:37:07 external_fqdn sslh-ev[60754]: probed for tls: PROBE_NEXT
Feb 28 22:37:07 external_fqdn sslh-ev[60754]: probing for regex
Feb 28 22:37:07 external_fqdn sslh-ev[60754]: probed for regex: PROBE_MATCH
Feb 28 22:37:07 external_fqdn sslh-ev[60754]: closing fd 10
Feb 28 22:37:07 external_fqdn sslh-ev[60889]: closing fd 8
Feb 28 22:37:07 external_fqdn sslh-ev[60889]: closing fd 9
Feb 28 22:37:07 external_fqdn sslh-ev[60889]: Proto timeout -1: 0/0 cnx
Feb 28 22:37:07 external_fqdn sslh-ev[60889]: Endpoint 5 -1: 1/0 cnx
Feb 28 22:37:07 external_fqdn sslh-ev[60889]: tcp-listener.c:284:
Feb 28 22:37:07 external_fqdn sslh-ev[60754]: Proto regex -1: 0/0 cnx
Feb 28 22:37:07 external_fqdn sslh-ev[60754]: Endpoint 5 -1: 1/0 cnx

(IPv4 connections are ok)

As I understand there would be no IPv4 <-> IPv6 translation (or at least not in transparent proxy mode? Didn't check the code yet UPD: yes:

sslh/common.c

Line 425 in e2d01a7

/* When transparent, make sure both connections use

), but what's the way to have a dual stack configuration then?

UPD: I guess the proper way would be to allow multiple 'host:' entries in the protocols section, at the moment such approach fails with:

sslh-ev[60936]: /etc/sslh/sslh.conf:56:duplicate setting name

..56 being the line with the extra (IPv6) address for that matcher

Thanks.

[yrutschle]

The addresses in the protocol section need to resolve to both, so typically you would have: protocol: ( { name: "ssh"; host: "localhost"; port: "9000"; } ); and find in /etc/hosts: 127.0.0.1 localhost ::1 localhost It's not possible to have translation with transparent proxy, as by definition transparent proxying keeps the external client address, and you can't transport an external IPv6 address on an internal IPv4 address. You can however use proxyprotocol to achieve a similar effect.

…

On Sat, Feb 28, 2026 at 11:51:03AM -0800, onehalf3570 wrote: Hi! What's the way to specify IPv6 addresses correctly in the protocols section? I've enabled IPv6 on the external interface (by adding another '{ host: }' to the 'listen' section), but the host addresses in the protocols section are still IPv4 only, so the connection fails with: ``` Feb 28 22:37:07 external_fqdn sslh-ev[60754]: accepting from 5 Feb 28 22:37:07 external_fqdn sslh-ev[60754]: writing deferred on fd -1 Feb 28 22:37:07 external_fqdn sslh-ev[60889]: connect: No child processes Feb 28 22:37:07 external_fqdn sslh-ev[60754]: hexdump of incoming packet: Feb 28 22:37:07 external_fqdn sslh-ev[60754]: 0x000000: 53 53 48 2d 32 2e 30 2d 4f 70 65 6e 53 53 48 5f SSH-2.0-OpenSSH_ Feb 28 22:37:07 external_fqdn sslh-ev[60754]: 0x000010: 31 30 2e 30 70 32 20 44 65 62 69 61 6e 2d 37 20 10.0p2 Debian-7 Feb 28 22:37:07 external_fqdn sslh-ev[60754]: probing for tls Feb 28 22:37:07 external_fqdn sslh-ev[60754]: Request did not begin with TLS handshake. Feb 28 22:37:07 external_fqdn sslh-ev[60754]: probed for tls: PROBE_NEXT Feb 28 22:37:07 external_fqdn sslh-ev[60754]: probing for tls Feb 28 22:37:07 external_fqdn sslh-ev[60754]: Request did not begin with TLS handshake. Feb 28 22:37:07 external_fqdn sslh-ev[60754]: probed for tls: PROBE_NEXT Feb 28 22:37:07 external_fqdn sslh-ev[60754]: probing for tls Feb 28 22:37:07 external_fqdn sslh-ev[60754]: Request did not begin with TLS handshake. Feb 28 22:37:07 external_fqdn sslh-ev[60754]: probed for tls: PROBE_NEXT Feb 28 22:37:07 external_fqdn sslh-ev[60754]: probing for regex Feb 28 22:37:07 external_fqdn sslh-ev[60754]: probed for regex: PROBE_MATCH Feb 28 22:37:07 external_fqdn sslh-ev[60754]: closing fd 10 Feb 28 22:37:07 external_fqdn sslh-ev[60889]: closing fd 8 Feb 28 22:37:07 external_fqdn sslh-ev[60889]: closing fd 9 Feb 28 22:37:07 external_fqdn sslh-ev[60889]: Proto timeout -1: 0/0 cnx Feb 28 22:37:07 external_fqdn sslh-ev[60889]: Endpoint 5 -1: 1/0 cnx Feb 28 22:37:07 external_fqdn sslh-ev[60889]: tcp-listener.c:284: Feb 28 22:37:07 external_fqdn sslh-ev[60754]: Proto regex -1: 0/0 cnx Feb 28 22:37:07 external_fqdn sslh-ev[60754]: Endpoint 5 -1: 1/0 cnx ``` (IPv4 connections are ok) As I understand there would be no IPv4 <-> IPv6 translation (or at least not in transparent proxy mode? Didn't check the code yet), but what's the way to have a dual stack configuration then? Thanks. -- Reply to this email directly or view it on GitHub: #525 You are receiving this because you are subscribed to this thread. Message ID: ***@***.***>

[onehalf3570]

Thank you! It works. Indeed, I missed the fact that transparent proxying won't work across different protocols ;)
I'd suggest updateing simple_transparent_proxy.md, as this configuration isn't obvious at first glance.

For the sake of completeness, here is the interfaces file used (also turned out to be not very obvious for the dual stack + dummy combination):

# cat /etc/network/interfaces.d/sslh.cfg 
auto sslh
iface sslh inet static
    address 192.168.128.254/32

    pre-up modprobe dummy; ip link add sslh type dummy

    post-up ip rule add from 192.168.128.254 table sslh
    post-up ip route add local 0.0.0.0/0 dev sslh table sslh

    pre-down ip route del local 0.0.0.0/0 dev sslh table sslh
    pre-down ip rule del from 192.168.128.254 table sslh

iface sslh inet6 static
    address fcff::ffff/128

    post-up ip -6 rule add from fcff::ffff table sslh
    post-up ip -6 route add local ::/0 dev sslh table sslh

    pre-down ip -6 route del local ::/0 dev sslh table sslh
    pre-down ip -6 rule del from fcff::ffff table sslh
    
    post-down ip link del sslh