Then set the domain to ipv6 and rebuild. For some reason accessing the site over ipv6 still doesn’t work (tested with https://ready.chair6.net/ and https://internet.nl). Am I missing something obvious?
I have a firewall outside of hestia, so mysql ports and such are not a concern for me.
I tried this, but unfortunately I am still unable to access the website on ipv6. My testcase is https://ipv6.dev.elementon.nl/.
Any other suggestions? This should work right? I can confirm that the /etc/nginx/conf.d/domains/* file gets correctly updated with the above listen directive.
Thanks for the response! Life happened and it took me a while to get back to this. But your suggestion was indeed the solution. I can’t believe “ensure your dns record is correct” was the actual culprit .
I’m going to brush up on my AAAA record knowledge. I figured since 2a01:4f8:c012:c9f4:: is a valid IPV6 address it would also be a valid AAAA record, but apparently not?
Thanks for the suggestion, this really helped a lot.
This works with normal added website, but how to make control panel accessible to IPv6 hestia? I tried with [https://host.name:8083] but it doesn’t work. How to make control panel listen to [ipv6ip]:port?
Hello I post here my custom nginx template, just adding the ipv6 support.
it starts from the “hosting” nginx template
and based on the Sahsanu answer
Copy the 3 files below under /usr/local/hestia/data/templates/web/nginx folder and set the right permissions (replicate the existing permissions from other templates, with chmod).
Then select this new template (ipv6 template) from the Hestiacp UI for each domains on the Proxy entry (under “advanced”).
if not enought then use the command for making changes ## v-rebuild-user [theusername] yes
or ## v-rebuild-web-domain [theusername] [thedomain] yes
to test it : visit the website url throught a mobile operator network, with and without the fix : looking for error message.
I suggest all nginx templates should include the line listen [::]XXXX
The motivation : → I have installed hestiacp and out of the box : people from mobile operator and few other users visiting my sites were not able to access to the website, receiving an error display page :
“the site does not exists”
or “this site is dangerous, Enter at your own risk !” [from https, no ssl certificate, but one exists]
with no log on hestiaCP server.
ipv6.tpl file
#=========================================================================#
# Default Web Domain Template #
# DO NOT MODIFY THIS FILE! CHANGES WILL BE LOST WHEN REBUILDING DOMAINS #
# https://hestiacp.com/docs/server-administration/web-templates.html #
#=========================================================================#
server {
listen %ip%:%proxy_port%;
#https://forum.hestiacp.com/t/adding-ipv6-support-to-nginx/12574/2
# accept ipv6 !
listen [::]:%proxy_port%;
server_name %domain_idn% %alias_idn%;
error_log /var/log/%web_system%/domains/%domain%.error.log error;
include %home%/%user%/conf/web/%domain%/nginx.forcessl.conf*;
location ~ /\.(?!well-known\/|file) {
deny all;
return 404;
}
location / {
proxy_pass http://%ip%:%web_port%;
location ~* ^.+\.(%proxy_extensions%)$ {
try_files $uri @fallback;
root %docroot%;
access_log /var/log/%web_system%/domains/%domain%.log combined;
access_log /var/log/%web_system%/domains/%domain%.bytes bytes;
expires max;
}
}
location @fallback {
proxy_pass http://%ip%:%web_port%;
}
location /error/ {
alias %home%/%user%/web/%domain%/document_errors/;
}
disable_symlinks if_not_owner from=%docroot%;
include %home%/%user%/conf/web/%domain%/nginx.conf_*;
}
and ipv6.stpl :
#=========================================================================#
# Default Web Domain Template #
# DO NOT MODIFY THIS FILE! CHANGES WILL BE LOST WHEN REBUILDING DOMAINS #
# https://hestiacp.com/docs/server-administration/web-templates.html #
#=========================================================================#
server {
listen %ip%:%proxy_ssl_port% ssl;
#https://forum.hestiacp.com/t/adding-ipv6-support-to-nginx/12574/2
# accept ipv6 !
listen [::]:%proxy_ssl_port% ssl;
server_name %domain_idn% %alias_idn%;
error_log /var/log/%web_system%/domains/%domain%.error.log error;
ssl_certificate %ssl_pem%;
ssl_certificate_key %ssl_key%;
#Commented out ssl_stapling directives due to Lets Encrypt ending OCSP support in 2025
#ssl_stapling on;
#ssl_stapling_verify on;
# TLS 1.3 0-RTT anti-replay
if ($anti_replay = 307) { return 307 https://$host$request_uri; }
if ($anti_replay = 425) { return 425; }
include %home%/%user%/conf/web/%domain%/nginx.hsts.conf*;
location ~ /\.(?!well-known\/|file) {
deny all;
return 404;
}
location / {
proxy_ssl_server_name on;
proxy_ssl_name $host;
proxy_pass https://%ip%:%web_ssl_port%;
location ~* ^.+\.(%proxy_extensions%)$ {
try_files $uri @fallback;
root %sdocroot%;
access_log /var/log/%web_system%/domains/%domain%.log combined;
access_log /var/log/%web_system%/domains/%domain%.bytes bytes;
expires max;
}
}
location @fallback {
proxy_ssl_server_name on;
proxy_ssl_name $host;
proxy_pass https://%ip%:%web_ssl_port%;
}
location /error/ {
alias %home%/%user%/web/%domain%/document_errors/;
}
disable_symlinks if_not_owner from=%sdocroot%;
proxy_hide_header Upgrade;
include %home%/%user%/conf/web/%domain%/nginx.ssl.conf_*;
}
.