IPv4 to IPv6 SSH Proxy
To allow accessing IPv6-only servers through SSH from networks which only have IPv4 connectivity, we provide an IPv4 to IPv6 proxy for SSH traffic.
This is currently only applicable to VPSes. We provide a separate system for SSHing to Raspberry Pi servers over IPv4, which we plan to merge into this system in the future.
Using the SSH proxy
The proxy is disabled by default, when a new server is provisioned. It can be enabled through our control panel, on the page for your virtual server. This option will only be displayed if your server is IPv6-only.
When enabled, you will be provided with a port number in the control panel. You can then SSH to sshproxy.mythic-beasts.com on that port, which will be proxied through to port 22 on your server.
IPv6 source addresses
Connections to your server through the proxy will have IPv6 source addresses in the subnet 2a00:1098:1:100::/56. The last 32 bits of the IPv6 address will be set to the IPv4 address which originated the connection.
This means that the original IPv4 address is preserved, and if your server is running automated blocking software such as fail2ban, it will be possible for it to block individual IPv4 addresses.
Firewalling
We run multiple proxy instances, each of which originates IPv6 connections from its own subnet. Therefore, it is not safe to refer to specific IPv6 addresses in your firewall configuration, as the IPv6 address may change when traffic is handled by a different proxy instance.
You can match specific IPv4 addresses by checking the IPv6 address is within the /56 for the proxy, and matching the last 32 bits against the IPv4 address. For example, using nftables:
tcp dport 22 ip6 saddr 2a00:1098:1:100::/56 ip6 saddr & ::ffff:ffff == ::192.0.2.1 counter accept
Old SSH proxy
We previously supported an older SSH proxy system, where you could SSH to a specific port on the hostname admin.vpsname.vs.mythic-beasts.com. We are currently in the process of decommissioning this - if you are still using the old system, please enable the new proxy through our control panel, and use the new details for SSH access.