[Bug]: Appstore unusable behind NAT64?

[86dd]

⚠️ This issue respects the following points: ⚠️

• This is not a troubleshooting question, general support matter, or webserver/proxy problem, but likely a bug (if unsure, ask the Community Help Forum).
• This issue is not already reported on Github OR solved at the Community Help Forum (I've searched!).
• I'm using a maintained major version of Nextcloud Server and tested against the latest patch level. (Supported major versions and current patch levels).
• I agree to follow Nextcloud's Code of Conduct.
• I've tried my best to provide clear reproduction steps that someone unfamiliar with this bug could use to reproduce it.

Bug description

Nextcloud refuses to install applications from appstore when the instance is on an IPv6-Only network with SIIT-DC/NAT64/DNS64 gateway

Steps to reproduce

1. Install Nextcloud behind an IPv6 only network, using tayga for stateless NAT64 and unbound with DNS64 enabled.
2. Setup works fine
3. Try to install application like OpenID backend
4. Get asked for password
5. Nothing happens
6. Check logs

Expected behavior

Application is installed successfully without pinning DNS hostnames to legacy IPv4 addresses

Nextcloud Server version

35

Operating system

Debian/Ubuntu

PHP engine version

PHP 8.3

Web server

Other

Database engine version

PostgreSQL

Is this bug present after an update or on a fresh install?

Fresh Nextcloud Server install

Are you using the Nextcloud Server Encryption module?

None

What user-backends are you using?

• Default user-backend (database)
• LDAP/ Active Directory
• SSO - SAML
• Other

Configuration report

{
    "system": {
        "instanceid": "***REMOVED SENSITIVE VALUE***",
        "passwordsalt": "***REMOVED SENSITIVE VALUE***",
        "secret": "***REMOVED SENSITIVE VALUE***",
        "trusted_domains": [
            "cloud.inklusives.theater"
        ],
        "datadirectory": "***REMOVED SENSITIVE VALUE***",
        "dbtype": "pgsql",
        "version": "35.0.1.1",
        "overwrite.cli.url": "https:\/\/cloud.inklusives.theater",
        "dbname": "***REMOVED SENSITIVE VALUE***",
        "dbhost": "***REMOVED SENSITIVE VALUE***",
        "dbtableprefix": "oc_",
        "dbuser": "***REMOVED SENSITIVE VALUE***",
        "dbpassword": "***REMOVED SENSITIVE VALUE***",
        "installed": true,
        "mail_smtpmode": "smtp",
        "mail_smtpsecure": "ssl",
        "mail_sendmailmode": "smtp",
        "mail_smtpstreamoptions": {
            "ssl": {
                "allow_self_signed": false,
                "verify_peer": true,
                "verify_peer_name": true
            }
        },
        "ldapProviderFactory": "OCA\\User_LDAP\\LDAPProviderFactory"
    }
}

List of activated Apps

Enabled:
  - activity: 8.0.0
  - app_api: 35.0.0
  - appstore: 2.0.0-dev.0
  - bruteforcesettings: 8.0.0
  - circles: 35.0.0
  - cloud_federation_api: 2.0.0-dev.0
  - comments: 2.0.0-dev.0
  - contactsinteraction: 2.0.0-dev.0
  - dashboard: 8.0.0-dev.0
  - dav: 2.0.0-dev.1
  - federatedfilesharing: 2.0.0-dev.1
  - federation: 2.0.0-dev.0
  - files: 3.0.0-dev.0
  - files_downloadlimit: 5.3.0
  - files_lock: 35.0.0
  - files_pdfviewer: 8.0.0
  - files_reminders: 2.0.0-dev.0
  - files_sharing: 2.0.0-dev.1
  - files_trashbin: 2.0.0-dev.0
  - files_versions: 2.0.0-dev.0
  - firstrunwizard: 8.0.0
  - logreader: 8.0.0
  - lookup_server_connector: 2.0.0-dev.0
  - nextcloud_announcements: 7.0.0
  - notifications: 8.0.0
  - oauth2: 2.0.0-dev.0
  - office: 1.1.0
  - password_policy: 7.0.0
  - photos: 8.0.0
  - privacy: 7.0.0
  - profile: 2.0.0-dev.0
  - provisioning_api: 2.0.0-dev.0
  - recommendations: 8.0.0
  - related_resources: 6.0.0
  - serverinfo: 7.0.0
  - settings: 2.0.0-dev.0
  - sharebymail: 2.0.0-dev.0
  - sharing: 1.0.4
  - support: 7.0.0
  - survey_client: 7.0.0
  - systemtags: 2.0.0-dev.0
  - text: 9.0.0
  - theming: 3.0.0-dev.0
  - twofactor_backupcodes: 2.0.0-dev.0
  - twofactor_totp: 17.1.0
  - updatenotification: 2.0.0-dev.0
  - user_ldap: 2.0.0-dev.0
  - user_status: 2.0.0-dev.0
  - viewer: 8.0.0
  - weather_status: 2.0.0-dev.0
  - webhook_listeners: 2.0.0-dev.0
  - workflowengine: 3.0.0-dev.0
Disabled:
  - admin_audit: 2.0.0-dev.0
  - encryption: 3.0.0-dev.0
  - files_external: 2.0.0-dev.0
  - suspicious_login: 13.0.0
  - twofactor_nextcloud_notification: 9.0.0

Nextcloud Signing status

No errors have been found.

Nextcloud Logs

{
  "reqId": "1QT4vePqWwE9N0xhZDRi",
  "level": 3,
  "time": "2026-09-27T12:46:11+00:00",
  "remoteAddr": "***REMOVED SENSITIVE VALUE***",
  "user": "admin",
  "app": "appstore",
  "method": "POST",
  "url": "/ocs/v2.php/apps/appstore/api/v1/apps/enable",
  "scriptName": "/ocs/v2.php",
  "message": "could not enable app",
  "userAgent": "Mozilla/5.0 (X11; Linux x86_64; rv:155.0) Gecko/20100101 Firefox/155.0",
  "version": "35.0.1.1",
  "exception": {
    "Exception": "OCP\\Http\\Client\\LocalServerException",
    "Message": "Host \"64:ff9b:1::8c52:7903\" (github.com:80) violates local access rules",
    "Code": 0,
    "Trace": [
      {
        "file": "/srv/nextcloud/3rdparty/guzzlehttp/guzzle/src/PrepareBodyMiddleware.php",
        "line": 35,
        "function": "OC\\Http\\Client\\{closure}",
        "class": "OC\\Http\\Client\\DnsPinMiddleware",
        "type": "->",
        "args": [
          "*** sensitive parameters replaced ***"
        ]
      },
      {
        "file": "/srv/nextcloud/3rdparty/guzzlehttp/guzzle/src/Middleware.php",
        "line": 31,
        "function": "__invoke",
        "class": "GuzzleHttp\\PrepareBodyMiddleware",
        "type": "->",
        "args": [
          "*** sensitive parameters replaced ***",
          "*** sensitive parameters replaced ***"
        ]
      },
      {
        "file": "/srv/nextcloud/3rdparty/guzzlehttp/guzzle/src/RedirectMiddleware.php",
        "line": 72,
        "function": "GuzzleHttp\\{closure}",
        "class": "GuzzleHttp\\Middleware",
        "type": "::",
        "args": [
          "*** sensitive parameters replaced ***"
        ]
      },
      {
        "file": "/srv/nextcloud/3rdparty/guzzlehttp/guzzle/src/Middleware.php",
        "line": 66,
        "function": "__invoke",
        "class": "GuzzleHttp\\RedirectMiddleware",
        "type": "->",
        "args": [
          "*** sensitive parameters replaced ***",
          "*** sensitive parameters replaced ***"
        ]
      },
      {
        "file": "/srv/nextcloud/3rdparty/guzzlehttp/guzzle/src/HandlerStack.php",
        "line": 75,
        "function": "GuzzleHttp\\{closure}",
        "class": "GuzzleHttp\\Middleware",
        "type": "::",
        "args": [
          "*** sensitive parameters replaced ***"
        ]
      },
      {
        "file": "/srv/nextcloud/3rdparty/guzzlehttp/guzzle/src/Client.php",
        "line": 1109,
        "function": "__invoke",
        "class": "GuzzleHttp\\HandlerStack",
        "type": "->",
        "args": [
          "*** sensitive parameters replaced ***",
          "*** sensitive parameters replaced ***"
        ]
      },
      {
        "file": "/srv/nextcloud/3rdparty/guzzlehttp/guzzle/src/Client.php",
        "line": 243,
        "function": "transfer",
        "class": "GuzzleHttp\\Client",
        "type": "->",
        "args": [
          "*** sensitive parameters replaced ***",
          "*** sensitive parameters replaced ***"
        ]
      },
      {
        "file": "/srv/nextcloud/3rdparty/guzzlehttp/guzzle/src/Client.php",
        "line": 273,
        "function": "requestAsync",
        "class": "GuzzleHttp\\Client",
        "type": "->",
        "args": [
          "*** sensitive parameters replaced ***"
        ]
      },
      {
        "file": "/srv/nextcloud/lib/private/Http/Client/Client.php",
        "line": 215,
        "function": "request",
        "class": "GuzzleHttp\\Client",
        "type": "->",
        "args": [
          "*** sensitive parameters replaced ***",
          "*** sensitive parameters replaced ***",
          {
            "0": "And 4 more entries, set log level to debug to see all entries",
            "verify": "/srv/nextcloud/resources/config/ca-bundle.crt",
            "timeout": 120,
            "version": "2.0",
            "curl": {
              "84": 4
            },
            "allow_redirects": {
              "on_redirect": {
                "__class__": "Closure"
              }
            }
          }
        ]
      },
      {
        "file": "/srv/nextcloud/lib/private/Installer.php",
        "line": 240,
        "function": "get",
        "class": "OC\\Http\\Client\\Client",
        "type": "->",
        "args": [
          "*** sensitive parameters replaced ***"
        ]
      },
      {
        "file": "/srv/nextcloud/apps/appstore/lib/Controller/ApiController.php",
        "line": 173,
        "function": "downloadApp",
        "class": "OC\\Installer",
        "type": "->",
        "args": [
          "user_oidc"
        ]
      },
      {
        "file": "/srv/nextcloud/lib/private/AppFramework/Http/Dispatcher.php",
        "line": 198,
        "function": "enableApp",
        "class": "OCA\\Appstore\\Controller\\ApiController",
        "type": "->",
        "args": [
          "user_oidc",
          [],
          false
        ]
      },
      {
        "file": "/srv/nextcloud/lib/private/AppFramework/Http/Dispatcher.php",
        "line": 86,
        "function": "executeController",
        "class": "OC\\AppFramework\\Http\\Dispatcher",
        "type": "->",
        "args": [
          {
            "__class__": "OCA\\Appstore\\Controller\\ApiController"
          },
          "enableApp"
        ]
      },
      {
        "file": "/srv/nextcloud/lib/private/AppFramework/App.php",
        "line": 138,
        "function": "dispatch",
        "class": "OC\\AppFramework\\Http\\Dispatcher",
        "type": "->",
        "args": [
          {
            "__class__": "OCA\\Appstore\\Controller\\ApiController"
          },
          "enableApp"
        ]
      },
      {
        "file": "/srv/nextcloud/lib/private/Route/Router.php",
        "line": 324,
        "function": "main",
        "class": "OC\\AppFramework\\App",
        "type": "::",
        "args": [
          "OCA\\Appstore\\Controller\\ApiController",
          "enableApp",
          {
            "__class__": "OC\\AppFramework\\DependencyInjection\\DIContainer"
          },
          {
            "_route": "ocs.appstore.api.enableapp"
          }
        ]
      },
      {
        "file": "/srv/nextcloud/ocs/v1.php",
        "line": 88,
        "function": "match",
        "class": "OC\\Route\\Router",
        "type": "->",
        "args": [
          "/ocsapp/apps/appstore/api/v1/apps/enable"
        ]
      },
      {
        "file": "/srv/nextcloud/lib/OC.php",
        "line": 1397,
        "function": "{closure}",
        "args": [
          "*** sensitive parameters replaced ***"
        ]
      },
      {
        "file": "/srv/nextcloud/ocs/v1.php",
        "line": 35,
        "function": "handleRequests",
        "class": "OC",
        "type": "::",
        "args": [
          {
            "__class__": "Closure"
          }
        ]
      },
      {
        "file": "/srv/nextcloud/ocs/v2.php",
        "line": 10,
        "args": [
          "/srv/nextcloud/ocs/v1.php"
        ],
        "function": "require_once"
      }
    ],
    "File": "/srv/nextcloud/lib/private/Http/Client/DnsPinMiddleware.php",
    "Line": 151,
    "message": "could not enable app",
    "CustomMessage": "could not enable app"
  },
  "id": "6ab912e9242ff"
}

Additional info

It looks like there is a DNS pinning done, but why? I don't see the reason behind it, it's at best some pseudo-security, since TLS verification is enough... and at worst, it completely breaks the setup for users behind IPv6-only networks with DNS64.
I tried to use Nextcloud without NAT64/DNS64 and well, we all know that GitHub hasn't added IPv6 support yet, so running a gateway is necessary.

[86dd]

Looks like it is happening here:

server/lib/private/Http/Client/DnsPinMiddleware.php

Line 149 in fb36ade

if ($this->ipAddressClassifier->isLocalAddress($ip)) {

Maybe consider NAT64 ranges without RFC1918 to be public IPs?

server/lib/private/Net/IpAddressClassifier.php

Lines 83 to 98 in fb36ade

	if ($parsedIp instanceof IPv6) {
	// rfc8215 is a generic reservation for ipv6/ipv4 translation mechanisms,
	// no assumptions can be made about how ipv4 addresses are encoded within.
	//
	// Thus the only thing we can do is treat them all as local
	if ($this->rfc8215->contains($parsedIp)) {
	return true;
	}
	$ipv4 = $this->getMappedIpv4($parsedIp);
	if ($ipv4) {
	$ip = (string)$ipv4;
	} else {
	$ip = (string)$parsedIp;
	}
	} else {
	$ip = (string)$parsedIp;

server/lib/private/Net/IpAddressClassifier.php

Line 33 in fb36ade

private RangeInterface $rfc8215;

Hm, I'm not familiar with NC source code, but maybe some logic or check is failing/missing here

[86dd]

I guess one could use allow_local_remote_servers but IMHO it would be more elegant if we could find some ideas to fix this from the source, because enabling it is kindof a security risk.

[86dd]

Ref: nextcloud/documentation#11749