Postgres connection access denied on IPv6 address

Question

Installed PostgreSQL 9.1 x64 on Windows, set up a listen address, but when connecting with pgAdmin I get the following error. Not sure why PostgreSQL is seeing my IPv6 address and not my regular IP address:

To get authentication working, based on the error message, I updated pg_hba.conf with this:

host all all fe80::c5d2:XXXX:XXXX:3bc0/12 trust

That worked, but it's ugly, and too specific. I tried the following based on PostgreSQL docs, but none worked, I get the same 'access denied' error:

local all all trust
host all all 0.0.0.0/12 trust

I got this one working, which covers the entire IPv6 address space, but how can I specify an IPv6 range for more restriction?

host  mydb  myuser  ::/0   trust

Questions

• Why does pgAdmin pick up my IPv6 address and not my normal IP?
• How do I specify a range in IPv6 without resorting to ::/0?

Answer 1

The IPv6 addresses starting with fe80: are link-local addresses. They cannot be routed across different subnets or the internet. They are for communication between machines connected to the same LAN only. The link-local range is defined as fe80::/10. If you trust everybody on your local LAN then you could do

host  all  all  fe80::/10  trust

If you don't trust everybody on your local LAN then you probably want to use username+password protection:

host  all  all  fe80::/10  md5

When specifying md5 you are still using username+password protection, but the password is not transmitted in a readable format anymore. Since you're not trusting people on your local LAN you probably shouldn't send a snoopable password over the wire either.

Answer 2

IPv6 is used because you are connecting to localhost. localhost resolves to both 127.0.0.1 and ::1.

Because operating systems prefer IPv6 over IPv4, that is the reason why IPv6 is used (although on Linux, this can be configured through /etc/gai.conf). The address ::1 is never used as a source address, and you don’t have a global address (2000::/3), which leaves the link-local address (fe80::/10) as the source address.

All perfectly logical, normal, expected behaviour when you think about it.

Answer 3

I am not quite sure why pgAdmin has the behavior it does. My recommendation there would be to ask on their support lists and get info on the design of that tool and whether this is a bug or a feature. It may have also to do with Windows name resolution. As a workaround you should be able to specify connecting over the ipv4 address or to 127.0.0.1.

As for the pg_hba.conf question, ipv4 and ipv6 get the different spaces in the file so it doesn't surprise me that you would have to add this.

One option you have, now that you can connect, is to set a password (ALTER USER "username" WITH PASSWORD 'password'). You can then set your entire ipv6 space to md5 in the pg_hba.conf and not have to worry so much. Also if you are on a windows domain, you can use LDAP, SSPI, or Kerberos 5 authentication and thus allow access only to domain members. This is somewhat an advanced topic though.