This is one in an occasional series of notes to future me, and possibly others who might find it useful.
Last week, for no apparent reason, I started getting “403 Forbidden” errors when using the TripIt API from my Linode system. I hadn’t made any changes to the code or the system; it just started happening. I was able to use the exact same code from my machines at home, so I suspected some sort of network issue.
Today, I tried to figure out what was going on. Creating a new Linode and running the code there didn’t help – I still got the errors.
I stumbled across a question on the Linode forums that was vaguely similar to my situation; it turned out that Google had blacklisted the Linode /64 network in Frankfurt (where the questioner’s Linode was located). The questioner could use the service if they forced the connection to go over IPv4, so I tried that.
Sure enough, I could get to the API if I forced the use of IPv4 (I tested with curl), but that wasn’t a real fix.
Linode had suggested that the questioner assign themself another /64 block and use that, but didn’t go into any detail about how to do that. Here’s how you do it (on Ubuntu 22.04).
Step 1: Use the Linode Cloud Manager to add a /64 block to my instance (click on the Linode name, click on “Network”, then “Add IP Address”)
Step 2: Reconfigure the network on the Linode to use the new block and NOT use the SLAAC auto-assigned address. This turned out to be difficult, because I couldn’t find an example. After far too much searching, I eventually found the proper documentation for the network manager configuration piece that I had to modify, etc/systemd/network/05-eth0.network.
I had to remove the IPv6AcceptRA=true line in the [Network] section, add an Address line for the address I’d chosen in my new /64 block, and add an [IPv6AcceptRA] section with a UseAutonomousPrefix=false line. The file now looks like this:
[Match]
Name=eth0
[Network]
DHCP=no
DNS=45.33.58.84 173.255.212.5 173.255.219.5
Domains=members.linode.com
IPv6PrivacyExtensions=false
Gateway=45.33.34.1
Address=45.33.34.52/24
# Force my own ipv6 address
Address=2600:3c01:e000:9c0::2/128
[IPv6AcceptRA]
UseAutonomousPrefix=false
I rebooted, and all is well; my SLAAC address is gone and the TripIt API works again!