Ipv6 bad routing? Turris can't directly access upstream DNS server via ipv6 but windows can when connected the same way

This concerns use of Turris Omnia router with Australia’s largest telco’s (Telstra’s) 5G home internet modem.

I have a Turris Omnia freshly reconfigured from latest medkit. Versions are later in this post.

The upstream modem reports via DHCP its own local DNS server addresses 192.168.0.1 and 2001:8004:1de1:b36b::1 which when using Windows directly with the upstream modem works just fine, and both ipv4 and ipv6 address are pingable from Windows.

But when Turris Omnia is connected, the following is seen where the ipv6 address is not pingable on the directly-connected device even though ipv6-only dns ipv6.google.com is pingable.

It looks like there’s some kind of routing problem happening with ipv6 traffic on Turris, that does not happen on Windows networked the same way.

I’m not terribly familiar with ipv6 routing but could the nexthop in the below be part of the problem, quoting from the detail under the “Turris interface status” heading further below:

                {
                        "target": "2001:8004:1de1:b36b::",
                        "mask": 64,
                        "nexthop": "::",
                        "metric": 256,
                        "source": "::/0"
                },

Foris reports that both ipv4 and ipv6 are operational.

I don’t know how to fix this, does anybody know how?

root@turris:~# cat /tmp/resolv.conf
search lan
nameserver 127.0.0.1
nameserver ::1
root@turris:~# cat /tmp/resolv.conf.d/resolv.conf.auto
# Interface wan
nameserver 192.168.0.1
search gateway
# Interface wan6
nameserver 2001:8004:1de1:b36b::1

From turris, pinging ipv4 works but ipv6 fails

root@turris:~# ping -c 1 192.168.0.1
PING 192.168.0.1 (192.168.0.1) 56(84) bytes of data.
64 bytes from 192.168.0.1: icmp_seq=1 ttl=64 time=0.886 ms

--- 192.168.0.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.886/0.886/0.886/0.000 ms
root@turris:~# ping -c 1 2001:8004:1de1:b36b::1
PING 2001:8004:1de1:b36b::1(2001:8004:1de1:b36b::1) 56 data bytes

--- 2001:8004:1de1:b36b::1 ping statistics ---
1 packets transmitted, 0 received, 100% packet loss, time 0ms

Pinging google’s ipv6 address clearly works:

root@turris:~# ping -c 1 ipv6.google.com
PING ipv6.google.com(syd09s31-in-x0e.1e100.net (2404:6800:4006:809::200e)) 56 data bytes
64 bytes from syd09s31-in-x0e.1e100.net (2404:6800:4006:809::200e): icmp_seq=1 ttl=113 time=28.5 ms

--- ipv6.google.com ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 28.514/28.514/28.514/0.000 ms

As a result, nslookup from turris only works on ipv4

root@turris:~# nslookup www.google.com 192.168.0.1
Server:         192.168.0.1
Address:        192.168.0.1#53

Name:      www.google.com
Address 1: 142.250.66.228
Address 2: 2404:6800:4006:810::2004
root@turris:~# nslookup www.google.com 2001:8004:1de1:b36b::1
;; connection timed out; no servers could be reached

Here’s windows directly connected to upstream modem/router:

C:\Users\dcampbel>ping -n 1 192.168.0.1

Pinging 192.168.0.1 with 32 bytes of data:
Reply from 192.168.0.1: bytes=32 time=1ms TTL=64

Ping statistics for 192.168.0.1:
    Packets: Sent = 1, Received = 1, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 1ms, Maximum = 1ms, Average = 1ms
C:\Users\dcampbel>ping -n 1 2001:8004:1de1:b36b::1

Pinging 2001:8004:1de1:b36b::1 with 32 bytes of data:
Reply from 2001:8004:1de1:b36b::1: time=3ms

Ping statistics for 2001:8004:1de1:b36b::1:
    Packets: Sent = 1, Received = 1, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 3ms, Maximum = 3ms, Average = 3ms

Windows routing details

C:\Users\dcampbel>route print
===========================================================================
Interface List
 31...a4 4c c8 50 77 67 ......Intel(R) Ethernet Connection (4) I219-LM
  6...34 f6 4b 93 b6 f5 ......Microsoft Wi-Fi Direct Virtual Adapter #3
 15...36 f6 4b 93 b6 f4 ......Microsoft Wi-Fi Direct Virtual Adapter #4
 26...34 f6 4b 93 b6 f4 ......Intel(R) Dual Band Wireless-AC 8265
 34...34 f6 4b 93 b6 f8 ......Bluetooth Device (Personal Area Network) #4
  1...........................Software Loopback Interface 1
===========================================================================

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0      192.168.0.1    192.168.0.247     35
        127.0.0.0        255.0.0.0         On-link         127.0.0.1    331
        127.0.0.1  255.255.255.255         On-link         127.0.0.1    331
  127.255.255.255  255.255.255.255         On-link         127.0.0.1    331
      192.168.0.0    255.255.255.0         On-link     192.168.0.247    291
    192.168.0.247  255.255.255.255         On-link     192.168.0.247    291
    192.168.0.255  255.255.255.255         On-link     192.168.0.247    291
        224.0.0.0        240.0.0.0         On-link         127.0.0.1    331
        224.0.0.0        240.0.0.0         On-link     192.168.0.247    291
  255.255.255.255  255.255.255.255         On-link         127.0.0.1    331
  255.255.255.255  255.255.255.255         On-link     192.168.0.247    291
===========================================================================
Persistent Routes:
  None

IPv6 Route Table
===========================================================================
Active Routes:
 If Metric Network Destination      Gateway
 26    291 ::/0                     fe80::ca99:b2ff:fefa:edba
  1    331 ::1/128                  On-link
 26    291 2001:8004:1de1:b36b::/64 On-link
 26    291 2001:8004:1de1:b36b:80c:2959:f73d:299/128
                                    On-link
 26    291 2001:8004:1de1:b36b:38a0:8174:9e49:d56c/128
                                    On-link
 26    291 fe80::/64                On-link
 26    291 fe80::9848:cb93:4ce0:4c61/128
                                    On-link
  1    331 ff00::/8                 On-link
 26    291 ff00::/8                 On-link
===========================================================================
Persistent Routes:
  None

Turris interface config

root@turris:~# ifconfig
br-lan    Link encap:Ethernet  HWaddr D8:58:D7:00:42:C3
          inet addr:192.168.16.1  Bcast:192.168.16.255  Mask:255.255.255.0
          inet6 addr: fe80::da58:d7ff:fe00:42c3/64 Scope:Link
          inet6 addr: fda9:de1a:2d90::1/60 Scope:Global
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:1164929 errors:0 dropped:80 overruns:0 frame:0
          TX packets:2365214 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:179752519 (171.4 MiB)  TX bytes:3532845277 (3.2 GiB)

eth1      Link encap:Ethernet  HWaddr D8:58:D7:00:42:C3
          inet6 addr: fe80::da58:d7ff:fe00:42c3/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1508  Metric:1
          RX packets:6862 errors:0 dropped:0 overruns:0 frame:0
          TX packets:74100 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1024
          RX bytes:894864 (873.8 KiB)  TX bytes:11993451 (11.4 MiB)
          Interrupt:47

eth2      Link encap:Ethernet  HWaddr D8:58:D7:00:42:C4
          inet addr:192.168.0.117  Bcast:192.168.0.255  Mask:255.255.255.0
          inet6 addr: 2001:8004:1de1:b36b:da58:d7ff:fe00:42c4/64 Scope:Global
          inet6 addr: 2001:8004:1de1:b36b::480/128 Scope:Global
          inet6 addr: fe80::da58:d7ff:fe00:42c4/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:3004658 errors:0 dropped:0 overruns:0 frame:0
          TX packets:1053164 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1024
          RX bytes:3558278145 (3.3 GiB)  TX bytes:182398709 (173.9 MiB)
          Interrupt:48

lan0      Link encap:Ethernet  HWaddr D8:58:D7:00:42:C3
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:6862 errors:0 dropped:0 overruns:0 frame:0
          TX packets:74092 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:743900 (726.4 KiB)  TX bytes:11399819 (10.8 MiB)

lan1      Link encap:Ethernet  HWaddr D8:58:D7:00:42:C3
          UP BROADCAST MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

lan2      Link encap:Ethernet  HWaddr D8:58:D7:00:42:C3
          UP BROADCAST MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

lan3      Link encap:Ethernet  HWaddr D8:58:D7:00:42:C3
          UP BROADCAST MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

lan4      Link encap:Ethernet  HWaddr D8:58:D7:00:42:C3
          UP BROADCAST MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:588245 errors:0 dropped:0 overruns:0 frame:0
          TX packets:588245 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:222430087 (212.1 MiB)  TX bytes:222430087 (212.1 MiB)

wlan0     Link encap:Ethernet  HWaddr 00:0A:52:07:39:4A
          inet6 addr: fe80::20a:52ff:fe07:394a/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:1143637 errors:0 dropped:0 overruns:0 frame:0
          TX packets:2982718 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:172996630 (164.9 MiB)  TX bytes:3326150125 (3.0 GiB)

wlan1     Link encap:Ethernet  HWaddr 04:F0:21:23:2F:F8
          inet6 addr: fe80::6f0:21ff:fe23:2ff8/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:25568 errors:0 dropped:0 overruns:0 frame:0
          TX packets:93098 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:5489950 (5.2 MiB)  TX bytes:51021883 (48.6 MiB)

Turris interface status

root@turris:~# ifstatus wan
{
        "up": true,
        "pending": false,
        "available": true,
        "autostart": true,
        "dynamic": false,
        "uptime": 13268,
        "l3_device": "eth2",
        "proto": "dhcp",
        "device": "eth2",
        "metric": 0,
        "dns_metric": 0,
        "delegation": true,
        "ipv4-address": [
                {
                        "address": "192.168.0.117",
                        "mask": 24
                }
        ],
        "ipv6-address": [

        ],
        "ipv6-prefix": [

        ],
        "ipv6-prefix-assignment": [

        ],
        "route": [
                {
                        "target": "0.0.0.0",
                        "mask": 0,
                        "nexthop": "192.168.0.1",
                        "source": "192.168.0.117/32"
                }
        ],
        "dns-server": [
                "192.168.0.1"
        ],
        "dns-search": [
                "gateway"
        ],
        "neighbors": [

        ],
        "inactive": {
                "ipv4-address": [

                ],
                "ipv6-address": [

                ],
                "route": [

                ],
                "dns-server": [

                ],
                "dns-search": [

                ],
                "neighbors": [

                ]
        },
        "data": {
                "hostname": "turris",
                "leasetime": 1800
        }
}
root@turris:~# ifstatus wan6
{
        "up": true,
        "pending": false,
        "available": true,
        "autostart": true,
        "dynamic": false,
        "uptime": 13268,
        "l3_device": "eth2",
        "proto": "dhcpv6",
        "device": "eth2",
        "metric": 0,
        "dns_metric": 0,
        "delegation": true,
        "ipv4-address": [

        ],
        "ipv6-address": [
                {
                        "address": "2001:8004:1de1:b36b::480",
                        "mask": 128,
                        "preferred": 1144,
                        "valid": 1144
                },
                {
                        "address": "2001:8004:1de1:b36b:da58:d7ff:fe00:42c4",
                        "mask": 64
                }
        ],
        "ipv6-prefix": [

        ],
        "ipv6-prefix-assignment": [

        ],
        "route": [
                {
                        "target": "2001:8004:1de1:b36b::",
                        "mask": 64,
                        "nexthop": "::",
                        "metric": 256,
                        "source": "::/0"
                },
                {
                        "target": "::",
                        "mask": 0,
                        "nexthop": "fe80::ca99:b2ff:fefa:edba",
                        "metric": 512,
                        "valid": 1769,
                        "source": "2001:8004:1de1:b36b:da58:d7ff:fe00:42c4/64"
                },
                {
                        "target": "::",
                        "mask": 0,
                        "nexthop": "fe80::ca99:b2ff:fefa:edba",
                        "metric": 512,
                        "valid": 1769,
                        "source": "2001:8004:1de1:b36b::480/128"
                }
        ],
        "dns-server": [
                "2001:8004:1de1:b36b::1"
        ],
        "dns-search": [

        ],
        "neighbors": [

        ],
        "inactive": {
                "ipv4-address": [

                ],
                "ipv6-address": [

                ],
                "route": [

                ],
                "dns-server": [

                ],
                "dns-search": [

                ],
                "neighbors": [

                ]
        },
        "data": {
                "passthru": "00170010200180041de1b36b0000000000000001"
        }
}

Turris routing details

root@turris:~# route -A inet
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         192.168.0.1     0.0.0.0         UG    0      0        0 eth2
192.168.0.0     *               255.255.255.0   U     0      0        0 eth2
192.168.16.0    *               255.255.255.0   U     0      0        0 br-lan
root@turris:~# route -A inet6
Kernel IPv6 routing table
Destination                                 Next Hop                                Flags Metric Ref    Use Iface
::/0                                        fe80::ca99:b2ff:fefa:edba               UG    512    1        0 eth2
::/0                                        fe80::ca99:b2ff:fefa:edba               UG    512    3        0 eth2
2001:8004:1de1:b36b::/64                    ::                                      U     256    1        0 eth2
2001:8004:1de1:b36b::/64                    ::                                      !n    2147483647 1        0 lo
fda9:de1a:2d90::/64                         ::                                      U     1024   3        0 br-lan
fda9:de1a:2d90::/48                         ::                                      !n    2147483647 2        0 lo
fe80::/64                                   ::                                      U     256    1        0 eth1
fe80::/64                                   ::                                      U     256    3        0 br-lan
fe80::/64                                   ::                                      U     256    3        0 eth2
fe80::/64                                   ::                                      U     256    1        0 wlan1
fe80::/64                                   ::                                      U     256    1        0 wlan0
::/0                                        ::                                      !n    -1     2        0 lo
::1/128                                     ::                                      Un    0      5        0 lo
2001:8004:1de1:b36b::/128                   ::                                      Un    0      3        0 eth2
2001:8004:1de1:b36b::480/128                ::                                      Un    0      4        0 eth2
2001:8004:1de1:b36b:da58:d7ff:fe00:42c4/128 ::                                      Un    0      3        0 eth2
fda9:de1a:2d90::/128                        ::                                      Un    0      3        0 br-lan
fda9:de1a:2d90::1/128                       ::                                      Un    0      5        0 br-lan
fe80::/128                                  ::                                      Un    0      6        0 eth1
fe80::/128                                  ::                                      Un    0      3        0 br-lan
fe80::/128                                  ::                                      Un    0      3        0 eth2
fe80::/128                                  ::                                      Un    0      3        0 wlan1
fe80::/128                                  ::                                      Un    0      3        0 wlan0
fe80::20a:52ff:fe07:394a/128                ::                                      Un    0      2        0 wlan0
fe80::6f0:21ff:fe23:2ff8/128                ::                                      Un    0      2        0 wlan1
fe80::da58:d7ff:fe00:42c3/128               ::                                      Un    0      3        0 eth1
fe80::da58:d7ff:fe00:42c3/128               ::                                      Un    0      4        0 br-lan
fe80::da58:d7ff:fe00:42c4/128               ::                                      Un    0      3        0 eth2
ff00::/8                                    ::                                      U     256    3        0 eth1
ff00::/8                                    ::                                      U     256    3        0 br-lan
ff00::/8                                    ::                                      U     256    3        0 eth2
ff00::/8                                    ::                                      U     256    1        0 wlan1
ff00::/8                                    ::                                      U     256    1        0 wlan0
::/0                                        ::                                      !n    -1     2        0 lo

Turris /etc/config/networks

root@turris:~# cat /etc/config/network

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 'fda9:de1a:2d90::/48'

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'lan0'
        list ports 'lan1'
        list ports 'lan2'
        list ports 'lan3'
        list ports 'lan4'

config interface 'lan'
        option device 'br-lan'
        option proto 'static'
        option ipaddr '192.168.16.1'
        option netmask '255.255.255.0'
        option ip6assign '60'

config interface 'wan'
        option device 'eth2'
        option proto 'dhcp'
        option ipv6 '1'

config interface 'wan6'
        option device '@wan'
        option proto 'dhcpv6'

config device 'dev_wan'
        option name 'eth2'
Device Turris Omnia
reForis version 1.4.1
Turris OS version 6.4.4
Turris OS branch HBS
Kernel version 5.15.135

Thank you for a very detailed report. I don’t see any reason why the mentioned DNS server address does not respond to ping. It is an address that is part of directly attached network segment, so there is not much routing involved, just sending the data directly to your upstream router.

Anyway, no matter whether your modem DNS resolver is or is not reachable over IPv6, this does not have any significant impact on anything. You can easily keep talking to DNS only over IPv4 or even ignore ISP-provided DNS servers completely.

The biggest issue you have is that your upstream 5G modem and/or the network that it is connected to does not support DHCPv6 Prefix delegation, so you are stuck with single /64 that is only used between your 5G modem and your router. Therefore, there is no IPv6 for the downstream interfaces behind your router.

I disabled DNS forwarding on the Turris Omnia due to this problem because DNS resolution was only working intermittently with this upstream modem and this issue. Is that the best approach? Since disabling DNS forwarding, at least the router is operable.

I actually prefer DNS without forwarding. At least unless you want it over TLS for privacy reasons, but that wasn’t the default anyway. (TLS forwarding only moves the privacy risks from the ISP to your chosen provider, too.)

Ondrej,

You wrote:

The biggest issue you have is that your upstream 5G modem and/or the network that it is connected to does not support DHCPv6 Prefix delegation, so you are stuck with single /64 that is only used between your 5G modem and your router.

I find that:

  1. A windows PC directly connected to the upstream 5G modem can ping 2001:8004:1de1:b36b::1 from the command line
  2. Turris directly connected to the upstream 5G modem cannot ping 2001:8004:1de1:b36b::1 from the router’s ssh command line

Is that related to DHCPV6 prefix delegation, or something else? Any ideas of how I can diagnose this?

I did a tcpdump on the router itself… there seems to be an ICMP neighbour solicitation and advertisement in relation to the address… ping still doesn’t succeed…

root@turris:~# ifconfig eth2
eth2 Link encap:Ethernet HWaddr D8:58:D7:00:42:C4
inet addr:192.168.0.117 Bcast:192.168.0.255 Mask:255.255.255.0
inet6 addr: 2001:8004:1de1:b36b:da58:d7ff:fe00:42c4/64 Scope:Global
inet6 addr: 2001:8004:1de1:b36b::480/128 Scope:Global
inet6 addr: fe80::da58:d7ff:fe00:42c4/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:176525647 errors:0 dropped:0 overruns:0 frame:0
TX packets:122306864 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1024
RX bytes:130375423450 (121.4 GiB) TX bytes:148492010615 (138.2 GiB)
Interrupt:48

This is either
a) a config issue (even FritzBox needs some help to do it properly)
b) a violation of RFC 3769: PD is mandatory, not an option.

If you are fluent in German you might like this Intro to IPv6 an Prefix Delegation:
https://www.schweinekraftland.de/Home_Network_access_IPv6/Home_Network_IPv6_v2_HTML/IPv6-verbinden_und_ergaenzende_Erlaeuterungen.html

I wish it was all that simple. First, PD support for 3GPP-based network appeared only in Release-10 and is not implemented by the vast majority of 3GPP network operators - if you have IPv6 on your phone, try to enable tethering and see whether you receive a PD from it. Second, nothing in RFC 3769 says that PD is mandatory - the RFC itself is informational after all. But even if it said so, this will not make PD magically happen.

Do you have any ideas why when a Windows PC replaces the Turris router in the connection to the upstream modem, there is no routing issue seen, and everything works normally including the IPV6 pings. Windows can, Turris can’t for some reason. I don’t understand how that can be. Doesn’t that imply that PD is implemented in the modem?

all mobile networks in Germany offer IPv6 and PD.
Your modem needs to be configured. Some may have issues.
As shown here Folie 68 the “PDP” settings need adjustment.
So yes, all (German) Mobile Provider do provide IPv6 and PD.
To reach someone on the PD address (termination on the Mobile) often fails: Carrier grade NAT and similar f*ups ruin the IPv6 connection. In principle it works (I often tried successful). In Germany best results are with DTAG/D1/Telekom. For plenty of money they offer a “fixed IPv6” on the mobile that can be reached (terminated on) all time. So yes, Mobile should work like any Internet device.

Turris refusing to ping an address that I can always ssh to was a problem, too. Sometimes it worked for a few minites after reboot of Turris Omnia. A complete new setup from scratch eventually resolved this issue. Not understood, afraid it might come back ping stops working.

You’ve suggested that the modem needs some configuration, but given that windows directly connected to the modem works fine with the device, no problem with pings whatsoever, doesn’t that lean towards indicating that there’s a problem in the Turris instead?

Can’t you have mwan3 package installed? I just tested it yesterday and the config installed by default by this package completely broke ipv6 on all outgoing interfaces. Try /etc/init.d/mwan3 stop

I don’t have mwan installed

This topic was automatically closed after 60 days. New replies are no longer allowed.