Canonical launchpad.net unreachable after uptade to 7.23.1 on RB5009UG

RouterOS General
1

Did something change in the firewall/NAT settings with 7.23.1 OS? I can no longer reach Ubuntu's Launchpad.net so can't add software via PPAs.

I have tried connecting directly to both my Verizon and Starlink modems and all works fine on both of these.

However, any PC connected through the RB5009 gets this error:

sudo add-apt-repository ppa:graphics-drivers/ppa
Place your finger on the fingerprint reader
Cannot add PPA: '"Failed to download the PPA: HTTPSConnectionPool(host='launchpad.net', port=443): Max retries exceeded with url: /api/1.0/~graphics-drivers/+archive/ppa (Caused by NewConnectionError('<urllib3.connection.HTTPSConnection object at 0x73a77f5653a0>: Failed to establish a new connection: [Errno 101] Network is unreachable'))."'.

Nothing else in the network has been changed only the OS updates for my Mikrotik devices.

I did find this reference but have never had to add these before so unless something changed in the firewall I shouldn't have to add them now.

Accessing Launchpad.net Behind a Firewall

To successfully reach launchpad.net while behind a firewall, specific configurations must be made to allow outbound traffic.

Required Firewall Settings

Ensure that your firewall allows outbound HTTPS traffic on port 443 to the following domains:

Domain Port Protocol
ppa.launchpad.net 443 HTTPS
ppa.launchpadcontent.net 443 HTTPS
2

Dear sir, I believe you're living too far in the future for us to answer. Latest stable version we know of is 7.23.1 :joy:

Jokes aside, it's probably Canonical's fault. Only thing you can do is play the waiting game. If nothing happens, reboot the router and try again

3

Or maybe you are just living too far in the past:

Screenshot at 2026-07-01 15-14-52
Screenshot at 2026-07-01 15-14-521920×1200 346 KB

4

7.23.1 has a nasty bug (feature) with unwanted IPv6 RA
try disabling ipv6->nd->all

5

Why would it be Canonical's fault when I can reach it just fine from either modem which are before the RB5009?

6

Unfortunately that didn't help.

7

My remote viewing abilities would also point to ipv6. So ping -4, curl -4. Also, if the error is "network unreachable", a traceroute can't hurt.

8

Don't know what curl -4 is/means. Here's the rest:

ping
ping1920×1200 259 KB

Traceroute
Traceroute1920×1200 273 KB

9

This shows broken routing on Canonical's part. They'll probably fix it eventually.

10

looks like problem is in AF (address family)
if you put PC direct on Starlink, and it is working
but not with updated MT device ...

you need to troubleshoot first from PC

nslookup launchpad.net
Server:         192.168.200.1
Address:        192.168.200.1#53

Non-authoritative answer:
Name:   launchpad.net
Address: 185.125.189.222
Name:   launchpad.net
Address: 185.125.189.223
Name:   launchpad.net
Address: 2620:2d:4000:1009::3ba
Name:   launchpad.net
Address: 2620:2d:4000:1009::f3

as you see, there is IPv4 / IPv6 address associated to launchpad.net
start tracerouting from PC, or when you do apt update you will see if your PC are using old (v4) or new (v6) addresses

now, with that info, you put back MT and start to scratch your head :slight_smile:

11

Looks pretty much the same to me, just an extra line for RB5009 and then strange delay between if-bundle... and 66.198.29.175 when the RB5009 is inline. Below order, first two straight on Starlink, second two behind RB5009.

BTW apt-get works fine behind the RB5009 it's only the PPA adding that has the issue.

myx1@ThinkPadX1:~$ nslookup launchpad.net
Server: 127.0.0.53
Address: 127.0.0.53#53

Non-authoritative answer:
Name: launchpad.net
Address: 185.125.189.222
Name: launchpad.net
Address: 185.125.189.223
Name: launchpad.net
Address: 2620:2d:4000:1009::f3
Name: launchpad.net
Address: 2620:2d:4000:1009::3ba

myx1@ThinkPadX1:~$ traceroute lauchpad.net
traceroute to lauchpad.net (45.55.47.107), 30 hops max, 60 byte packets
1 * _gateway (192.168.1.1) 4.250 ms 4.460 ms
2 100.64.0.1 (100.64.0.1) 18.612 ms 18.548 ms 26.391 ms
3 172.16.252.74 (172.16.252.74) 25.976 ms 30.032 ms 30.015 ms
4 * * *
5 undefined.hostname.localhost (206.224.64.211) 29.938 ms undefined.hostname.localhost (206.224.64.225) 29.919 ms 149.19.109.96 (149.19.109.96) 29.895 ms
6 ae19.cr8-dal3.ip4.gtt.net (65.175.1.41) 30.007 ms dls-b7-link.ip.twelve99.net (62.115.147.32) 29.660 ms 29.591 ms
7 89.221.40.214 (89.221.40.214) 34.013 ms 23.353 ms ix-bundle-3.qcore2.dt8-dallas.as6453.net (64.86.132.238) 31.351 ms
8 * 195.22.206.28 (195.22.206.28) 58.381 ms 58.360 ms
9 * * if-bundle-63-2.qcore2.ct8-chicago.as6453.net (66.198.29.34) 51.243 ms
10 if-bundle-2-2.qcore1.ct8-chicago.as6453.net (66.110.15.36) 51.078 ms 51.058 ms *
11 * * 66.198.29.185 (66.198.29.185) 42.770 ms
12 * * *
13 * * *
14 504gatewaytimeout.dev (45.55.47.107) 60.003 ms 67.337 ms *
myx1@ThinkPadX1:~$ nslookup launchpad.net
Server: 127.0.0.53
Address: 127.0.0.53#53

Non-authoritative answer:
Name: launchpad.net
Address: 185.125.189.223
Name: launchpad.net
Address: 185.125.189.222
Name: launchpad.net
Address: 2620:2d:4000:1009::3ba
Name: launchpad.net
Address: 2620:2d:4000:1009::f3

myx1@ThinkPadX1:~$ traceroute lauchpad.net
traceroute to lauchpad.net (45.55.47.107), 30 hops max, 60 byte packets
1 _gateway (192.168.101.1) 1.917 ms 1.832 ms 1.815 ms
2 192.168.1.1 (192.168.1.1) 3.908 ms 3.890 ms 2.597 ms
3 100.64.0.1 (100.64.0.1) 35.613 ms 51.448 ms 51.430 ms
4 172.16.252.74 (172.16.252.74) 51.416 ms 51.400 ms 51.385 ms
5 * * *
6 undefined.hostname.localhost (206.224.64.223) 51.320 ms 40.870 ms undefined.hostname.localhost (206.224.64.225) 30.038 ms
7 ae19.cr8-dal3.ip4.gtt.net (65.175.1.41) 24.834 ms * 24.898 ms
8 * 89.221.40.214 (89.221.40.214) 24.849 ms *
9 if-bundle-2-2.qcore1.dt8-dallas.as6453.net (66.110.56.8) 46.325 ms * 195.22.206.28 (195.22.206.28) 72.787 ms
10 * * *
11 * * *
12 * 66.198.29.175 (66.198.29.175) 47.658 ms 66.198.29.185 (66.198.29.185) 53.165 ms
13 * * *
14 * * *
15 504gatewaytimeout.dev (45.55.47.107) 67.909 ms * *

12

tcpdump shows it's the IPv6 that's failing behind the RB5009:

18:59:03.292477 IP6 _gateway > ThinkPadX1: ICMP6, destination unreachable, unreachable route launchpad-net.ps5-frontend-1.canonical.com, length 88

Don't get this error message on the tcpdump when connecting directly to the Starlink modem.

13

You can force ipv4 only in the meantime.

echo 'Acquire::ForceIPv4 "true";' | sudo tee /etc/apt/apt.conf.d/99force-ipv4

See if that works.

14

as i said before, it will be AF (address family) problem ...
your PC will work without problem because dhcpv6 client on linux need to take care only for him self, so PC will req IPv6 address, get one (slaac/stateful) from modem ... and will be happy with that

but .. MT need to grab ia_na or ia_pd from upstream and redistribute this v6 to downstream clients

this way, it will be hard to troubleshoot IPv6 changes on MT

18

@mtbdrew

Edit your post and fix the version your on.

19

image
image1920×1200 442 KB

20

Look, I'm not trying to be difficult but what the heck are you talking about? The attached picture clearly shows my SW level as does Winbox that it was taken from:

What's new in 7.23.1 (2026-Jun-02 12:25):

Why do you keep saying there is no such software?

21

Ah, no.

Click the pencil on all your posts and change the version

22

I'm sorry, but why would I change it from what my RB5009 clearly states is installed? What am I missing here?

What's new in 7.23.1 (2026-Jun-02 12:25): ---- This is cut and past directly from Winbox connected to my RB5009. Are you saying my RB5009 is miss identifying what software is actually installed?

23

Change your posts and topic with the correct version.

Canonical launchpad.net unreachable after uptade to 7.32.1 on RB5009UG

Did something change in the firewall/NAT settings with 7.32.1 OS? I can no longer reach Ubuntu's Launchpad.net so can't add software via PPAs.