For everyone stumbling across this issue:
There was no issue with the router (FritzBox) or server configuration, the problem was the client side, having an IPv4 internet access only.
While @Piezo’s server uses a Dual Stack Light internet access, it can only be reached by its IPv6 address. The router’s external IPv4 address is not reachable from the outside (because DS Lite/ NAT).
With the server only reachable via IPv6 it means that clients need to have an IPv6 internet access as well (“DS” or “DS Lite only” doesn’t matter on the client side; but there has to be one IPv6 address).
Unfortunately the VPN provider and the LTE provider used IPv4 addresses only and therefore the clients couldn’t connect to the server.
The test connection from my internet access and my LTE network (both with IPv6 addresses) and the SSL test of ssllabs.com/ssltest showed successful connections.
So in case someone has a similar issue, that the connection to his server doesn’t succeed although all configurations seem fine, check and do the following:
- check your internet access if it is using Dual Stack (DS ^1) or Dual Stack Lite (DS Lite ^2)
- in case of DS Lite make sure your clients use an Internet connection which assigns an IPv6 address (check for example with https://www.whatismyip.com/) in order to perform reliable tests
- if your mobile phone doesn’t get an IPv6 address in 3G/ 4G network, check the Internet if your provider put guides only how to enable IPv6 as well (APN settings)
- check your website with an external services which supports both IPv4 and IPv6; for example the ssl test mentioned above
- for internal IPv6 tests use the server’s fe80:: address
For the router you want to keep in mind and make sure the following:
- on your router you better configure: “Unique Local Address (ULA) - only assigned when there is no internet connection”
- at least with me there were connection issues with “always assign ULA”
With IPv6 “port forwarding” is different!
While with IPv4 you access the external IPv4 of the router with your client devices and the port forwarding directs you to the server behind that router.
With IPv6 you need to access the server’s IPv6 global scope address. The “port forwarding” configuration on the router only opens the router’s firewall to allow traffic over that port to the device/ server.
I hope this explains a little and helps.
^1 Dual Stack means you have both, a globally unique IPv6 and a globally unique IPv4 address. Your router is reachable via IPv4 and IPv6 address from the Internet.
^2 Dual Stack Lite means you get a shared external IPv4 address (NAT) and a gloablly unique IPv6 address. Your router is only reachable via the IPv6 address from the Internet. Pretty much the only reason why you get the IPv4 address is to be able to connect to services and websites which have IPv4 addresses only.