We had a couple different issues today. We’re in the process of moving from Consul to an internal service discovery system called Corrosion; the first place Corrosion is getting rolled out is DNS for our WireGuard gateways. Some of our gateways were very small, relative to the rest of our hosts, and Corrosion’s DNS server overwhelmed them; we’ve done a fleetwide upgrade of our gateways.
If you were seeing pretty much everything work, to the point where you were getting an fdaa:: address for the instance you were connecting to in your output, then what was probably happening is that you were getting a stale IPv6 address from Corrosion DNS.