Let's Encrypt almost never blocks IPs directly, and if they did the message you'd get wouldn't be "connection timeout". It's probably some misconfiguration on your system. We sometimes see systems that think that 172.65.x.x is "internal" (since it's near the 172.16.x.x-172.31.x.x block) even though it's a normal public IP. That's for IPv4; your "network unreachable" message probably means that your IPv6 isn't set up right either. Fixing either one would probably allow you to reach Let's Encrypt, though fixing both would be ideal.
If you run a traceroute of some sort to acme-v02.api.letsencrypt.org, you'll probably find it stop working somewhere really near your system, rather then on Let's Encrypt's end.
It might also be worthwhile to compare connecting to (via curl & traceroute and such) the staging environment server acme-staging-v02.api.letsencrypt.org.
(Though I'm always hesitant to prescribe a test when I'm not sure what one would do with that information one way or the other.)
Not sure how to proceed with this. Looks like my ISP is have trouble reaching 172.65.32.248 ( acme-v02.api.letsencrypt.org ) but has no problem with acme-staging-v02.api.letsencrypt.org (172.65.46.172).
But than again, using a Ubuntuserver with public ip in the same range as the webserver works fine.
Have now been in contact with my ISP and they confirm that traffic from my end passes through thier nodes without problem. The problem occours later on in the chain but me nor them can se where.
A 404 response is indeed invalid with regard to the ACME challenge, but the fact the ACME validation server actually got a 404 file not found (which is expected), means that it was successful in setting up a HTTP connection with the 62.181.75.252 IP address.
(Same for the staging environment by the way, above was on the production environment.)
There are other free ACME CAs out there, see e.g. ACME CA Comparison - Posh-ACME for a comparison. Personally not a fan of ZeroSSL and EAB makes it more difficult to use, but BuyPass, a CA from Norway, is a non-nonsense CA with certs with a longer lifetime.
There are several other Certificate Authorities that offer free certificates. BuyPass Go (--server https://api.buypass.com/acme/directory) and ZeroSSL (--server https://acme.zerossl.com/v2/DV90) are probably the easiest for trying things out. (Posh-ACME and AcmeClients.com from the author of Certify the Web offer some comparison charts.)
Tanks for your efforts to help me, much appreciated!
I have also been in contact with Cloudflare and got following response:
"172.65.32.248 is part of our anycast ranges, and the traceroute is expected. Can you please detail more on what is the issue client has when trying to reach acme-v02.api.letsencrypt.org?
Additional information, this is what the return path looks like.
Not getting any wiser. All should be working according isp, cloudflare and destination server.
I am running PLESK on this server and Lets Encrypt has a very neat plugin that issues free certificates on the fly from the gui. Sadly there are no alternative that offers the same service.