The bad practise would be to entirely disable IPv6. #ShittySysAdmin
this post was submitted on 24 Aug 2023
51 points (100.0% liked)
Linux
45501 readers
1564 users here now
From Wikipedia, the free encyclopedia
Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).
Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word "Linux" in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.
Rules
- Posts must be relevant to operating systems running the Linux kernel. GNU/Linux or otherwise.
- No misinformation
- No NSFW content
- No hate speech, bigotry, etc
Related Communities
Community icon by Alpár-Etele Méder, licensed under CC BY 3.0
founded 5 years ago
MODERATORS
Broke: disabling ipv6 because it's causing security holes with software not originally built for it
Woke: disabling ipv6 because hex ip strings are too hard to type
Honest to Tux, I've never memorized a single IPv6 since its public release; ever.
Well I memorized mine: ::1
The whole Silicon Valley, governments and economic infrastructure hangs by a thread made of bootleg shortcuts.
Haha, yeah that's what ProtonVPN support recommended to me and I am not sure if I want to disable IPv6 globally like that. I feel (with my inexperienced brain) that there's gotta be a way to do it on a per connection basis.
Maybe try forcing only IPv4 connections for the traffic you want to keep private?
Your biggest leak maybe IPv6 DNS which is probably not that big of a deal really...
I do the same, but would like to know the correct way to hide ipv6
In this case, disabling IPv6 is actually the right move. If the VPN provider doesn't support IPv6, then there's no way to allow to allow IPv6 Internet traffic without causing a leak/VPN bypass. If you block IPv6 via firewall or routing it to a dead-end, it will add delays as things try IPv6, timeout, and fall back to IPv4. If you just remove the IPv6 address from the Internet interface, you have to also make sure it doesn't get re-added by SLAAC/DHCPv6 or other interface changes (switching wifi networks, etc). As dumb as it seems, disabling IPv6 or switching to a provider that supports it are probably the best options.
In this case, disabling IPv6 is actually the right move. If the VPN provider doesn’t support IPv6, then there’s no way to allow to allow IPv6 Internet traffic without causing a leak/VPN bypass.
The right move for the VPN provider is to support IPv6. The right move for the user is to take their business to a provider that does.
Yes, I agree - using a VPN that supports IPv6 is preferred. If they don't want to/can't change providers, then disabling IPv6 is the best way to prevent IPv6 leaks without negatively affecting network performance.
IPv6 is broken by design /s.
IPv4 and IPv6 are two different network stacks. Your IPv4 stack is hidden behind wireguard, but not the IPv6 one.
The correct way to fix your issue is to setup a second witeguard tunnel for IPv6, and route IPv6 traffic through it.
Edit: many comments advise to block outbound IPv6 traffic. Don't do that! It will add latency to all your requests as you will have to wait for them to timeout.
Unfortunately I can't change the tunnel as it is provided by ProtonVPN.
If you disable IPv6 at the kernel level there's no extra latency as nothing even tries to connect to an IPv6 address. It's a shame to have to do it, but does fix the issue.
Disabling it is fine indeed, but I saw many comments advising to block outbound traffic, so I warned against that.
The true enterprise solution is to disable IPv6, if you disable IPv4 you might be surprised to see how many sites and services, even those run by large companies require IPv4.
Wireguard easily supports dual stack configuration on a single interface, but the VPN server must also have IPv6 enabled. I use AirVPN and I get both IPv6 and IPv4 with a single wireguard tunnel. In addition to the ::/0 route you also need a static IPv6 address for the wireguard interface. This address must be provided to you by ProtonVPN.
If that's not possible, the only solution is to entirely disable IPv6.
Yes, agree with you, especially your last comment: disable entirely IPv6
My ISP doesn't even support IPv6
My country doesn't really support IPv6.
Time to get a better ISP
Either fix IPv6 in the Wireguard tunnel or, if the tunnel isn't under your control, set up your firewall to drop all IPv6 traffic directed towards the wider internet. You could also gimp your normal network interface by disabling IPv6 on it if you always have the VPN on anyway.
Disabling IPv6 system wide will cause all kinds of fun and interesting random failures in tons of applications. You can drop all the routes you want, but I wouldn't remove the link local addresses or the ::1 address unless you like debugging failed assertions in your system logs.
Using networking namespaces may be an option https://gist.github.com/zenofile/d3ada8a1becb8c88aadffa68cdb18350
I just disable ipv6 on my router to simply my firewall and such.... Won't use it until necessary
This is a real backwards approach to this.
Why? I don't miss anything
You're missing a chance to help cool tech moving forward :)
I use a magisk module to disable ipv6
decreasing security for a... privacy(?) increase 🤔
We're not talking about privacy in that context here
We're trying to patch a leaking ipv6 which I gave my solution to.
Don't use it if you don't like it lmao
I suppose but my point was that rooting your device decreases security immensely via crippling the android security model.
That is true... but it's always about your threat model
Here, the ipv6 leaks are the priority