this post was submitted on 05 Oct 2024
47 points (100.0% liked)

Linux

48652 readers
1025 users here now

From Wikipedia, the free encyclopedia

Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).

Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word "Linux" in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.

Rules

Related Communities

Community icon by Alpár-Etele Méder, licensed under CC BY 3.0

founded 5 years ago
MODERATORS
 

I was setting up my laptop for traveling and adding Wireguard VPN configuration.

The Wireguard config generated by router only contains IPv4 address (10.0.5.x), and while testing the VPN to my surprise "what is my ip" websites can find my IPv6 address (I USB tethered mobile connection to my laptop).

It looks like NetworkManager does nothing about IPv6 connection if VPN doesn't have IPv6 settings, which is bad for road warrior type of VPN configuration.

Is there an easy toggle to turn of IPv6 if VPN is connected and otherwise? Or is only option to disable all IPv6 no matter what?

you are viewing a single comment's thread
view the rest of the comments
[–] [email protected] 9 points 2 months ago (3 children)

Or you could just... learn to use the modern internet that 60% of internet traffic uses? Not everyone has a dedicated IPv4 anymore, we are in the days of mobile networks and CGNAT. IPv4 exhaustion is here today.

[–] [email protected] 2 points 2 months ago (1 children)

Idk why my comment was removed. I just said most internet traffic is chinese bots which are not sentient so they're okay with using IPv6 instead of IPv4 like people do.

IPv4 exhaustion is ofc a problem. But IPv6 discarding NAT is like throwing the baby out with the bathwater.

[–] [email protected] 1 points 2 months ago

Huh weird that it would be removed, that's a fair comment.

For Web scraping and other activities by so-called "legitimate" companies to varying degrees, this may be the case. But for general bots, they are generally attempting to scan and probe the entire IPv4 range, since it can be exhaustively checked in a reasonable amount of time and the majority of IPs have hosts on them. Enumerating the entire IPv6 space is quite literally impossible without some external list of hosts known to exist, due to the number of hosts. This happens, but it's a much higher hanging fruit for an attacker so far fewer will bother. So you generally see few to no continuous probes on things like sshd over IPv6 unless you have a domain name. I'm guessing a lot of bots (in botnets) are dumb old technology that doesn't even have IPv6.

NAT was always a hacky workaround. And although it effectively ends up functioning as a firewall under normal usage when combined with a typical "drop invalid incoming packets" rule, it was not designed to be a firewall and shouldn't be assumed to always function as one. A simple accept established, default drop firewall rule should do the trick and should be used on both v4 and v6 regardless of NAT (and probably is on your router already).

If your goal is privacy in the sense of blending in, you can still use NATv6 and this is a good use case for it. This is what VPNs like Mullvad use. If your goal is privacy in the sense of being more difficult to track across sessions, you can enable IPv6 privacy extensions which essentially generates a new IPv6 address for every connection your device makes. So in this sense it's more private than IPv4

[–] [email protected] 2 points 2 months ago (1 children)

Or you could just… learn to use the modern internet that 60% of internet traffic uses? Not everyone has a dedicated IPv4 anymore, we are in the days of mobile networks and CGNAT. IPv4 exhaustion is here today.

Where are you getting 60%? Google's IPv6 Adoption page has it under 50% still:

Screenshot of Google saying "IPv6 Adoption / We are continuously measuring the availability of IPv6 connectivity among Google users. The graph shows the percentage of users that access Google over IPv6." with a graph climbing from near 0% in 2008 to 45% in September 2024

(while other stats pages from big CDNs show even less)

[–] [email protected] 1 points 2 months ago (2 children)

Huh, I misremembered then. I stand corrected.

Notable though that there are specific countries (such as India) where adoption is far higher at 72%

[–] [email protected] 1 points 2 months ago

Dunno why my comment was removed but I remarked that it's either fed to them as scraps or it's in use by scammers and bots.