cross-posted from: https://lemmy.world/post/3754933

While experimenting with ProtonVPN’s Wireguard configs, I realized that my real IPv6 address was leaking while IPv4 was correctly going through the tunnel. How do I prevent this from happening?

I’ve already tried adding ::/0 to the AllowedIPs option and IPv6 is listed as disabled in the NetworkManager profile.

  • 30021190
    link
    fedilink
    339 months ago

    The bad practise would be to entirely disable IPv6. #ShittySysAdmin

    • @[email protected]
      link
      fedilink
      English
      24
      edit-2
      9 months ago

      Broke: disabling ipv6 because it’s causing security holes with software not originally built for it

      Woke: disabling ipv6 because hex ip strings are too hard to type

      • @3laws
        link
        11
        edit-2
        9 months ago

        Honest to Tux, I’ve never memorized a single IPv6 since its public release; ever.

    • @3laws
      link
      9
      edit-2
      9 months ago

      The whole Silicon Valley, governments and economic infrastructure of the world hang by a thread made of bootleg shortcuts.

    • @Molecular0079OP
      link
      English
      69 months ago

      Haha, yeah that’s what ProtonVPN support recommended to me and I am not sure if I want to disable IPv6 globally like that. I feel (with my inexperienced brain) that there’s gotta be a way to do it on a per connection basis.

      • 30021190
        link
        fedilink
        29 months ago

        Maybe try forcing only IPv4 connections for the traffic you want to keep private?

        Your biggest leak maybe IPv6 DNS which is probably not that big of a deal really…

    • @dack
      link
      19 months ago

      In this case, disabling IPv6 is actually the right move. If the VPN provider doesn’t support IPv6, then there’s no way to allow to allow IPv6 Internet traffic without causing a leak/VPN bypass. If you block IPv6 via firewall or routing it to a dead-end, it will add delays as things try IPv6, timeout, and fall back to IPv4. If you just remove the IPv6 address from the Internet interface, you have to also make sure it doesn’t get re-added by SLAAC/DHCPv6 or other interface changes (switching wifi networks, etc). As dumb as it seems, disabling IPv6 or switching to a provider that supports it are probably the best options.

      • @[email protected]
        link
        fedilink
        6
        edit-2
        9 months ago

        In this case, disabling IPv6 is actually the right move. If the VPN provider doesn’t support IPv6, then there’s no way to allow to allow IPv6 Internet traffic without causing a leak/VPN bypass.

        The right move for the VPN provider is to support IPv6. The right move for the user is to take their business to a provider that does.

        • @dack
          link
          19 months ago

          Yes, I agree - using a VPN that supports IPv6 is preferred. If they don’t want to/can’t change providers, then disabling IPv6 is the best way to prevent IPv6 leaks without negatively affecting network performance.

    • @fuckwit_mcbumcrumble
      link
      English
      -19 months ago

      Unironically that’s one thing we do to anonymize traffic at work. We could do NAT via IPV6 but what’s the point when IPV4 already helps mask who is doing what in the office.

  • z3bra
    link
    fedilink
    26
    edit-2
    9 months ago

    IPv4 and IPv6 are two different network stacks. Your IPv4 stack is hidden behind wireguard, but not the IPv6 one.

    The correct way to fix your issue is to setup a second witeguard tunnel for IPv6, and route IPv6 traffic through it.

    Edit: many comments advise to block outbound IPv6 traffic. Don’t do that! It will add latency to all your requests as you will have to wait for them to timeout.

    • @Molecular0079OP
      link
      English
      19 months ago

      Unfortunately I can’t change the tunnel as it is provided by ProtonVPN.

    • @[email protected]
      link
      fedilink
      19 months ago

      If you disable IPv6 at the kernel level there’s no extra latency as nothing even tries to connect to an IPv6 address. It’s a shame to have to do it, but does fix the issue.

      • z3bra
        link
        fedilink
        19 months ago

        Disabling it is fine indeed, but I saw many comments advising to block outbound traffic, so I warned against that.

    • @[email protected]
      link
      fedilink
      19 months ago

      For me, it was rather the opposite: when dropping IPv6 packets, applications would often hang and behave weirdly. Disabling IPv6 completely would mean they’d stop trying to do anything on IPv6 and function well.

  • @[email protected]
    link
    fedilink
    79 months ago

    The true enterprise solution is to disable IPv6, if you disable IPv4 you might be surprised to see how many sites and services, even those run by large companies require IPv4.

  • dr_robot
    link
    fedilink
    69 months ago

    Wireguard easily supports dual stack configuration on a single interface, but the VPN server must also have IPv6 enabled. I use AirVPN and I get both IPv6 and IPv4 with a single wireguard tunnel. In addition to the ::/0 route you also need a static IPv6 address for the wireguard interface. This address must be provided to you by ProtonVPN.

    If that’s not possible, the only solution is to entirely disable IPv6.

    • @Syrup
      link
      -19 months ago

      Yes, agree with you, especially your last comment: disable entirely IPv6

  • @wmassingham
    link
    29 months ago

    You can either route IPv6 through the tunnel, or if the tunnel doesn’t support it, you have to block it somehow if you don’t want it going out to the Internet. You can do that by creating a firewall rule to block it on your host or network, or by disabling IPv6 entirely at the host or network level.

    • @Molecular0079OP
      link
      English
      19 months ago

      You can either route IPv6 through the tunnel

      That’s what I am trying to do with the ::/0 option but it doesn’t seem to work. I am guessing because the tunnel itself doesn’t have IPv6?

      • Max-P
        link
        fedilink
        19 months ago

        Add a dummy IPv6 on the WireGuard interface, like a completely random fd00::/128 address on it so it thinks it’s IPv6 enabled. It’ll then just go nowhere as the remote end won’t accept it. You can then drop it at the firewall level before it goes into the tunnel to save some bandwidth.

        • @Molecular0079OP
          link
          English
          3
          edit-2
          9 months ago

          Thanks for the suggestion! It gave me the idea to try setting the connection profile’s IPv6 setting to either Link Local or Ignored. Both those options, along with the ::/0 in AllowedIPs, seem to work according to ipleak.net, but I am unsure what the bigger ramifications of this change are.

          • Max-P
            link
            fedilink
            39 months ago

            It’s going to still send that IPv6 traffic through the tunnel and get discarded at the other end but that’s about it. You can firewall that off if you want, ideally with a reject rule so things don’t have to timeout before realizing it goes nowhere.

  • Presi300
    link
    English
    29 months ago

    Just disable IPv6, if you don’t wanna, try a configuration tool like PiVPN, which can setup wireguard automatically

  • auth
    link
    fedilink
    29 months ago

    I just disable ipv6 on my router to simply my firewall and such… Won’t use it until necessary

      • @[email protected]
        link
        fedilink
        English
        19 months ago

        We’re not talking about privacy in that context here

        We’re trying to patch a leaking ipv6 which I gave my solution to.

        Don’t use it if you don’t like it lmao

        • @[email protected]
          link
          fedilink
          19 months ago

          I suppose but my point was that rooting your device decreases security immensely via crippling the android security model.

          • @[email protected]
            link
            fedilink
            English
            29 months ago

            That is true… but it’s always about your threat model

            Here, the ipv6 leaks are the priority