How to get rid of IPv6 - once and for ever....?

**suse_rasputin** · 29-Jun-2019, 06:04

It's regarding both Leap 15.1 and TW. I'm a little out of humor on this issue, as it is a year-long, uphill fight against opensuse and its constant and repeated attempts to enable ipv6 on its distributions. Earlier they simply switched in NetworkManager the ipv6 setting from "ignored" to something else, now they simply ignore it. I have disabled ipv6 in Yast, in wicked (although not used) as well as in NetworkManager. To no avail. With ip addr I see the eth0 interface still has (again) an ipv6 address. I don't want it. I can disable it for the current session via

Code:

sysctl -w net.ipv6.conf.all.disable_ipv6=1 sysctl -w net.ipv6.conf.default.disable_ipv6=1

but after the next reboot the same ipv6 stuff is back. Can I delete something once and for ever? Can I disable ipv6 in the kernel on boot (reliably)? Please. There must be solution to get rid of this pest. IPv6 is uncontrollable via router/firewall, as nobody knows which and how many address a single machine has (including the router/firewall). I don't want this security issues on my network.

**hcvv** · 29-Jun-2019, 06:11

I have IPv6 running for years already on my systems. It is the way the world goes.Isn't this like cutting yourself off from the ineternet more and more? To me it looks like an up-hill battle.

**suse_rasputin** · 29-Jun-2019, 06:39

Hi Henk! No, everything here running just fine. Even if my ISP would switch to ipv6 Iwould go with ipv4 in the LAN. Again: ipv6 is a security nightmare. Uncontrollable. Insecure and side-channel by design. Can anybody enlighten my, where to turn it off? Pretty, pretty please? :-)

**nrickert** · 29-Jun-2019, 06:55

I see a line in "/etc/sysctl.conf"

Code:

# net.ipv6.conf.all.disable_ipv6 = 1

As far as I know, if you uncomment that, and then regenerate the "initrd" (run "mkinitrd"), that should do what you want.

However, I agree with Henk -- ipv6 is the future. Unfortunately, my ISP does not currently provide it.

**mike_g** · 29-Jun-2019, 07:03

Originally Posted by suse_rasputin

There must be solution to get rid of this pest.

Yes, in the BIOS under Network.

**suse_rasputin** · 29-Jun-2019, 07:27

Hy !

My /etc/sysctl.conf looks like:

Code:

  cat /etc/sysctl.conf                                               
####
#
# To disable or override a distribution provided file just place a
# file with the same name in /etc/sysctl.d/
#
# See sysctl.conf(5), sysctl.d(5) and sysctl(8) for more information
#
####

I used this file to disable ipv6 on the debian machine (Dell Precision M6400 with ATI m7740, not playing nice with opensuse anymore) by including

Code:

 net.ipv6.conf.all.disable_ipv6 = 1  
net.ipv6.conf.default.disable_ipv6 = 1  
net.ipv6.conf.lo.disable_ipv6 = 1

But as this file is so... empty... in TW I though it might be not in use for any kind of configuration.

BIOS is not an option, as my BIOS (all old machines here) don't have such options. I would not trust is anyway, after I saw Win10 ignoring BIOS-disabled HDDs and simply accessed them anyway... ;-)

**suse_rasputin** · 29-Jun-2019, 08:08

In Yast -> Boot Loader I added under "Kernel Parameters" -> "Optional Kernel Command Line Parameter"

Code:

 ipv6.disable=1

https://itsfoss.com/disable-ipv6-ubuntu-linux/

After reboot the machine cam back without IPv6 address.For now. Most likely the next TW update will kill that, too?

**Sauerland** · 29-Jun-2019, 08:40

Originally Posted by suse_rasputin

In Yast -> Boot Loader I added under "Kernel Parameters" -> "Optional Kernel Command Line Parameter"

Code:

 ipv6.disable=1

https://itsfoss.com/disable-ipv6-ubuntu-linux/

After reboot the machine cam back without IPv6 address.For now. Most likely the next TW update will kill that, too?

Here is the old forums thread:
https://forums.opensuse.org/showthre...pensuse-11-2-a

**karlmistelberger** · 29-Jun-2019, 09:52

Originally Posted by suse_rasputin

It's regarding both Leap 15.1 and TW. I'm a little out of humor on this issue, as it is a year-long, uphill fight against opensuse and its constant and repeated attempts to enable ipv6 on its distributions. Earlier they simply switched in NetworkManager the ipv6 setting from "ignored" to something else, now they simply ignore it. I have disabled ipv6 in Yast, in wicked (although not used) as well as in NetworkManager. To no avail. With ip addr I see the eth0 interface still has (again) an ipv6 address. I don't want it. I can disable it for the current session via

Code:

sysctl -w net.ipv6.conf.all.disable_ipv6=1 sysctl -w net.ipv6.conf.default.disable_ipv6=1

but after the next reboot the same ipv6 stuff is back. Can I delete something once and for ever? Can I disable ipv6 in the kernel on boot (reliably)? Please. There must be solution to get rid of this pest. IPv6 is uncontrollable via router/firewall, as nobody knows which and how many address a single machine has (including the router/firewall). I don't want this security issues on my network.

You may want to suppress ipv6 on a link basis only: https://en.opensuse.org/Systemd-networkd#Disabling_IPv6

Actually I observed a large delay upon connecting. This resulted from the router being unable to support ipv6. Thus the network tried to connect again until timeout. When suppressing ipv6 on the link it would not probe for ipv6.

**mike_g** · 29-Jun-2019, 11:30

Originally Posted by Sauerland

Here is the old forums thread:
https://forums.opensuse.org/showthre...pensuse-11-2-a

https://itsfoss.com/disable-ipv6-ubuntu-linux/

An update never removes the iommu=soft parameter.

Inet6 is gone in Kubuntu 19.10 with the given link method (foss). Splash screen remains normal if set that way (see grub below) and the router is not affected. Should work the same for TW in Yast.

Code:

ip a

 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000

 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
 inet 127.0.0.1/8 scope host lo

 valid_lft forever preferred_lft forever
 2: enp2s0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc fq_codel state DOWN group default qlen 1000
 link/ether xx xx xx xx xx xx brd ff:ff:ff:ff:ff:ff

 3: wlp3s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
 link/ether xx xx xx xx xx xxbrd ff:ff:ff:ff:ff:ff
 inet xx /24 brd xx.255 scope global dynamic noprefixroute wlp3s0
 valid_lft 7198sec preferred_lft 7198sec

Code:

etc/default/grub

 GRUB_DEFAULT=0
 GRUB_TIMEOUT=7
 GRUB_DISTRIBUTOR=`lsb_release -i -s 2> /dev/null || echo Debian`
 GRUB_CMDLINE_LINUX_DEFAULT="ipv6.disable=1 quiet splash"
 GRUB_CMDLINE_LINUX="ipv6.disable=1 iommu=soft"

Code:

uname -a

 Linux xx 5.2.0-050200rc6-generic #201906222033 SMP Sun Jun 23 00:36:46 UTC 2019 x86_64 x86_64 x86_64 GNU/Linux

 mokutil --sb-state

 SecureBoot enabled

Tor browser needs an extra tweak to kill V6 >about:config>IPV6>First entry must be set to false = will be removed>Restart Tor.

Fallback IPV6 is negative = fail + IPV6 test is mark not reachable.

https://ipleak.net/

Note FF 67.0.4 and Chrome 77.0.3833.0 don't need to be tweaked. The result is negative.