I was setting up my laptop for traveling and adding Wireguard VPN configuration.

The Wireguard config generated by router only contains IPv4 address (10.0.5.x), and while testing the VPN to my surprise “what is my ip” websites can find my IPv6 address (I USB tethered mobile connection to my laptop).

It looks like NetworkManager does nothing about IPv6 connection if VPN doesn’t have IPv6 settings, which is bad for road warrior type of VPN configuration.

Is there an easy toggle to turn of IPv6 if VPN is connected and otherwise? Or is only option to disable all IPv6 no matter what?

  • Supermariofan67@programming.dev
    2·
    3 hours ago

    Best to set a firewall rule with nftables to block non-vpn traffic from leaving (you should also do the save for IPv4 traffic to prevent leaks in case the tunnel disconnects)

  • axzxc1236@lemm.eeOP
    2·
    7 hours ago

    I tried the same setup with Ubuntu 24.04.1 desktop live system and I can replicate this IP leak issue, I guess I will have to disable IPv6.

  • LainTrain@lemmy.dbzer0.com
    23·
    5 hours ago

    I’d also like to know, is there a way to just turn off this ipv6 trashfire? Preferably in a universal, cross-distro way?

    Seems like the most universal way is: GRUB_CMDLINE_LINUX_DEFAULT=“ipv6.disable=1 quiet splash”

    • axzxc1236@lemm.eeOP
      2·
      5 hours ago

      In my case just disable IPv6 in WiFi is enough.

      sysctl looks like the most universal way.

      net.ipv6.conf.all.disable_ipv6 = 1 net.ipv6.conf.default.disable_ipv6 = 1

    • Supermariofan67@programming.dev
      11·
      3 hours ago

      Or you could just… learn to use the modern internet that 60% of internet traffic uses? Not everyone has a dedicated IPv4 anymore, we are in the days of mobile networks and CGNAT. IPv4 exhaustion is here today.

      • LainTrain@lemmy.dbzer0.com
        2·
        3 hours ago

        Yikes. By most internet traffic you mean Chinese bots yeah?

        Yeah I’ll stay behind my one NAT instead of six godzillion firewalls thanks.