cross-posted from: https://lemmy.world/post/3754933

While experimenting with ProtonVPN’s Wireguard configs, I realized that my real IPv6 address was leaking while IPv4 was correctly going through the tunnel. How do I prevent this from happening?

I’ve already tried adding ::/0 to the AllowedIPs option and IPv6 is listed as disabled in the NetworkManager profile.

    • empireOfLove@lemmy.oneEnglish
      41·
      1 year ago

      Broke: disabling ipv6 because it’s causing security holes with software not originally built for it

      Woke: disabling ipv6 because hex ip strings are too hard to type

  • z3bra@lemmy.sdf.org
    4·
    1 year ago

    IPv4 and IPv6 are two different network stacks. Your IPv4 stack is hidden behind wireguard, but not the IPv6 one.

    The correct way to fix your issue is to setup a second witeguard tunnel for IPv6, and route IPv6 traffic through it.

    Edit: many comments advise to block outbound IPv6 traffic. Don’t do that! It will add latency to all your requests as you will have to wait for them to timeout.

    • notabot@lemm.ee
      2·
      1 year ago

      If you disable IPv6 at the kernel level there’s no extra latency as nothing even tries to connect to an IPv6 address. It’s a shame to have to do it, but does fix the issue.

      • z3bra@lemmy.sdf.org
        1·
        1 year ago

        Disabling it is fine indeed, but I saw many comments advising to block outbound traffic, so I warned against that.

  • Presi300@lemmy.worldEnglish
    2·
    1 year ago

    Just disable IPv6, if you don’t wanna, try a configuration tool like PiVPN, which can setup wireguard automatically

  • Skull giver@popplesburger.hilciferous.nl
    2·
    1 year ago

    Either fix IPv6 in the Wireguard tunnel or, if the tunnel isn’t under your control, set up your firewall to drop all IPv6 traffic directed towards the wider internet. You could also gimp your normal network interface by disabling IPv6 on it if you always have the VPN on anyway.

    Disabling IPv6 system wide will cause all kinds of fun and interesting random failures in tons of applications. You can drop all the routes you want, but I wouldn’t remove the link local addresses or the ::1 address unless you like debugging failed assertions in your system logs.

  • auth@lemmy.ml
    1·
    1 year ago

    I just disable ipv6 on my router to simply my firewall and such… Won’t use it until necessary

  • nothacking@discuss.tchncs.de
    1·
    1 year ago

    The true enterprise solution is to disable IPv6, if you disable IPv4 you might be surprised to see how many sites and services, even those run by large companies require IPv4.

  • dr_robot@kbin.social
    1·
    1 year ago

    Wireguard easily supports dual stack configuration on a single interface, but the VPN server must also have IPv6 enabled. I use AirVPN and I get both IPv6 and IPv4 with a single wireguard tunnel. In addition to the ::/0 route you also need a static IPv6 address for the wireguard interface. This address must be provided to you by ProtonVPN.

    If that’s not possible, the only solution is to entirely disable IPv6.

    • Syrup@lemmy.world
      22·
      1 year ago

      Yes, agree with you, especially your last comment: disable entirely IPv6

      • sounddrill@lemmy.antemeridiem.xyzEnglish
        1·
        1 year ago

        We’re not talking about privacy in that context here

        We’re trying to patch a leaking ipv6 which I gave my solution to.

        Don’t use it if you don’t like it lmao

        • zwekihoyy@lemmy.ml
          11·
          1 year ago

          I suppose but my point was that rooting your device decreases security immensely via crippling the android security model.