look out honey 'cause I'm using technology

HOWTO: disable IPv6 networking in Debian

is ready?

Tonight I did ran netstat (`netstat -plunt`) on my Debian server and saw that I had some listening via IPv6.  It’s a shame hasn’t caught on as it’s better than IPv4 in virtually every way, and it should, especially since TCP/IPv4 was standardized in ARPANET RFC’s… in 1981!  Also, provides network level via IPSec, which enables authentication of sender and encryption of communication path, to secure communications, all fun stuff, but while some point to the fact that the Beijing Olympics used exclusively as a point in how far it’s come, that’s hardly saying much when the protocol went Alpha… in 1996!  I mean I put things off and get distracted, sure, but come on!  So while its adoption can be argued to be a case of the chicken before the egg, since I’m not using anything , nor do I or my ISP even have the capability to use it, it’s silly and perhaps dangerous to leave it running with open .  So, if you’re not using it, it – it’s easy, just put on your pointy hat and follow along… First we need to edit:

/etc/modprobe.d/aliases

By default you will have a line like this:

alias net-pf-10

Replace that line with:

alias net-pf-10 off
alias  off

(The second line may/may not be required with newer (2.26.+) kernels, but it won’t hurt anything)

Also, while we’re at it, on your desktop machines, help out Firefox by disabling there too.  It’s simple, in the location bar enter:

about:config

Then search for:

network.dns.disableIPv6

and toggle its value to ‘true‘

Well, that’s it, you’re now surfing with 1980s technology (just like 99.098% of the internet!)



Related posts

This entry was posted on Tuesday, December 2nd, 2008 at 10:45 pm and is filed under geek, howto and tagged with , , , , , , , . You can follow any responses to this entry through the RSS 2.0 feed.

  • "It’s a shame IPv6 hasn’t caught on"

    And it won't if people follow your advice and disable it on their machines. We are finally starting to make some headway on getting IPv6 used.

    "nor do I or my ISP even have the capability to use it"

    IPv6 is available for you to use - via tunnel brokers.

    "It’s silly and perhaps dangerous to leave it running with open ports"

    How so? You don't have a routable IPv6 address, so there's not much of a threat (well, none from outside your local network. In theory it's possible someone on your subnet could attack you over your link-local address). Debian 4.1 supports statefull firewalling for IPv6.
  • miksuh
    I don't really understand why you think it's a problem and why you need to disable it. IPv6 support sure is not any security risk and it does not stop you from using IPv4. I think it's silly and unnesessary to disable it. And what if your ISP suddenly starts to use IPv6? By disabling the IPv5 support you are actually slowing the IPv6 adoption. As long as ISPs don't see people wanting to use IPv6 they don't have any reason to start using it soon, even if IPv5 address space is getting too small.
  • If you manage a server and want to lock it down, sure, it makes sense to close all ports. But why would you bother to do this, as a desktop user? IPV6 might come along one day :)
  • I appreciate all the comments on this post, but I didn't mean to sound harsh to IPv6, or insinuate that no one should use it. Note that I did state:

    "So, if you’re not using it, disable it"

    @Derek Morr
    Thanks for your comment - your site (http://www.personal.psu.edu/dvm105/blogs/ipv6/) told me a great deal about IPv6, and where it is, adoption wise. I am very interested in it, but currently I don't have any hardware, or an ISP that would support it. Are there general ISPs out there that do? I'm with Speakeasy, using static IPs on their home DSL for service, and have been very happy with them (this site is servered on that line, from my home servers). What are options for people like me to get started with IPv6? If not from my ISP, would a home network benifit from it? I'm running that Tomato Firmware on a Linksys router doing all the firewalling, how could I rebuild this with a Linux or OpenBSD box running over IPv6?

    @miksuh
    Yep, but understand I got into Linux because I could have complete control. If you do a base install of most OSs they leave all sorts of ports open, even some Linux ones leave open :25 (smtp) and others...this is why I install Debian from a netinst and only put down a base system. I only want things open that I need and use - disabling things I don't need is just part of "my fun" ;)

    @Alex Morega
    I completely agree, but again, if you're not using it...plus, if I was going to use it I'd do a fresh install (I do this anyway a few times of year when I want to redo my partitions, or I just want a fresh start with Debian!

    Again, thank you for the comments, and for the record, I *AM* very interested in using IPv6 - but if I can't get started at my house I'm not sure when I'll have the ability to. Please inform me! Thanks.
  • Neil
    I found this post very helpful. I'm an IPv6 fan as well but I needed to disable IPv6 Link Local on my Xen host (Dom0) so that it is not accessible by routing through a computer on my local network. This computer doesn't have an IPv4 address either (but the virtual machines do).
  • Anders
  • stephenryan
    The biggest problem with IPv6 is the crappy path to adoption. You will never get regular joe to put a tunnel broker in place.
    ISPs are also struggling with it too because you get yourself fully working, but then have a misconfigured foreign site that now doesn't work because it advertises IPv6 DNS entries but doesn't have the server on IPv6, or worse, IPv4 entries but both machines on either side have IPv6 properly enabled. Web browsing will work in most case but you get problems with certain types of TCP connections trying IPv6 first and failing as the bit in the middle, the internet, hasn't got IPv6 enabled.
    Running into this exact problem with downloads right now. Both networks have IPv6 running internally. One of the ISPs has IPv6 connectivity, the other doesn't.
  • Yep, and I didn't want to start a post with, "I don't want to start a flamewar, but what is the deal with you IPv6 folks?"

    While I haven't experienced the ins and outs as you have, I don't think I need to have something enabled that I'm not going to use...from a resources standpoint as well as security. This is what I get in Linux, full control to do things the way I want - if I had more time I suspect I'd look into v6, but until then...
  • MadDuck of Debian fame has a good introduction to enable a routing tunnel of IPv6 in Debian, see the link above.
    I have a Linksys with OpenWRT that is handling the firewall and tunneling for IPv6. I guess Tomatoe on the Linksys would work too. I had to set up the IPv6 tunnell and then start radvd to automaticly config all IPv6 enabled OS:es in the network (all modern OS:es has IPv6 support by default, MS Windows Vista and newer even "helps" you by setting up an tunnel for the network if it doesn't find a IPv6 network).
blog comments powered by Disqus

We like





We support


EFF - Electronic Frontier Foundation       TOR - The Onion Router       HRC - Human Rights Campaign