cross-posted from: https://lemmy.world/post/3754933

While experimenting with ProtonVPN’s Wireguard configs, I realized that my real IPv6 address was leaking while IPv4 was correctly going through the tunnel. How do I prevent this from happening?

I’ve already tried adding ::/0 to the AllowedIPs option and IPv6 is listed as disabled in the NetworkManager profile.

    • empireOfLove@lemmy.one
      link
      fedilink
      English
      arrow-up
      25
      ·
      edit-2
      1 year ago

      Broke: disabling ipv6 because it’s causing security holes with software not originally built for it

      Woke: disabling ipv6 because hex ip strings are too hard to type

    • 3laws@lemmy.world
      link
      fedilink
      arrow-up
      9
      ·
      edit-2
      1 year ago

      The whole Silicon Valley, governments and economic infrastructure of the world hang by a thread made of bootleg shortcuts.

    • Molecular0079@lemmy.worldOP
      link
      fedilink
      English
      arrow-up
      6
      ·
      1 year ago

      Haha, yeah that’s what ProtonVPN support recommended to me and I am not sure if I want to disable IPv6 globally like that. I feel (with my inexperienced brain) that there’s gotta be a way to do it on a per connection basis.

      • 30021190@lemmy.cloud.aboutcher.co.uk
        link
        fedilink
        arrow-up
        2
        ·
        1 year ago

        Maybe try forcing only IPv4 connections for the traffic you want to keep private?

        Your biggest leak maybe IPv6 DNS which is probably not that big of a deal really…

    • dack@lemmy.world
      link
      fedilink
      arrow-up
      3
      ·
      1 year ago

      In this case, disabling IPv6 is actually the right move. If the VPN provider doesn’t support IPv6, then there’s no way to allow to allow IPv6 Internet traffic without causing a leak/VPN bypass. If you block IPv6 via firewall or routing it to a dead-end, it will add delays as things try IPv6, timeout, and fall back to IPv4. If you just remove the IPv6 address from the Internet interface, you have to also make sure it doesn’t get re-added by SLAAC/DHCPv6 or other interface changes (switching wifi networks, etc). As dumb as it seems, disabling IPv6 or switching to a provider that supports it are probably the best options.

      • p1mrx@sh.itjust.works
        link
        fedilink
        arrow-up
        6
        ·
        edit-2
        1 year ago

        In this case, disabling IPv6 is actually the right move. If the VPN provider doesn’t support IPv6, then there’s no way to allow to allow IPv6 Internet traffic without causing a leak/VPN bypass.

        The right move for the VPN provider is to support IPv6. The right move for the user is to take their business to a provider that does.

        • dack@lemmy.world
          link
          fedilink
          arrow-up
          1
          ·
          1 year ago

          Yes, I agree - using a VPN that supports IPv6 is preferred. If they don’t want to/can’t change providers, then disabling IPv6 is the best way to prevent IPv6 leaks without negatively affecting network performance.

    • fuckwit_mcbumcrumble@lemmy.world
      link
      fedilink
      English
      arrow-up
      1
      ·
      1 year ago

      Unironically that’s one thing we do to anonymize traffic at work. We could do NAT via IPV6 but what’s the point when IPV4 already helps mask who is doing what in the office.