VPN and IPv6

[kylerickards]

Hi

I was looking through the forum and I don't think this exact question has been asked so here I go. (I'm not up to anything nefarious by the way).

So I have had a VPN for years but suddenly a check on whatismyIP is bringing up my "real" location under the IPv6 part (but not IPv4). I have done cat /proc/sys/net/ipv6/conf/all/disable_ipv6 and got '1' back which I think means everything is working as it should.

I have looked at screenshots from the VPN provider whose Mint Network Manager looks different than mine in that their IPv6 seems to have a simple on/off toggle which mine doesn't. To further confuse me, I ran some DNSleak tests and they are all coming back as clear and everything is running as it should. I have cleared all caches and even installed a totally new browser.

Is there anything I am missing?

EDIT: Out of curiosity I jumped back into Windows and everything works as it should - so there's something I am not seeing about the IPv6 settings in Mint? I even tried a website based in the States which refuses point blank to work under Mint and sailed straight through under Windows... This is very odd...

[kylerickards]

Just thinking - is there a way of changing my Network-Manager? I don't think it is that but I might be able to work out the problem more easily?

EDIT: I have found a way of doing it at the GRUB level that seems to work but I am not sure I have edited the config correctly - would someone be able to check I have done it the right way if possible? I have noticed that after closing down and restarting now, I always have to restore my browser tabs so I think this is something to do with it?

Code: Select all

# If you change this file, run 'update-grub' afterwards to update
# /boot/grub/grub.cfg.
# For full documentation of the options in this file, see:
#   info -f grub -n 'Simple configuration'

GRUB_DEFAULT=0
#GRUB_TIMEOUT_STYLE=hidden
GRUB_TIMEOUT=10
GRUB_DISTRIBUTOR=`lsb_release -i -s 2> /dev/null || echo Debian`
GRUB_CMDLINE_LINUX_DEFAULT="quiet splash threadirqs" 
GRUB_CMDLINE_LINUX=""
GRUB_CMDLINE_LINUX="ipv6.disable=1"
GRUB_CMDLINE_LINUX_DEFAULT="ipv6.disable=1"

# Uncomment to enable BadRAM filtering, modify to suit your needs
# This works with Linux (no patch required) and with any kernel that obtains
# the memory map information from GRUB (GNU Mach, kernel of FreeBSD ...)
#GRUB_BADRAM="0x01234567,0xfefefefe,0x89abcdef,0xefefefef"

# Uncomment to disable graphical terminal (grub-pc only)
#GRUB_TERMINAL=console

# The resolution used on graphical terminal
# note that you can use only modes which your graphic card supports via VBE
# you can see them in real GRUB with the command `vbeinfo'
#GRUB_GFXMODE=640x480

# Uncomment if you don't want GRUB to pass "root=UUID=xxx" parameter to Linux
#GRUB_DISABLE_LINUX_UUID=true

# Uncomment to disable generation of recovery mode menu entries
#GRUB_DISABLE_RECOVERY="true"

# Uncomment to get a beep at grub start
#GRUB_INIT_TUNE="480 440 1"

[Slash_Earth]

sudo sysctl -w net.ipv6.conf.all.disable_ipv6=1 &&
sudo sysctl -w net.ipv6.conf.default.disable_ipv6=1 &&
ip a

Is what I used in the past.

[Moonstone Man]

EDIT: Out of curiosity I jumped back into Windows and everything works as it should - so there's something I am not seeing about the IPv6 settings in Mint?

Possibly not. You should check with your VPN provider to find out if IPv6 is required at all. Unless the provider is very, very new to the scene, they will have a stack of IPv4 addresses and will be using those. I would be surprised if IPv6 was absolutely required because most of the internet isn't ready for it, consequently the wise thing to do is disable it.

With IPv6, you should be using random MAC addresses because your real MAC address forms part of your IPv6 address.

In addition, there are some things you can do to prevent DNS leaks. Let me know if you need advice on that.

[kylerickards]

sudo sysctl -w net.ipv6.conf.all.disable_ipv6=1 &&
sudo sysctl -w net.ipv6.conf.default.disable_ipv6=1 &&
ip a

Is what I used in the past.

You absolute legend! Thank you!

[kylerickards]

EDIT: Out of curiosity I jumped back into Windows and everything works as it should - so there's something I am not seeing about the IPv6 settings in Mint?

Possibly not. You should check with your VPN provider to find out if IPv6 is required at all. Unless the provider is very, very new to the scene, they will have a stack of IPv4 addresses and will be using those. I would be surprised if IPv6 was absolutely required because most of the internet isn't ready for it, consequently the wise thing to do is disable it.

With IPv6, you should be using random MAC addresses because your real MAC address forms part of your IPv6 address.

In addition, there are some things you can do to prevent DNS leaks. Let me know if you need advice on that.

Thank you - it was more a case of switching the VPN on and then when running tests, IPv4 was hidden but IPv6 was showing as my real location for some reason. I have one wired connection so I could not work out why any way of disabling IPv6 did not work. Every instruction I found on the net for Ubuntu/Mint did not work either - apart from the one above! If there's any other things I can check to ensure there are absolutely no DNS leaks, I would be happy to try those also. Thank you.

[Moonstone Man]

If there's any other things I can check to ensure there are absolutely no DNS leaks, I would be happy to try those also. Thank you.

The first place to start is your router. Set its DNS addresses to something you trust, such as cloudflare 1.1.1.1 and 1.0.0.1. If there's going to be a leak, it will be here.

Run firefox ESR and stubby, also purge the existing firefox: viewtopic.php?f=42&t=344198

Use Network Manager and import .ovpn files instead of using a VPN provider's Linux client.

Enforce .ovpn DNS by adding these lines to your .ovpn before importing them:

Code: Select all

dhcp-option DNS 127.0.0.1
script-security 2
up /etc/openvpn/update-resolv-conf
down /etc/openvpn/update-resolv-conf

In the above code, DNS 127.0.0.1 assumes you've installed stubby locally. It's all described in the tutorial I've linked to above.

Happy private browsing.

[kylerickards]

Thank you - I really appreciate the help! Why do they make things so hard!

[Moonstone Man]

Thank you - I really appreciate the help! Why do they make things so hard!

Things aren't so hard that a little bit of thought into what might be appropriate google search terms won't fix.

That's not a slight, it's a fact. The only problem is that you have to do a lot of reading, analysing and discounting of the many vapid responses from all and sundry tyre-kickers who don't what they're talking about. Here, most of us have already done that for you. In addition, keeping copious notes about each and every installation is highly beneficial. I have 560MB+ of notes on tap from installs going back years. Even though I can install and fully configure my systems while blindfolded, I still document every step. I keep a record of the source of the information, what problem it intends to fix and any modifications made to the notes for whatever reason, so I always know why, when, how and what for. Because of that, you will never see a request from me for anyone's help. I can just go over my notes to work out what went wrong, why it went wrong, and note how to rectify it. That's a very good habit that you might take up.

[kylerickards]

I didn't take it as a slight and I do appreciate the help. I did search and search and I only found the GRUB solution in once place. It just completely threw me as everyone else seemed to be typing a few commands and it worked and I just couldn't understand how they were doing it.

I do tend to screen shot as much as I can and I don't think I ask the same question twice? I don't think I do - but I admit I don't keep or retain the amount of data that you do - and I know I should.

[Moonstone Man]

I do tend to screen shot as much as I can and I don't think I ask the same question twice? I don't think I do - but I admit I don't keep or retain the amount of data that you do - and I know I should.

My view is that keeping such notes, and typing them out, sets them into one's memory more firmly, consequently I think it's the easiest path into learning far more about Linux than would be otherwise possible.

Anyway, all the best.

[kylerickards]

sudo sysctl -w net.ipv6.conf.all.disable_ipv6=1 &&
sudo sysctl -w net.ipv6.conf.default.disable_ipv6=1 &&
ip a

Is what I used in the past.

Interestingly within 24 hours, this has stopped working.

[Moonstone Man]

sudo sysctl -w net.ipv6.conf.all.disable_ipv6=1 &&
sudo sysctl -w net.ipv6.conf.default.disable_ipv6=1 &&
ip a

Is what I used in the past.

Interestingly within 24 hours, this has stopped working.

You can always disable it at the kernel level. Edit /etc/default/grub and add ipv6.disable=1 after quiet splash, then do sudo update-grub and reboot.

[kylerickards]

sudo sysctl -w net.ipv6.conf.all.disable_ipv6=1 &&
sudo sysctl -w net.ipv6.conf.default.disable_ipv6=1 &&
ip a

Is what I used in the past.

Interestingly within 24 hours, this has stopped working.

You can always disable it at the kernel level. Edit /etc/default/grub and add ipv6.disable=1 after quiet splash, then do sudo update-grub and reboot.

Thank you for getting back so quickly - that has worked straight off. What would have caused it to revert back?

[Moonstone Man]

Thank you for getting back so quickly - that has worked straight off. What would have caused it to revert back?

An update, more likely.

[kylerickards]

Ah ok - thanks for this, I genuinely, really appreciate the help. (And the solution is in my notebook now!)