Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

The ISP I work at is setting up an internal IPv6 network in preparation for eventually connecting to the IPv6 internet. As a result, several of the servers in this network now try to connect to security.debian.org via its IPv6 address by default when running apt-get update, and that results in having to wait for a lengthy timeout whenever I'm downloading updates of any sort.

Is there a way to tell apt to either prefer IPv4 or ignore IPv6 altogether?

share|improve this question
Shouldn't that return immediately with a routing failure? – pjc50 Mar 23 '11 at 11:46
No, it's entirely possible that their internal network has routing between multiple subnets (and hosts have an IPv6 default gateway) but no IPv6 connectivity to the outside world. – Andrew Medico Mar 23 '11 at 13:51
There's probably a way to set up /etc/gai.conf so that security.debian.org's A record are returned before the AAA record, but I don't know precisely what to put in that file. – Gilles Mar 24 '11 at 0:10
@AndrewMedico - but shouldn't their network's default gateways know that there isn't external ipV6 connectivity and reject the outbound attempt at the edge pretty quickly? I think there's a network issue here as well as the question being asked. – Michael Kohne Nov 12 '13 at 13:21
Fixing the edge router/firewall/whatever is causing the problem is the "best" way to handle this. It should be returning an ICMP destination unreachable packet. This is either not happening, or something is blocking it. Either way, the problem should be reported to your network people. – Michael Hampton Apr 9 '14 at 22:25
up vote 85 down vote accepted

Add -o Acquire::ForceIPv4=true when running apt-get.

If you want to make the setting persistent just create /etc/apt/apt.conf.d/99force-ipv4 and put Acquire::ForceIPv4 "true"; in it.

Config options Acquire::ForceIPv4 and Acquire::ForceIPv6 were added to version (see bug 611891) which is available since Ubuntu Saucy (released in October 2013) and Debian Jessie (released in April 2015).

share|improve this answer
Moving the "accepted" to this one; while the original 30-point answer is perfectly correct, it's applicable on a much broader scale while this provides the option to just restrict apt-get. – Shadur Nov 12 '13 at 18:21
Please be properly descriptive in your answer. -o Acquire::ForceIPv4=true is the addition to the command to allow a user to use ipv4 – Kendrick May 23 '14 at 1:42
Answer updated following Kendrick's suggestion – mmoya May 23 '14 at 8:02
I just tried: it also works in wheezy. – mirabilos Dec 13 '14 at 14:59
Judging from the rest of my apt.conf you need to write it like this: Acquire::ForceIPv4 "true"; (with double quotes) – mirabilos Dec 13 '14 at 15:09

As Gilles says, use gai.conf

Say we have two hosts www.he.net and www.ripe.net

$ host www.he.net
www.he.net is an alias for he.net.
he.net has address
he.net has IPv6 address 2001:470:0:76::2

$ host www.ripe.net
www.ripe.net has address
www.ripe.net has IPv6 address 2001:67c:2e8:22::c100:68b

Case 1: Prefer IPV4

Append the following to /etc/gai.conf

precedence ::ffff:0:0/96  100

then we have:

$ telnet www.ripe.net 81
$ telnet www.he.net 81

Case 2: Prefer IPV6 for specific hosts

If we append

precedence 2001:470::/32 100

then we have

$ telnet www.ripe.net 81
$ telnet www.he.net 81
Trying 2001:470:0:76::2...

So we seem to prefer that network for ipv6 and ipv4 everywhere else.

Case 3: Prefer ipv4 for specific hosts

Wondering if we invert the mask the reverse will be true?


According to @GrueMaster this is true.

precedence 2001:470::/96 100

Worked for him. To get it working, security.ubuntu.com ipv6 needed to be disabled. It was stalling forever.

See also:

share|improve this answer
Perhaps summarize content in case the above links disappear? – Faheem Mitha May 16 '11 at 15:04
So, what's the syntax to disable IPv6 for a particular name, or at least for a particular address (range)? If you add that to your post, it'll be the best answer here. – Gilles May 16 '11 at 16:16
Thanks, this worked. – Shadur May 17 '11 at 17:41
Thanks. I added 2 lines #security.debian.org has IPv6 address 2610:148:1f10:3::73 \n #security.debian.org has IPv6 address 2001:4f8:8:36::6 \n precedence 2001:4f8::/96 100 \n precedence 2610:148::/96 100 to my /etc/gai.conf and apt-get update works perfect now. – don bright Jun 1 '15 at 0:49

You could setup apt-cacher-ng on a spare machine to act as a proxy/cache for all of your hosts. You can force the configuration to only use specific hosts or use the /etc/hosts trick suggested by @badp on that one machine.

apt-get install apt-cacher-ng

Once you have apt-cache-ng setup you just need to drop the following line (with IP address/hostname altered to point at your cacher machine) in /etc/apt/apt.conf.d/90httpproxy

Acquire::http { Proxy "http://[]:3142"; };

I use that setup to reduce bandwidth usage but it should workaround your problem. Unfortunately I'm not aware of a way to directly disable ipv6 lookups for apt-get itself.

share|improve this answer
Still not a perfect solution, but as good as it's likely going to get. Thanks. – Shadur Mar 24 '11 at 10:49

You could work around this by setting up a DNS proxy server that dropped ip6 responses.

share|improve this answer
Won't your local resolver still try to get the AAAA record? And time out? – Mikel May 15 '12 at 14:32

How about adding a line in /etc/hosts overriding the relevant addresses? e.g.,  ftp.debian.org   security.debian.org 
share|improve this answer
I'll save this solution for last if there turns out to be absolutely no other way; I really don't like cluttering /etc/hosts with IP addresses I don't own myself. – Shadur Mar 23 '11 at 11:34
@Shadur Yes, I can totally see your point :) – badp Mar 23 '11 at 12:49
Note: these need to be flipped, so it is IP then hostname – Mike T May 14 '12 at 13:42

Hijacking old topic, but faced with the same problem recently. So, based on the advice given above and the output of host and whois:

# host security.debian.org
security.debian.org has address
security.debian.org has address
security.debian.org has address
security.debian.org has IPv6 address 2001:8d8:580:400:6564:a62:0:2
security.debian.org has IPv6 address 2001:a78:5:0:216:35ff:fe7f:be4f
security.debian.org has IPv6 address 2001:a78:5:1:216:35ff:fe7f:6ceb

Solved problem in a slightly different way - lowered the precedence of the IPv6 networks which contain security.debian.org in /etc/gai.conf:

# Make IPv6 for security.debian.org undesirable
precedence 2001:8d8:580::/48    5
precedence 2001:a78:5::/48      5

So, IPv6 is still preferred except for security.debian.org.

share|improve this answer

As of Oct 08th 2014, I had the same issue, trying to update debian behind a proxy on local network. In the hope it will be relevant to others, I post my response here. As others have mentioned, editing /etc/hosts is something one should be careful with.

But personally I just wanted to have the update done.

Content of /etc/apt/sources.list when doing the update (it was different before the update..):

deb http://http.debian.net/debian/ testing main
deb-src http://http.debian.net/debian/ testing main

deb http://mirrors.kernel.org/debian/ wheezy main
deb-src http://mirrors.kernel.org/debian/ wheezy main

deb http://security.debian.org/ wheezy/updates main
deb-src http://security.debian.org/ wheezy/updates main

Content of /etc/apt/apt.conf:

Acquire::http::proxy "";
Acquire::http::Timeout "10";
Acquire::ftp::Timeout "10";

Addition to /etc/hosts:

#Workaround for making apt-get work (08-10-2014) security.debian.org ftp.debian.org

Now, running apt-get update ; apt-get upgrade as root worked well.

As mentioned in other answers, use, run host command on the domain to get the correct ip to insert in the hosts file.


$ host ftp.debian.org
ftp.debian.org has address

This successfully updated the system to Debian GNU/Linux testing (jessie). You might not want to run with the testing repositories, then simply remove it from the sources. The testing repositories gives you more recent updates of several packages, but is not considered stable.

share|improve this answer

I have found a much better way to do this. Open up your sources.list file and note down the hostnames of the repos. Get their IPv4 addresses, then edit sources.list with the IPv4 addresses rather than the hostnames. Apt-get should now contact the repositories over the IPv4 addresses you specified, bypassing IPv6.

There is the disadvantage that repos usually have some sort of load balancing and/or IP geolocation set up, which this method of course bypasses. However, it shouldn't matter if only a few people are doing it. If you do find one mirror is slow, try getting another repo IP address (for instance, by using an online ping service) and use that.

share|improve this answer
That's a really bad solution, actually, for the reasons you already describe. – Shadur Apr 18 '13 at 4:46

You can try this if works for you

user@ubuntuvm:~$ sudo bash
root@ubuntuvm:~# echo 1 > /proc/sys/net/ipv6/conf/eth0/disable_ipv6 

--> replace your interface name

share|improve this answer
This is a solution for a different question than I asked. – Shadur Jul 12 '15 at 18:10

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.