4

Unlike other systems, Fedora 25 workstation doesn't use stable IPv6 addresses, by default.

For example, with CentOS 7 or Fedora 23, a stable IPv6 is automatically configured (in an IPv6 enabled network where a IPv6 router is present) - i.e. one that is derived from the MAC-address.

That IPv6 address then can be used in an DNS AAAA-record.

In contrast to that, the IPv6 address of a Fedora 25 workstation system doesn't have any relation to its MAC address and doesn't seem to be stable.

How to configure deterministic and stable IPv6 addresses on Fedora 25?

|improve this question
8

On Fedora 25 Workstation, NetworkManager (NM) configures all network interfaces, by default. That means also the wired ones. And the NetworkManager doesn't create EUI-64 derived IPv6 addresses. Instead it generates so called 'stable-privacy' ones. Apparently to not disclose the MAC address to each IPv6 destination.

This can be changed for a given interface $i via changing the IPV6_ADDR_GEN_MODE key in the /etc/sysconfig/network-scripts/ifcfg-$i configuration file. For example via:

sed -i 's/^IPV6_ADDR_GEN_MODE=stable-privacy/IPV6_ADDR_GEN_MODE=eui64/' \
  /etc/sysconfig/network-scripts/ifcfg-$i

The change is effective after NetworkManager rereads its configuration and after a reconnect:

nmcli con reload
nmcli con down $i
nmcli con up $i

Notes

  • this option isn't exposed via the NM settings GUI
  • the interface configuration files under /etc/sysconfig/network-scripts read by NM are Fedora/Redhat specific, but the configuration key is not - i.e. on other distributions NM just reads the interface configurations from different locations/configuration files
|improve this answer
  • sysconfig/network-scripts is for systemd-networkd. If using NetworkManager, it is configured in NetworkManager.conf or connection specific. – Bachsau Feb 14 '18 at 13:38
  • @Bachsau, I haven't used systemd-networkd so far, thus I haven't investigated what config files it reads. But NetworkManager definitely does read the /etc/sysconfig/network-scripts/ files, on Fedora. This is also documented in a fine manual page. – maxschlepzig Feb 14 '18 at 20:34
3

The addresses that you think are not stable, actually are.

These are RFC 7217 stable privacy addresses, which are designed to make devices less trackable as they roam across networks, while maintaining the same address on any given network.

Stable privacy addresses are assigned instead of EUI-64 derived addresses when SLAAC is in use on a link. They do not replace RFC 4941 privacy addresses.

This all means that in order to have stable addresses, you need to do nothing. You can also use stateful DHCPv6 and get rid of SLAAC entirely, and in this way you can centrally control the assignment of addresses. But then you lose the benefits of stable privacy addresses.

|improve this answer
  • Thanks for the RFC reference - RFC 7217 provides a limited degree of stability, though. Since the generating function depends on a secret-key (and other implementation specific ingredients) the resulting IP is only stable over the life-time of the currently installed operating system instance. In that sense EUI-64 style addresses are more stable. And thus have the advantage to not require updates to existing DNS AAAA-records. – maxschlepzig Dec 18 '16 at 18:52
  • I don't worry about updating DNS. That is automatic once I have joined a domain and set up sssd (which might also be done automatically). – Michael Hampton Dec 18 '16 at 18:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.