1

eth0 on my Arch Linux box is connected directly to a cable modem. ip a shows the following info. openvpn has established one tunnel. All traffic should flow over the openvpn tunnel only. What are all these other connections for? Do they pose security concerns?

eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
    link/ether c4:d4:64:34:b4:94 brd ff:ff:ff:ff:ff:ff
    inet 10.0.0.181/24 brd 10.0.0.255 scope global eth0
    valid_lft forever preferred_lft forever
    inet6 2601:343:380:1f6::3c84/128 scope global dynamic noprefixroute 
    valid_lft 566296sec preferred_lft 566296sec
    inet6 2601:343:380:1f6:d609:189b:cf5b:bb8e/64 scope global dynamic mngtmpaddr noprefixroute 
    valid_lft 196684sec preferred_lft 196684sec
    inet6 fe80::2e4d:54ff:fe53:8b92/64 scope link 
    valid_lft forever preferred_lft forever

EDIT

Changed title from "Understanding ethernet connections on one interface" to "Understanding ethernet addresses on one interface" as per dirkt's answer.

  • All traffic can't flow through the VPN, because at least the VPN software should be able to send packets directly. :-) ipv6 does some nasty things, link-local addresses, and many similar. As far I know, all thing has at least 2 ip on it. Maybe also this "dynamic mngtmpaddr" could mean something. Probably it doesn't have anything with openvpn et al. – peterh Sep 15 '17 at 0:18
  • Thanks for that info. The cable modem is from Comcast. Does knowing that help? – MountainX Sep 15 '17 at 4:37
  • Quite possible. There is also some iplevel autoconf protocol in it, because the commitee invented ipv6 likes to do unneeded things, this time yet another dhcp. – peterh Sep 15 '17 at 4:40
4

These are not connections, they are addresses. To be able to communicate at all, a network interface needs to be assigned IP protocol addresses. Otherwise the VPN tunnel couldn't connect to the other endpoint.

You have, from top to bottom:

  • One private usage IPv4 address 10.0.0.181. This is your internal address in the comcast network.
  • One global IPv6 adddress 2601:343:380:1f6::3c84.
  • One temporary IPv6 address 2601:343:380:1f6:d609:189b:cf5b:bb8e which will be used instead of the previous address, and will change from time to time to help ensure your privacy.
  • One link-local IPv6 address fe80::2e4d:54ff:fe53:8b92 which is automatically configured for every interface that supports IPv6.

All of that is perfectly normal, is needed for normal operation, and is no security concern.

If you look at your routes with ip route, you should see routes for all your interfaces, and an overriding default routes (or two) that direct everything towards the OpenVPN tunnel.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.