-1

This question already has an answer here:

First,

if I issue sysctl net.ipv6.conf.all.disable_ipv6=1 from the command line after the system has started, I get the result I want -- IPv6 is indeed disabled.

Now for the problem of making this behavior persistent after a reboot.

It is easy to find suggestions for how to do this, usually they revolve around putting net.ipv6.conf.all.disable_ipv6=1 in a file in the /etc/sysctl.d/ directory or in the config file for sysctl itself, namely /etc/sysctl.conf. Other approaches mentioned include adding

GRUB_CMDLINE_LINUX="ipv6.disable=1"

To /etc/default/grub

This is mentioned e.g. here:

https://serverfault.com/questions/660979/how-to-disable-ipv6-support-in-linux-entirely

I've tried all of these, they don't work. ifconfig clearly shows that IPv6 is enabled for the interface. Again, if I just do a manual sysctl after booting, it disables it as expected.

sysctl -p does nothing for me, only writing the command verbatim as above works.

I've also tried putting the sysctl command in /etc/rc.local, which I know runs correctly from observing other commands I can put there. However, despite executing, it doesn't seem to take effect.

I've also tried other commands instead of just all.disable_ipv6, such as default.disable_ipv6 and enp0s3.disable_ipv6 (I've verified that enp0s3 is indeed my Ethernet interface).

This seems a bit similar to https://bugs.launchpad.net/ubuntu/+source/linux/+bug/997605 to me, but I have no idea why this happens. I'm confident that all I had to do on a different system was simply to put this in a file in /etc/sysctl.d/.

One way to disable this which I already know of, beyond what I've tried, would be to recompile the kernel manually without IPv6 support. However, this is simply too much of a kludge, it is not reliable, and it is too much work to do and maintain.

marked as duplicate by LinuxSecurityFreak, terdon Jan 6 at 13:48

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • 2
    The kernel command-line option requires both that one be actually using GRUB in the first place and that one perform the unstated extra steps to ensure that GRUB applies the setting. – JdeBP Sep 5 '18 at 7:46
  • Please add the output of uname -a to your question. – Rui F Ribeiro Sep 5 '18 at 9:55
  • Warning: You are disabling IPv6. Be sure you document this carefully for any other admins who may attempt to manage this system (including future yourself) as it is 100% guaranteed to come back to bite you at some point. – Michael Hampton Sep 5 '18 at 22:00
3

Been a long time Debian sysadmin, administering hundred of Debian VMs, and I can assure you issuing sysctl+kernel settings to disable IPv6, is more than enough to kill it off for good.

Your problem here in your scenario, is that is not enough to edit /etc/default/grub, for the parameter(s) there to be applied to the kernel.

You also have to do:

sudo update-grub2

And then reboot, for the kernel parameter to disable IPv6 to take effect.

By the way, you can check it out which parameters were passed to your kernel, in run-time:

$ cat /proc/cmdline 
BOOT_IMAGE=/boot/vmlinuz-4.10.5-antix.3-amd64-smp root=UUID=00c17984-859f-4197-8bd8-b346ddd092bd ro iommu=1 intel_iommu=on iommu=pt ipv6.disable=1 intremap=no_x2apic_optout radeon.modeset=0

Also, as @schweik correctly states, after you successfully manage to kill IPv6, you might want to revisit the configuration of a couple of daemons, that are compiled/have specific configuration configuration for IPv6. Watch for error messages and/or logs of errors related to IPv6, upon booting your system.

PS Also be aware that in Arm or MIPS architecture, you often do not have grub, and you have to edit a different file from /etc/default/grub. However I assume that if you are editing it, that you have grub.

  • please, what kind of VM engine do you use? I noticed by using KVM-Qemu many errors while disable the IPv6 in the Debian 9 running as guest VM. May I start a regular question on that? – schweik Sep 5 '18 at 11:19
  • @schweik Corporate use mostly VMWare (ESX) Enterprise, some ESXi, Parallels and VMWare Fusion in my Mac, a few Hyper V, kvm and AWS here and there, Xen in the past, a few tests with bhyve, even VirtualBox. I do find HyperV and VirtualBox buggy. – Rui F Ribeiro Sep 5 '18 at 11:38
0

You may need to search for GRUB_CMDLINE_LINUX_DEFAULT in all config files under /etc/default.

On my Ubuntu server 18.04.1 LTS install, there is a /etc/default/grub file AND a /etc/default/grub.d/50-curtain-settings.cfg file. The latter overwrote the GRUB_CMDLINE_LINUX_DEFAULT variable which kept ipv6 active.

After also editing the latter file, I ran update-grub and rebooted. IPv6 was successfully disabled.

-1

IPv6 is realy very boring protocol while using e.g. private network. The problem is that this protocol is forced in even all services hence in pure IPv4 network it decrease the speed with its timeouts.

Well if you disable IPv6 in /etc/sysctl.conf or elsewhere near the start of system, some services, which are configured to use the IPv6 (and there are plenty of them) can enable it again. Disabling IPv6 after the system is fully loaded and configured asserts your will better. But if you after this change that change your network connection (e.g. form wifi to wire) the IPv6 may appear again. The suspected service is NetworkManager hence I stop this service (mainly on servers) or disable it (you can also configure each connection to ignore IPv6 - I did not find the global disable for that). There are other configurations where it is necessary to disable IPv6, too: in /etc/ssh/sshd_config add the line AddressFamily inet, comment all the line with IPv6 in /etc/hosts, in /etc/samba/smb.conf specify IPv4 addess expressly (interfaces = 192.168.43.11) not interface name nor the domain name. And so on. If asking for DHCP address use: dhclient -4 eth0, what forces an IPv4 request even IPv6 self-assignment.

The good practise is to look at listening ports with netstat -lptun (or ss -lptun) and consult the man pages of process using IPv6 address how to disable it. In some cases you cannot win (e.g. dns-server allways listen on IPv6) but usualy you can find the way.

The 100% way could be to recompile the kernel without IPv6, but than you risk some applications refuse to start until recompiled, too.

Good luck

  • IPv6 being "broken" in "internal" networks is relative. Many universities are deploying it in wifi networks due to the scarcity of IPv4 addresses, and even our major telecom operator here in Portugal is delivering IPv6 addresses to their Internet fiber customers. In corporate settings I often find a mix were a small part of the network is IPv6 (e.g. maybe 2%-5% of the servers need to be IPv6 enabledl). – Rui F Ribeiro Sep 5 '18 at 10:06
  • I would not start a flame over the IPv6. In my strictly isolated office network, a private network range of 192.168.X.X is fully suffitient and hence I simply described the way to tace the IPv6 as it was asked. – schweik Sep 5 '18 at 10:25
  • No flame here, have a look at my answer – Rui F Ribeiro Sep 5 '18 at 10:41
  • In Debian I dont remember having to recompile an app because of disabling IPv6, btw, either in server or desktop settings. – Rui F Ribeiro Sep 5 '18 at 11:00
  • @RuiFRibeiro I appologise that I wold not be provocative to start a flame, I recognise, that there are reason to switch to IPv6. Sorry, I didnot try to accuse someone else :-) – schweik Sep 5 '18 at 11:16

Not the answer you're looking for? Browse other questions tagged or ask your own question.