debian 8: My machine started to only use IPv6 for *outgoing* connections. How to go back to IPv4?

Question

I'm running debian 8 on my server. Recently, the server starting only using IPv6 for all outgoing TCP connections. It still accepts IPv4 for incoming connections, however.

Because of this, I can't access any web sites (port 80), make any ssh connections (port 22), nor access any other outgoing host via any TCP port from my server now.

I completely disabled all iptables rules via iptables -F followed by iptables -X, and the problem persists.

Here are some command outputs which might be pertinent:

% sudo ip address
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: dummy0: <BROADCAST,NOARP> mtu 1500 qdisc noop state DOWN group default qlen 1000
    link/ether aa:bf:5c:77:b2:82 brd ff:ff:ff:ff:ff:ff
3: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
    link/ether f2:3c:91:96:da:28 brd ff:ff:ff:ff:ff:ff
    inet 45.33.123.70/24 brd 45.33.123.255 scope global eth0
       valid_lft forever preferred_lft forever
    inet 45.33.5.47/24 scope global eth0:1
       valid_lft forever preferred_lft forever
    inet 192.168.135.4/17 scope global eth0:2
       valid_lft forever preferred_lft forever
    inet6 2600:3c00::f03c:91ff:fe96:da28/64 scope global mngtmpaddr dynamic 
       valid_lft 87sec preferred_lft 27sec
    inet6 fe80::f03c:91ff:fe96:da28/64 scope link 
       valid_lft forever preferred_lft forever
4: teql0: <NOARP> mtu 1500 qdisc noop state DOWN group default qlen 100
    link/void 
5: tunl0@NONE: <NOARP> mtu 1480 qdisc noop state DOWN group default qlen 1000
    link/ipip 0.0.0.0 brd 0.0.0.0
6: gre0@NONE: <NOARP> mtu 1476 qdisc noop state DOWN group default qlen 1000
    link/gre 0.0.0.0 brd 0.0.0.0
7: gretap0@NONE: <BROADCAST,MULTICAST> mtu 1476 qdisc noop state DOWN group default qlen 1000
    link/ether 00:00:00:00:00:00 brd ff:ff:ff:ff:ff:ff
8: erspan0@NONE: <BROADCAST,MULTICAST> mtu 1464 qdisc noop state DOWN group default qlen 1000
    link/ether 00:00:00:00:00:00 brd ff:ff:ff:ff:ff:ff
9: ip_vti0@NONE: <NOARP> mtu 1480 qdisc noop state DOWN group default qlen 1000
    link/ipip 0.0.0.0 brd 0.0.0.0
10: ip6_vti0@NONE: <NOARP> mtu 1364 qdisc noop state DOWN group default qlen 1000
    link/tunnel6 :: brd ::
11: sit0@NONE: <NOARP> mtu 1480 qdisc noop state DOWN group default qlen 1000
    link/sit 0.0.0.0 brd 0.0.0.0
12: ip6tnl0@NONE: <NOARP> mtu 1452 qdisc noop state DOWN group default qlen 1000
    link/tunnel6 :: brd ::
13: ip6gre0@NONE: <NOARP> mtu 1448 qdisc noop state DOWN group default qlen 1000
    link/gre6 00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00 brd 00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00

% sudo route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         45.33.123.1     0.0.0.0         UG    0      0        0 eth0
45.33.5.0       0.0.0.0         255.255.255.0   U     0      0        0 eth0
45.33.123.0     0.0.0.0         255.255.255.0   U     0      0        0 eth0
192.168.128.0   0.0.0.0         255.255.128.0   U     0      0        0 eth0

I don't know what could have caused this change to IPv6-only on output. But in any case, I just want to go back to IPv4 for the default for all outgoing connections.

Thank you for any insights and suggestions.

Answer 1

Another method that might work would be to configure your machine to prefer IPv4. So it'll try IPv4 first but then try IPv6 if that fails.

This can be done in /etc/gai.conf

precedence ::ffff:0:0/96  100
scopev4 ::ffff:0.0.0.0/96       14

This tells the getaddrinfo() call to give priority to IPv4 results.

Answer 2

I take the "nuke it from orbit" approach when it comes to IPv6.

Add ipv6.disable=1 to your kernel options in /etc/default/grub then run update-grub and reboot:

GRUB_CMDLINE_LINUX_DEFAULT="... ipv6.disable=1"

Alternatively if you can't easily modify kernel parameters add this to your sysctl.conf or run sysctl to set manually:

net.ipv6.conf.all.disable_ipv6=1
net.ipv6.conf.default.disable_ipv6=1

Answer 3

If you delete the public ip6 address you should be ok:

# ip address del 2600:3c00::f03c:91ff:fe96:da28/64 dev eth0

As to how it got there, it might be that their DHCP server (if you're getting addresses over DHCP) just started sending an IPv6 prefix.

You might want to tell your provider about it, beacause in the long run you do want to have IPv6 enabled.