8

Problem and aim

We don't get IPv6 from our ISP thus I have an IPv6 tunnel which works fine but is, of course, not very fast. And not really reliable. I like to have IPv6 available "just in case" but I want certain hosts (domains) to be connected with IPv4 only.

Default protocol

It seems to me that all applications try IPv6 first; this is probably a glibc setting. I would be fine if this default would be reversed (for all applications).

Netfilter

It would be possible to block IPv6 addresses / networks with Netfilter but there are two problems:

  1. Would this cause a delay as the app waits for a IPv6 timeout before it tries IPv4?
  2. Some domains seem to be mixed that it looks like chaos. Separating google.com and youtube.com seems like something you don't want to do if you can avoid it.

I just note that the man page for ip route says for the routing type unreachable:

The local senders get an EHOSTUNREACH error.

Does the same happen with Netfilter DROPs or REJECTs? Such an error should not cause a relevant delay.

DNS filtering

Another solution (rather easy one if that is possible) would be to filter AAAA records for certain domains. If that is not (easily) possible: Is it possible to connect the DNS server and Netfilter so that I know "IP address X belongs to domain Y" so that I can add it to Netfilter? Anything more elegant than logging everything and grepping the log?

The way to go?

Which (other) possibilities are there and what is the easiest?

2
  • 2
    You really won't notice with anything that implements Happy Eyeballs (RFC 6555), such as modern web browsers. May 27, 2013 at 21:15
  • DNS isn't really designed to work that way. In any event, you might try a more reliable tunnel service. Jun 6, 2013 at 3:28

2 Answers 2

18

You can control address selection with /etc/gai.conf. The configuration file is well documented, and already contains the defaults, so you can just begin tweaking.

The interesting defaults here are:

label  ::1/128       0
label  ::/0          1
label  2002::/16     2
label ::/96          3
label ::ffff:0:0/96  4
precedence  ::1/128       50
precedence  ::/0          40
precedence  2002::/16     30
precedence ::/96          20
precedence ::ffff:0:0/96  10

The last line gives the lowest preference to all IPv4 addresses.

If you want to give a higher preference to all IPv4, you could change it to:

precedence ::ffff:0:0/96  100

If you only wanted to give higher preference to specific IPv4 addresses or blocks, you can specify them as well. Remember that you have to use an IPv4-mapped IPv6 in hex.

So, to give preference to 203.0.113.0/24 over all IPv6, you would add:

label ::ffff:cb00:7100/120 5
precedence ::ffff:cb00:7100/120 100

Restart running applications to have them pick up changes you make.


On Debian derived systems, /etc/gai.conf is already present. On Red Hat derived systems, it is absent, but a sample file is located at /usr/share/doc/glibc-common-*/gai.conf; just copy it to /etc.

2
  • Never heard of that before; great hint even though it's not a DNS solution. May 27, 2013 at 21:41
  • 1
    You asked for the easiest method... :) May 27, 2013 at 21:42
5
+100

OK, here's a completely different answer.

Place the offending hosts with crappy IPv6 connectivity in /etc/hosts with their corresponding IPv4 address.

For example:

199.7.53.74 whois.verisign-grs.com

Remember to remove them when their (in this case) or your IPv6 connectivity improves.

2
  • 1
    That would be easy for a single host with a single IP. As I mentioned this is about **.youtube.com. Thus a lot of host names are affected. In theory this would be easy with DNS: "Block AAAA records for everything in .youtube.com". Your approach would be to put all these addresses (probably they change neither their domain structure nor their IPs often and it would be OK to have a script check that every day) in /etc/hosts. If noone comes up with "DNS server software XY can filter this way!!" I'll probably end up with that. Jun 8, 2013 at 23:52
  • I'm familiar with almost every known DNS server package, and none do what you seem to want, easily or at all. Now if you want to write your own custom code...but the real solution of course is to improve your IPv6 connectivity. Try a different tunnel broker? Jun 8, 2013 at 23:53

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .