1

I'm setting up a VPN tunnel for some services. I created a vpntunnel/vpntunnel user/group that is routed to the tun0 interface based on the group ID. That works quite fine. Commands below run as regular user:

curl -4 ifconfig.io <= returns my public IPv4 ip
curl -6 ifconfig.io <= returns my public IPv6 ip

Because my VPN provider doesn't support IPv6 yet, my IP could be exposed. So I added an ip6tables rule:

 ip6tables -A OUTPUT -o tun0 -m owner --gid-owner vpntunnel -j REJECT

Now the same commands run as the vpntunnel user

sudo -u vpntunnel -i -- curl -4 ifconfig.io <= returns my VPN ip
sudo -u vpntunnel -i -- curl -6 ifconfig.io <= connection refused

The refused connection is normal as I blocked IPv6 OUTPUT on tun0. So I thought everything was fine but I did a last check: I went on https://torguard.net/checkmytorrentipaddress.php, copied the magnet link and waited for the results. I was very surprised to see my IPv6 appear. My IPv4 is the VPN IP though so my routing is not completely broken, Transmission uses the VPN tunnel.

I tried to add more rules:

ip6tables -A INPUT -i tun0  -j DROP
ip6tables -I FORWARD -i tun0 -o enp3s0 -j REJECT

But nothing did the trick.

I don't want to disable IPv6 on the machine, I need it.

Any idea? Thanks!

11
  • You won't talk IPv6 over a interface without IPv6. What you need to do is to block the user from talking IPv6 on the interfaces that has it.
    – vidarlo
    Nov 14, 2021 at 9:18
  • just disable ipv6?
    – djdomi
    Nov 14, 2021 at 10:01
  • 1
    @djdomi no, I use IPv6, can't disable it.
    – Axel
    Nov 14, 2021 at 12:54
  • @djdomi you gave me an idea, and it worked. I added a net.ipv6.conf.tun0.disable_ipv6 = 1 into systectl. Just fine now. Thanks
    – Axel
    Nov 14, 2021 at 13:02
  • If you have an answer, you should post the answer and accept it.
    – Ron Maupin
    Nov 14, 2021 at 14:53

0

You must log in to answer this question.

Browse other questions tagged .