{"id":6178,"date":"2022-08-01T00:01:00","date_gmt":"2022-08-01T04:01:00","guid":{"rendered":"http:\/\/www.linux-databook.info\/?page_id=6178"},"modified":"2022-07-03T19:40:56","modified_gmt":"2022-07-03T23:40:56","slug":"how-to-disable-ipv6","status":"publish","type":"page","link":"http:\/\/www.linux-databook.info\/?page_id=6178","title":{"rendered":"How to Disable IPV6"},"content":{"rendered":"\n

IPV6 is a good thing for the Internet in general, but I find it unnecessarily complex for use in most home, and small- to medium-size businesses. Like many others, I continue use private IPV4 IP ranges for my own internal networks as well as those others for which I have some level of responsibility. My ISP only provides IPV4 addresses anyway so it makes no sense to use IPV6 internally when all external packets are IPV4. Besides, IPV4 really is much simpler and one of the tenets of my Linux Philosophy<\/a> is, \u201cFind the Simplicity.\u201d<\/p>\n\n\n\n

As a result I disabled IPV6 on all my hosts. Here is how I did this. It seemed easy \u2013 at first.<\/p>\n\n\n\n

Testing for IPV6<\/h2>\n\n\n\n

All of my hosts run the Fedora 36 Xfce spin as well as a significant number of packages and configuration changes I perform after the initial default installation. All of my hosts have the most recent updates installed. One of those hosts is my firewall\/router and that is the first host on which I disabled IPV6.<\/p>\n\n\n\n

You can check to see whether IPV6 is currently active on your Linux host. The nmcli<\/strong> command results below are from my router\/firewall host. All the active NICs have both IPV4 and IPV6 addresses.<\/p>\n\n\n\n

[root@wally ~]# nmcli<\/strong>\nenp4s0: connected to enp4s0\n        \"Realtek RTL8111\/8168\/8411\"\n        ethernet (r8169), 84:16:F9:04:44:03, hw, mtu 1500\n        ip4 default\n        inet4 45.20.209.41\/29\n        route4 45.20.209.40\/29 metric 102\n        route4 default via 45.20.209.46 metric 102\n        inet6 2600:1700:7c0:860:8616:f9ff:fe04:4403\/64\n        inet6 fe80::8616:f9ff:fe04:4403\/64\n        route6 fe80::\/64 metric 256\n        route6 default via fe80::a698:13ff:fee5:fa10 metric 1024\n        route6 2600:1700:7c0:860::\/64 metric 256\n\nenp1s0: connected to enp1s0\n        \"Realtek RTL8111\/8168\/8411\"\n        ethernet (r8169), 84:16:F9:03:E9:89, hw, mtu 1500\n        inet4 192.168.10.1\/24\n        route4 192.168.10.0\/24 metric 101\n        inet6 fe80::8616:f9ff:fe03:e989\/64\n        route6 fe80::\/64 metric 256\n\nenp2s0: connected to enp2s0\n        \"Realtek RTL8111\/8168\/8411\"\n        ethernet (r8169), 84:16:F9:03:FD:85, hw, mtu 1500\n        inet4 192.168.0.254\/24\n        route4 192.168.0.0\/24 metric 100\n        inet6 fe80::8616:f9ff:fe03:fd85\/64\n        route6 fe80::\/64 metric 256\n\nlo: unmanaged\n        \"lo\"\n        loopback (unknown), 00:00:00:00:00:00, sw, mtu 65536\n\nDNS configuration:\n        servers: 192.168.0.52 8.8.8.8 8.8.4.4\n        interface: enp4s0\n\n        servers: 192.168.0.52 8.8.8.8\n        interface: enp2s0\n\n        servers: 192.168.0.52 8.8.8.8\n        interface: enp1s0<\/pre>\n\n\n\n
Add a Local File to sysctl.d<\/h2>\n\n\n\n
The \/etc\/sysctl.conf file can be used to add the configuration settings necessary but it is much better to add a local file to the \/etc\/sysctl.d directory so that it won\u2019t be overwritten during updates or upgrades. Note that there is already a file named 99-sysctl.conf. You can use that file to set the configuration but I created a different for this purpose, 99-local-network.conf with the following content. That way if the 99-sysctl.conf changes with future updates or upgrades my file will remain untouched. This is not an executable file, it is a configuration file.<\/p>\n\n\n\n
################################################################################\n# Local NetworkManager settings - Specifically to disable IPV6                 #\n################################################################################\n#\nnet.ipv6.conf.all.disable_ipv6 = 1\nnet.ipv6.conf.default.disable_ipv6 = 1<\/pre>\n\n\n\n
Note: <\/strong>Like many configuration files in configuration directories like this one, the files contained in the directory are read in natural sorted order. That means that the value for a variable declared in a file with a later sort order will override an earlier declaration for the same variable.<\/em><\/p>\n\n\n\n
A reboot is usually used to cause these changes to take effect but I later learned how to do so without a reboot. I rebooted my system and ran the nmcli command again, this time with the following results.<\/p>\n\n\n\n
[root@wally ~]# nmcli<\/strong>\nenp4s0: connected to enp4s0\n        \"Realtek RTL8111\/8168\/8411\"\n        ethernet (r8169), 84:16:F9:04:44:03, hw, mtu 1500\n        ip4 default\n        inet4 45.20.209.41\/29\n        route4 45.20.209.40\/29 metric 101\n        route4 default via 45.20.209.46 metric 101\n\nenp1s0: connected to enp1s0\n        \"Realtek RTL8111\/8168\/8411\"\n        ethernet (r8169), 84:16:F9:03:E9:89, hw, mtu 1500\n        inet4 192.168.10.1\/24\n        route4 192.168.10.0\/24 metric 102\n\nenp2s0: connected to enp2s0\n        \"Realtek RTL8111\/8168\/8411\"\n        ethernet (r8169), 84:16:F9:03:FD:85, hw, mtu 1500\n        inet4 192.168.0.254\/24\n        route4 192.168.0.0\/24 metric 100\n\nlo: unmanaged\n        \"lo\"\n        loopback (unknown), 00:00:00:00:00:00, sw, mtu 65536\n\nDNS configuration:\n        servers: 192.168.0.52 8.8.8.8 8.8.4.4\n        interface: enp4s0\n\n        servers: 192.168.0.52 8.8.8.8\n        interface: enp2s0\n\n        servers: 192.168.0.52 8.8.8.8\n        interface: enp1s0<\/pre>\n\n\n\n
This shows that my simple fix worked.<\/p>\n\n\n\n
Except \u2026<\/h2>\n\n\n\n
\u2026 that solution only works on one of my twelve Linux computers. After writing the part of this article above, I started installing this fix on all of my other hosts. I had only done one when I realized that this did not always work. I then tried it on one of my VMs and it failed there as well. As best I can tell it only works on one host, the one I use as my firewall and router.<\/p>\n\n\n\n
After some additional research on a VM I discovered that these settings can also be issued as commands using sysctl<\/strong> so that a reboot would not be needed. I could enter those commands from the command line and IPV6 would be deactivated.<\/p>\n\n\n\n
[root@f36vm ~]# sysctl -w net.ipv6.conf.all.disable_ipv6=1<\/strong>\nnet.ipv6.conf.all.disable_ipv6 = 1\n[root@f36vm ~]# sysctl -w net.ipv6.conf.default.disable_ipv6=1<\/strong>\nnet.ipv6.conf.default.disable_ipv6 = 1\n[root@f36vm ~]# nmcli<\/strong>\nenp0s3: connected to Wired connection 1\n        \"Intel 82540EM\"\n        ethernet (e1000), 08:00:27:07:CD:FE, hw, mtu 1500\n        ip4 default\n        inet4 192.168.0.136\/24\n        route4 192.168.0.0\/24 metric 100\n        route4 default via 192.168.0.254 metric 100\n\nlo: unmanaged\n<SNIP><\/pre>\n\n\n\n
It took some time to research this and determine that the file I created was not being read \u2013 or at least not processed \u2013 by sysctl<\/strong> during the Linux startup. Or that, if it was, it was being ignored or the settings were being overwritten later by the same variables with different values. After this I knew that there was no deeper problem preventing it.<\/p>\n\n\n\n
About sysctl<\/h2>\n\n\n\n
At this point I looked into the sysctl<\/strong> command in more detail. The purpose of the sysctl<\/strong> command is to set kernel parameters in the \/proc directory. It can also be used by the root user to set individual parameters from the command line or \u2013 and this is the key to my solution \u2013 it can be used to view and set all of the kernel parameters stored in several locations including \/etc\/sysctl.conf and in files located in \/etc\/sysctl.d. The sysctl<\/strong> command is used during Linux startup<\/a> to set the kernel parameters.<\/p>\n\n\n\n
I repeat: The <\/em>sysctl<\/em><\/strong> command <\/em>is used by the system and by the SysAdmin to view and set kernel variables. While the system is up and running. Without a reboot. This command and the power it offers the Linux SysAdmin is one of the most significant differences between Linux and other operating systems. It gives us a tool to do things impossible on other OS\u2019s.<\/em><\/p>\n\n\n\n
I tested this by rebooting the VM and running the following command to set the variables in all of the locations listed in the sysctl<\/strong> man page.<\/p>\n\n\n\n
[root@f36vm ~]# sysctl --system<\/strong>\n* Applying \/usr\/lib\/sysctl.d\/10-default-yama-scope.conf ...\nkernel.yama.ptrace_scope = 0\n* Applying \/usr\/lib\/sysctl.d\/50-coredump.conf ...\nkernel.core_pattern = |\/usr\/lib\/systemd\/systemd-coredump %P %u %g %s %t %c %h\nkernel.core_pipe_limit = 16\nfs.suid_dumpable = 2\n* Applying \/usr\/lib\/sysctl.d\/50-default.conf ...\nkernel.sysrq = 16\nkernel.core_uses_pid = 1\nnet.ipv4.conf.default.rp_filter = 2\nsysctl: setting key \"net.ipv4.conf.all.rp_filter\": Invalid argument\nnet.ipv4.conf.default.accept_source_route = 0\nsysctl: setting key \"net.ipv4.conf.all.accept_source_route\": Invalid argument\nnet.ipv4.conf.default.promote_secondaries = 1\nsysctl: setting key \"net.ipv4.conf.all.promote_secondaries\": Invalid argument\nnet.ipv4.ping_group_range = 0 2147483647\nnet.core.default_qdisc = fq_codel\nfs.protected_hardlinks = 1\nfs.protected_symlinks = 1\nfs.protected_regular = 1\nfs.protected_fifos = 1\n* Applying \/usr\/lib\/sysctl.d\/50-libkcapi-optmem_max.conf ...\nnet.core.optmem_max = 81920\n* Applying \/usr\/lib\/sysctl.d\/50-libreswan.conf ...\nnet.ipv6.conf.default.accept_redirects = 0\nnet.ipv6.conf.all.accept_redirects = 0\nnet.ipv4.conf.default.send_redirects = 0\nnet.ipv4.conf.default.accept_redirects = 0\nnet.ipv4.conf.all.send_redirects = 0\nnet.ipv4.conf.all.accept_redirects = 0\n* Applying \/usr\/lib\/sysctl.d\/50-pid-max.conf ...\nkernel.pid_max = 4194304\n* Applying \/etc\/sysctl.d\/99-local-network.conf ...\nnet.ipv6.conf.all.disable_ipv6 = 1\nnet.ipv6.conf.default.disable_ipv6 = 1\n* Applying \/etc\/sysctl.d\/99-sysctl.conf ...\n* Applying \/etc\/sysctl.conf ...\n[root@f36vm ~]#<\/pre>\n\n\n\n
Then checking the status of the NIC with the nmcli<\/strong> command showed that IPV6 had been disabled and that IPV4 was still up and running. Yes, I do see the other errors in that data stream but I am ignoring them for now. Be sure to read the man page for the sysctl<\/strong> command as it is quite interesting. It provides a method for processing all of the sysctl configuration files with the –service option.<\/p>\n\n\n\n
The solution<\/h2>\n\n\n\n
Now that I understood the true nature of the problem I could create a real solution \u2013 even if it might be only a temporary circumvention. But I was able to do so in a way that is in keeping with the original intent of the Linux startup sequence and the sysctl.d method for configuring the kernel.<\/p>\n\n\n\n
I left my new configuration file in place in \/etc\/sysctl.d. I created the simple Bash script shown below that would run the sysctl –system <\/strong>command and stored it in \/usr\/local\/bin. I then tested that a number of times to ensure that it continued to work as expected.<\/p>\n\n\n\n
#!\/bin\/bash\n<SNIP \u2013 discarded a bunch of comments to save space>\nsysctl --system<\/pre>\n\n\n\n
I tested this script multiple times before proceeding to ensure that it worked. If you do this be sure to test it multiple times, both with and without rebooting to return to the original kernel configuration.<\/p>\n\n\n\n
Creating the Service<\/h2>\n\n\n\n
The real key to this solution was to create a new systemd service that would work similarly to the old rc.local SystemV script. In this case I called it the MyStartup.service and I renamed the script I created above and called it MyStartup.sh. To create the service<\/a> itself I created a new systemd unit file in the \/usr\/local\/lib\/systemd\/system directory which I also had to create. This service will run once at startup. I named this new file MyStartup.service and added the following content.<\/p>\n\n\n\n
<SNIP \u2013 discarded a bunch of comments to save space>\n[Unit]\nDescription=Runs \/usr\/local\/bin\/MyStartup.sh\n\n[Service]\nExecStart=\/usr\/local\/bin\/MyStartup.sh\n\n[Install]\nWantedBy=multi-user.target<\/pre>\n\n\n\n
Note that systemd unit files like this one don\u2019t need to be executable. It is owned by root.root with 664 permissions. It\u2019s pretty simple to create this service and it can be used for so many local startup tasks that I plan to keep it even when there is a permanent fix to the extant problem.<\/p>\n\n\n\n
The new service is enabled by the command below. Note that the systemctl command searches the new directory by default without any options, arguments, or prodding from me to locate the new unit file.<\/p>\n\n\n\n
[root@f36vm ~]# systemctl enable MyStartup.service<\/strong> \nCreated symlink \/etc\/systemd\/system\/multi-user.target.wants\/MyStartup.service \u2192 \/usr\/local\/lib\/systemd\/system\/MyStartup.service.<\/pre>\n\n\n\n
Enabling the service does not run the MyStartup.sh script. The script will be run by this service at every reboot.<\/p>\n\n\n\n
Testing<\/h2>\n\n\n\n
As soon as the VM rebooted I did a login as root and ran the following command to check the status of IPV6 but it was still active. After a bit more testing I determined that the service was running the commands too soon so I added a command to the MyStartup.sh script sleep for 25 seconds before running the commands.<\/p>\n\n\n\n
#!\/bin\/bash\n<SNIP \u2013 discarded a bunch of comments to save space>\n# Wait a bit for things to start up and settle. It doesn't work without this.\nsleep 25\n# Run the sysctl command. \nsysctl --system<\/pre>\n\n\n\n
I rebooted again and verified the status as soon as I was able to login with the result that the service was still sleeping.<\/p>\n\n\n\n
[root@f36vm ~]# systemctl status MyStartup.service<\/strong> \n\u25cf MyStartup.service - Runs \/usr\/local\/bin\/MyStartup.sh\n     Loaded: loaded (\/usr\/local\/lib\/systemd\/system\/MyStartup.service; enabled; vendor preset: disabled)\n     Active: active (running) since Fri 2022-07-01 13:24:22 EDT; 14s ago\n   Main PID: 667 (MyStartup.sh)\n      Tasks: 2 (limit: 14129)\n     Memory: 592.0K\n        CPU: 1ms\n     CGroup: \/system.slice\/MyStartup.service\n             \u251c\u2500 667 \/bin\/bash \/usr\/local\/bin\/MyStartup.sh\n             \u2514\u2500 669 sleep 25<\/pre>\n\n\n\n
After waiting some additional time I checked again and the service had completed successfully with the results clearly shown in the last few journal entries.<\/p>\n\n\n\n
Jul 01 13:24:22 f36vm.both.org systemd[1]: Started MyStartup.service - Runs \/usr\/local\/bin\/MyStartup.sh.\n[root@f36vm ~]# systemctl status MyStartup.service<\/strong> \n\u25cb MyStartup.service - Runs \/usr\/local\/bin\/MyStartup.sh\n     Loaded: loaded (\/usr\/local\/lib\/systemd\/system\/MyStartup.service; enabled; vendor preset: disabled)\n     Active: inactive (dead) since Fri 2022-07-01 13:24:47 EDT; 358ms ago\n    Process: 667 ExecStart=\/usr\/local\/bin\/MyStartup.sh (code=exited, status=0\/SUCCESS)\n   Main PID: 667 (code=exited, status=0\/SUCCESS)\n        CPU: 9ms\n\nJul 01 13:24:47 f36vm.both.org MyStartup.sh[1020]: net.ipv4.conf.all.send_redirects = 0\nJul 01 13:24:47 f36vm.both.org MyStartup.sh[1020]: net.ipv4.conf.all.accept_redirects = 0\nJul 01 13:24:47 f36vm.both.org MyStartup.sh[1020]: * Applying \/usr\/lib\/sysctl.d\/50-pid-max.conf ...\nJul 01 13:24:47 f36vm.both.org MyStartup.sh[1020]: kernel.pid_max = 4194304\nJul 01 13:24:47 f36vm.both.org MyStartup.sh[1020]: * Applying \/etc\/sysctl.d\/99-local-network.conf ...\nJul 01 13:24:47 f36vm.both.org MyStartup.sh[1020]: net.ipv6.conf.all.disable_ipv6 = 1\nJul 01 13:24:47 f36vm.both.org MyStartup.sh[1020]: net.ipv6.conf.default.disable_ipv6 = 1\nJul 01 13:24:47 f36vm.both.org MyStartup.sh[1020]: * Applying \/etc\/sysctl.d\/99-sysctl.conf ...\nJul 01 13:24:47 f36vm.both.org MyStartup.sh[1020]: * Applying \/etc\/sysctl.conf ...\nJul 01 13:24:47 f36vm.both.org systemd[1]: MyStartup.service: Deactivated successfully.\n[root@f36vm ~]#<\/pre>\n\n\n\n
You can see in the the data output above that the configuration statements in the 99-sysctl.conf file were applied. I also used the nmcli command to verify that IPV6 has been disabled.<\/p>\n\n\n\n
Automating it<\/h2>\n\n\n\n
After figuring out how to do this so that it would always work, I added a task to do this it to the Ansible playbook I use for distributing new and updated configuration files. That makes it easy for me to distribute to all of my 12 current hosts. I also added it to the playbook I use immediately after performing a basic installation on new hosts or ones that need a reinstallation for some reason. I added the following tasks to those playbooks.<\/p>\n\n\n\n
    - name: Install 99-local-network.conf file to disable IPV6\n      copy:\n        src: \/root\/ansible\/system-scripts\/files\/99-local-network.conf\n        dest: \/etc\/sysctl.d\n        mode: 0644\n        owner: root\n        group: root\n\n    - name: Install MyStartup.sh \n      copy:\n        src: \/root\/ansible\/system-scripts\/files\/MyStartup.sh\n        dest: \/usr\/local\/bin\n        mode: 0754\n        owner: root\n        group: root\n\n    - name: create \/root\/ansible\/system-scripts\/files\/ directory\n      file:\n        path: \/root\/ansible\/system-scripts\/files\/\n        state: directory\n        mode: 0755\n        owner: root\n        group: root  \n      \n    - name: Install MyStartup.service\n      copy:\n        src: \/root\/ansible\/system-scripts\/files\/MyStartup.service\n        dest: \/usr\/local\/lib\/systemd\/system\/\n        mode: 0664\n        owner: root\n        group: root\n\n    - name: Enable the MyStartup.service\n      systemd:\n        name: MyStartup.service\n        state: stopped\n        enabled: yes\n\n    - name: Run the raw command to disable IPV4 so a reboot is not required at this time\n      command: \n        cmd: sysctl --system<\/pre>\n\n\n\n
This addition to my playbooks makes it easy for me to install this service on all new hosts and to update the service on all of my current hosts if necessary.<\/p>\n\n\n\n
Final thoughts<\/h2>\n\n\n\n
Although just installing the file with the correct kernel parameters and rebooting worked fine on one of my hosts it failed on all of the others I tried. I looked for differences that might explain why it failed on the others while working on my router\/firewall, I found nothing that provided a clue as to why this is so. I discovered that this problem exists on hosts with newly installed Fedora 36 without any of the changes and post-installation configuration that I always perform as well as those with those changes. I do plan to keep investigating. I also plan to submit a bug report to Red Hat so that there might be a true fix to this instead of my simple circumvention.<\/p>\n\n\n\n
This circumvention does not depend upon the existence of any NIC configuration files \u2014 either the old-style interface configuration files that used to be located in \/etc\/sysconfig\/network-scripts, or the newer NetworkManager interface connection files that would be located in the \/etc\/NetworkManager\/system-connections directory. It works with or without those files. The result is global for all network interfaces on the host.<\/p>\n\n\n\n
This is a somewhat general solution that is used in lieu of the old rc.local script of the old SystemV startup days. It can also be used for running other local tasks shortly after startup. When a permanent fix becomes available from Red Hat I can leave all of this in place and just remove the specific sections for this fix from the MyStartup.sh script. If there are no local startup tasks I can either let the service run at startup as it doesn\u2019t interfere with the normal startup or operations of the host, or I can disable this service until it is needed again.<\/p>\n\n\n\n
I plan to continue testing to determine how much shorter I can make the sleep time. Take some time to think about the implications of needing this sleep time to make it work at all \u2013 I did.<\/p>\n","protected":false},"excerpt":{"rendered":"
IPV6 is a good thing for the Internet in general, but I find it unnecessarily complex for use in most home, and small- to medium-size businesses. Like many others, I continue use private IPV4 IP ranges for my own internal…<\/p>\n
Read more →<\/a><\/p>\n","protected":false},"author":2,"featured_media":0,"parent":2004,"menu_order":3,"comment_status":"closed","ping_status":"closed","template":"","meta":{"footnotes":""},"class_list":["post-6178","page","type-page","status-publish","hentry"],"_links":{"self":[{"href":"http:\/\/www.linux-databook.info\/index.php?rest_route=\/wp\/v2\/pages\/6178","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/www.linux-databook.info\/index.php?rest_route=\/wp\/v2\/pages"}],"about":[{"href":"http:\/\/www.linux-databook.info\/index.php?rest_route=\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"http:\/\/www.linux-databook.info\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"http:\/\/www.linux-databook.info\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=6178"}],"version-history":[{"count":16,"href":"http:\/\/www.linux-databook.info\/index.php?rest_route=\/wp\/v2\/pages\/6178\/revisions"}],"predecessor-version":[{"id":6197,"href":"http:\/\/www.linux-databook.info\/index.php?rest_route=\/wp\/v2\/pages\/6178\/revisions\/6197"}],"up":[{"embeddable":true,"href":"http:\/\/www.linux-databook.info\/index.php?rest_route=\/wp\/v2\/pages\/2004"}],"wp:attachment":[{"href":"http:\/\/www.linux-databook.info\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=6178"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}