3 ms·

In your /etc/sysctl.d/local.conf: net.ipv6.conf.default.accept_dad=0 net.ipv6.conf.default.accept_ra=0 net.ipv6.conf.default.autoconf=0 Or, in your netw

by teddyh 2y ago

In your /etc/sysctl.d/local.conf: net.ipv6.conf.default.accept_dad=0 net.ipv6.conf.default.accept_ra=0 net.ipv6.conf.default.autoconf=0 Or, in your network startup script (like Debian’s /etc/network/interfaces): sysctl -w net.ipv6.conf.default.accept_dad=0 sysctl -w net.ipv6.conf.default.accept_ra=0 sysctl -w net.ipv6.conf.default.autoconf=0 Or, in your /etc/systemd/network/en0whatever.network: [Network] IPv6AcceptRA=false IPv6DuplicateAddressDetection=0

Dagger2 2y ago
Only accept_ra=0 is actually needed for static config. autoconf is de-facto disabled if RAs aren't being processed, and DAD is a separate thing (but relevant to the grandparent since it takes a few seconds to finish). Although I'd also argue that you should prefer automatic config over static in general. RAs can set your default route correctly and you can use `ip token` if you really need SLAAC to give you a specific address. I think it's better to be able to just connect machines and have them get the right config rather than need to hand-craft it on each one.
- JoshTriplett 2y ago
  For most cases I agree that automatic configuration is the right answer. In this case I'm bringing up virtual machines, as fast as possible, and static is inherently faster and more predictable. Automatic configuration isn't compatible with literally counting milliseconds.
  - teddyh 2y ago
    If you don’t need link-local addresses, have you tried these? LinkLocalAddressing=no and/or sysctl -w net.ipv6.conf.default.addr_gen_mode=1
    - JoshTriplett 2y ago
      Interesting! I'll look into those, those look helpful.
- teddyh 2y ago
  I don’t want to trust the network. The network is never secure. Therefore, I don’t want the server to trust any self-proclaimed router with what IP address the server should use. As far as I know, there is no IPsec for RA packets.
  - tremon 2y ago
    Fine, then don't connect to it. Nobody's making you.
  - icedchai 2y ago
    There's always static IPs. Do you trust DHCP on v4?
JoshTriplett 2y ago
I've previously found and used all three of those, and those help but don't seem to suffice. There's still some degree to which the configuration seems unreliable, and doesn't settle down for a few seconds. (I appreciate the confirmation of those settings, though, and those are all an important part of the setup.)
nottorp 2y ago
Now how do you do it on your phone or windows laptop? :) What if you have multiple internet connections and you want to choose which one you go through? With ipv4 and nat you can just change the default route. And you don't even need to write down the router's address since it's <your prefix for the whole network> dot one number.

by teddyh 2y ago

Dagger2 2y ago

Only accept_ra=0 is actually needed for static config. autoconf is de-facto disabled if RAs aren't being processed, and DAD is a separate thing (but relevant to the grandparent since it takes a few seconds to finish). Although I'd also argue that you should prefer automatic config over static in general. RAs can set your default route correctly and you can use `ip token` if you really need SLAAC to give you a specific address. I think it's better to be able to just connect machines and have them get the right config rather than need to hand-craft it on each one.

JoshTriplett 2y ago
For most cases I agree that automatic configuration is the right answer. In this case I'm bringing up virtual machines, as fast as possible, and static is inherently faster and more predictable. Automatic configuration isn't compatible with literally counting milliseconds.
- teddyh 2y ago
  If you don’t need link-local addresses, have you tried these? LinkLocalAddressing=no and/or sysctl -w net.ipv6.conf.default.addr_gen_mode=1
  - JoshTriplett 2y ago
    Interesting! I'll look into those, those look helpful.
teddyh 2y ago
I don’t want to trust the network. The network is never secure. Therefore, I don’t want the server to trust any self-proclaimed router with what IP address the server should use. As far as I know, there is no IPsec for RA packets.
- tremon 2y ago
  Fine, then don't connect to it. Nobody's making you.
- icedchai 2y ago
  There's always static IPs. Do you trust DHCP on v4?

JoshTriplett 2y ago

I've previously found and used all three of those, and those help but don't seem to suffice. There's still some degree to which the configuration seems unreliable, and doesn't settle down for a few seconds. (I appreciate the confirmation of those settings, though, and those are all an important part of the setup.)

nottorp 2y ago

Now how do you do it on your phone or windows laptop? :) What if you have multiple internet connections and you want to choose which one you go through? With ipv4 and nat you can just change the default route. And you don't even need to write down the router's address since it's <your prefix for the whole network> dot one number.