4 ms·

I strongly suggest that you use something like Network Namespaces through Vopono[0] or Gluetun[1] if you use a commercial VPN for "privacy" or "security" aka to

I strongly suggest that you use something like Network Namespaces through Vopono[0] or Gluetun[1] if you use a commercial VPN for "privacy" or "security" aka torrenting and shitposting. Relying on these clients is always a gamble and if your software (Browser, Torrentclient, etc.) cannot know you public IP only the internal IP of the VPN you are also safe against some exploits and misconfigurations a desktop client won't protect you against. [0] https://github.com/jamesmcm/vopono https://github.com/jamesmcm/vopono [1] https://github.com/qdm12/gluetun https://github.com/qdm12/gluetun

nikanj 1y ago
I strongly suggest you disable ipv6, as nothing will break by disabling it but many things break with it enabled.
- indigo945 1y ago
  Alternatively, disable ipv4. The same statement holds true.
  - ZiiS 1y ago
    Unfortunately this is not true, loads of cool techy stuff (Sentry, GitHub) etc still don't work properly on IPv6, less techy stuff really didn't care at all.
    - zokier 1y ago
      You can use nat64 to talk to legacy networks. Ipv6-only networks (with nat64 or 464xlat etc) are becoming increasingly popular. There is also this new concept called "ipv6-mostly network" that is getting rolled out: https://www.ietf.org/archive/id/draft-ietf-v6ops-6mops-02.html https://www.ietf.org/archive/id/draft-ietf-v6ops-6mops-02.ht...
  - ta1243 1y ago
    Lots of things will break if you disable ipv4, including my work provided zscaler windows laptop (and not break in the good way where it fails open when you block traffic to zscaler nodes on your router) Very little will break if you disable ipv6
    - denkmoon 1y ago
      Enterprise malware not doing v6 properly hardly counts, it’s a good day for them when they don’t just bsod your entire network.
    - mrweasel 1y ago
      A lot of stuff breaks when you run Zscaler.
      - ta1243 1y ago
        Absolutely, yet it's a requirement for many people.
- lxgr 1y ago
  That's not true anymore. IPv6 allows for more direct connections for services like VoIP or Tailscale, since UDP hole punching between two firewalled public IPv6 addresses usually just works, but doesn't between two clients both behind a "port-restricted cone" or "symmetric" NAT. As a result, connections have to be relayed, which increases latency and is just outright infeasible for some non-profit services that don't have a budget for relaying everyone's traffic. Anecdotally, I've also heard that you can get better routing via IPv6 on IPv4-via-NAT-only providers these days, as the provider's CG-NAT might be topologically farther away than the IPv6 server you're connecting to.
- mrweasel 1y ago
  That's not really true anymore. I've used a connection with both IPv4 and 6 for the past two years. There's a number of times where my stuff magically works, whiles others have issues, because my traffic is mostly over IPv6. Not once have I had an issue because my setup is dual stacked.
  - patrakov 1y ago
    This is still true for ISPs that don't monitor their IPv6 connectivity. I was forced to disable IPv6 recently because of this: https://www.reddit.com/r/ipv6/comments/1nf3ytq/how_do_i_complain_about_partial_ipv6_connectivity/ https://www.reddit.com/r/ipv6/comments/1nf3ytq/how_do_i_comp... And before you say "change the ISP": Globe is the only one that does not refuse to provide services to foreigners and does not lock you up into a 24-month non-cancellable contract, which is longer than any available non-resident visa.
    - mrweasel 1y ago
      That's not really an IPv6 issue, but an ISP issue. My old ISP didn't monitor anything and relies on customers to call them up and explain that their connection is down. Sometimes tell them that their connection to entire towns are down, because they don't know. I'm fairly fortunate that my ISP not only offers IPv6, but also knows how to run their network. Denmark has plenty of ISP that doesn't provide IPv6, don't know how to run a network or some many cases both.
Varelion 1y ago
Wouldn't blocking IPv6 and using a kill-switch prevent leaking?
- IlikeKitties 1y ago
  No, not in all cases. Imagine your Browser gets 0-dayed and just send all IPs it sees to an endpoint.
  - Varelion 1y ago
    Noob here. If this happened, wouldn't any type of layering of network solutions ultimately result in this leaking all the same though?
    - IlikeKitties 1y ago
      No. The Browser or torrent prozess is sandboxed and can only see the VPN Network interface. The other interfaces are hidden.
- Denatonium 1y ago
  In the case of PureVPN, the only way of preventing leaks is by switching to a different provider. There is definitive proof that they keep logs despite their claims to the contrary. I have linked to a federal criminal complaint where the FBI requested logs after the offense and was given them by PureVPN. The relevant portion is on page 22. https://www.justice.gov/archives/opa/press-release/file/1001841/dl https://www.justice.gov/archives/opa/press-release/file/1001...
- fulafel 1y ago
  Block IPv4 as well and you're pretty solid.

nikanj 1y ago

I strongly suggest you disable ipv6, as nothing will break by disabling it but many things break with it enabled.

indigo945 1y ago
Alternatively, disable ipv4. The same statement holds true.
- ZiiS 1y ago
  Unfortunately this is not true, loads of cool techy stuff (Sentry, GitHub) etc still don't work properly on IPv6, less techy stuff really didn't care at all.
  - zokier 1y ago
    You can use nat64 to talk to legacy networks. Ipv6-only networks (with nat64 or 464xlat etc) are becoming increasingly popular. There is also this new concept called "ipv6-mostly network" that is getting rolled out: https://www.ietf.org/archive/id/draft-ietf-v6ops-6mops-02.html https://www.ietf.org/archive/id/draft-ietf-v6ops-6mops-02.ht...
- ta1243 1y ago
  Lots of things will break if you disable ipv4, including my work provided zscaler windows laptop (and not break in the good way where it fails open when you block traffic to zscaler nodes on your router) Very little will break if you disable ipv6
  - denkmoon 1y ago
    Enterprise malware not doing v6 properly hardly counts, it’s a good day for them when they don’t just bsod your entire network.
  - mrweasel 1y ago
    A lot of stuff breaks when you run Zscaler.
    - ta1243 1y ago
      Absolutely, yet it's a requirement for many people.
lxgr 1y ago
That's not true anymore. IPv6 allows for more direct connections for services like VoIP or Tailscale, since UDP hole punching between two firewalled public IPv6 addresses usually just works, but doesn't between two clients both behind a "port-restricted cone" or "symmetric" NAT. As a result, connections have to be relayed, which increases latency and is just outright infeasible for some non-profit services that don't have a budget for relaying everyone's traffic. Anecdotally, I've also heard that you can get better routing via IPv6 on IPv4-via-NAT-only providers these days, as the provider's CG-NAT might be topologically farther away than the IPv6 server you're connecting to.
mrweasel 1y ago
That's not really true anymore. I've used a connection with both IPv4 and 6 for the past two years. There's a number of times where my stuff magically works, whiles others have issues, because my traffic is mostly over IPv6. Not once have I had an issue because my setup is dual stacked.
- patrakov 1y ago
  This is still true for ISPs that don't monitor their IPv6 connectivity. I was forced to disable IPv6 recently because of this: https://www.reddit.com/r/ipv6/comments/1nf3ytq/how_do_i_complain_about_partial_ipv6_connectivity/ https://www.reddit.com/r/ipv6/comments/1nf3ytq/how_do_i_comp... And before you say "change the ISP": Globe is the only one that does not refuse to provide services to foreigners and does not lock you up into a 24-month non-cancellable contract, which is longer than any available non-resident visa.
  - mrweasel 1y ago
    That's not really an IPv6 issue, but an ISP issue. My old ISP didn't monitor anything and relies on customers to call them up and explain that their connection is down. Sometimes tell them that their connection to entire towns are down, because they don't know. I'm fairly fortunate that my ISP not only offers IPv6, but also knows how to run their network. Denmark has plenty of ISP that doesn't provide IPv6, don't know how to run a network or some many cases both.

Varelion 1y ago

Wouldn't blocking IPv6 and using a kill-switch prevent leaking?

IlikeKitties 1y ago
No, not in all cases. Imagine your Browser gets 0-dayed and just send all IPs it sees to an endpoint.
- Varelion 1y ago
  Noob here. If this happened, wouldn't any type of layering of network solutions ultimately result in this leaking all the same though?
  - IlikeKitties 1y ago
    No. The Browser or torrent prozess is sandboxed and can only see the VPN Network interface. The other interfaces are hidden.
Denatonium 1y ago
In the case of PureVPN, the only way of preventing leaks is by switching to a different provider. There is definitive proof that they keep logs despite their claims to the contrary. I have linked to a federal criminal complaint where the FBI requested logs after the offense and was given them by PureVPN. The relevant portion is on page 22. https://www.justice.gov/archives/opa/press-release/file/1001841/dl https://www.justice.gov/archives/opa/press-release/file/1001...
fulafel 1y ago
Block IPv4 as well and you're pretty solid.