Thanks @dios, I found it out now.
For all, who are interested in:
You need to edit /boot/boot.cmd and add “ipv6.disable=1” to the lines which set the bootargs. Don’t know, which of both is actually used.
Then mkimage as noted at the end of boot.cmd file, reboot and all tcp6 and upd6 references in netstat output are gone.
Hi folks,
i found a nice feature for unbound itself make the possibility a little smaller for certain software to build ipv6 tunnels in ipv4 or make ipv6 connection by them self. I found a program which catches all or mostly all DNS querys and saw some ipv6 addresses even all ipv6 is deactivated. So why and from where they come?
Simple Question, easy answer, unbound gives you A records as also AAAA Records if they exists.
Then I read a that unbound has the option to filter the DNS response for the clients.
So i added the file /etc/unbound/local.d/ipv6filter.conf
server:
private-address : ::/0
No longer unbound give a respond with AAAA Records.
Why is this option not set in unbound as default for ipfire?
The option do-ip6: no only say that no DNS Server is asked on his ipv6 address, but the ipv4 DNS Server will give both A and AAAA Records.
Hopefully this helps a bit till we reach the ipv6 firewall in ipfire.
Best Regards
Hi folks,
Well, right before we switched from Unbound to Knot Resolver, I discovered this cool feature: when the DNS server’s response included an IPv6 address, Unbound would filter it out of the response. I keep noticing that some programs; especially the fu… Chrome browser; try to bypass all the rules using an IPv6 connection.
I think this feature (filter unwanted AAAA records from the response, also we asked only for A records, because same servers will still answer with both query) is one of the most important ones, if you don’t route IPv6 on your internal network and therefore haven’t set up a firewall for it (Ipfire is also ipv4 only). I really miss this option now.
Can anyone tell me, if the Knot Resolver also has such a filter option and point me to the relevant section in the manual and give me a hint where on Ipfire i had to work in the options ?
Unfortunately, I’m not really getting anywhere with this guide; because I did not find the counterpart on ipfire, I need some help or warm words to getting started.
Or, put another way, how have you solved the problem of more and more apps simply opening their own IPv6 network interface and thus trying to communicate unnoticed, bypassing any restrictions?
I surely can’t be the only one who’s noticed this behavior.
cheers and peace