[SOLVED] IPv6 Privacy Extensions not working?

esuhl · 2021-01-15 17:50:29

I just noticed that my public IPv6 address uses EUI-64, exposing my MAC address. This is on a PC connected to a consumer ISP router via Ethernet.

So I followed the wiki to enable IPv6 Privacy Extensions. I use systemd-networkd, so I also added the "kernel" value to IPv6PrivacyExtensions in the .network file (and rebooted).

However, my IP addresses are still based on my MAC. :-/ Also, I don't get any "temporary" IPv6 addresses assigned... :-/

Can anyone suggest what I might be doing wrong?

Cheers :-)

===========================================================

$ ls /sys/class/net
lo  net0

/etc/systemd/network/20-wired.network:
--------------------------------------
[Match]
Name=net0

[Network]
DHCP=yes
IPv6PrivacyExtensions=kernel

/etc/sysctl.d/40-ipv6.conf:
---------------------------
# Enable IPv6 Privacy Extensions
net.ipv6.conf.all.use_tempaddr = 2
net.ipv6.conf.default.use_tempaddr = 2
net.ipv6.conf.net0.use_tempaddr = 2

In the following, I have obfuscated the last half of my MAC/EUI-64 addresses with X's:

/etc/udev/rules.d/10-network.rules:
-----------------------------------
# Change the default name of the ethernet device as it changes names when IDE drives are enabled/disabled in the BIOS
SUBSYSTEM=="net", ACTION=="add", ATTR{address}=="00:26:18:XX:XX:XX", NAME="net0"

$ ip addr
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: net0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1492 qdisc fq_codel state UP group default qlen 1000
    link/ether 00:26:18:XX:XX:XX brd ff:ff:ff:ff:ff:ff
    altname enp5s0
    inet 192.168.1.10/24 brd 192.168.1.255 scope global dynamic net0
       valid_lft 81576sec preferred_lft 81576sec
    inet6 2a02:c7f:d451:7d00:226:18ff:feXX:XXXX/64 scope global dynamic mngtmpaddr noprefixroute 
       valid_lft 1810sec preferred_lft 1809sec
    inet6 fd59:4827:9fed:0:226:18ff:feXX:XXXX/64 scope global mngtmpaddr noprefixroute 
       valid_lft forever preferred_lft forever
    inet6 fe80::226:18ff:feXX:XXXX/64 scope link 
       valid_lft forever preferred_lft forever

Last edited by esuhl (2021-01-16 23:17:40)

esuhl · 2021-01-16 07:29:59

Hmm... I think I've found the cause of the issue.

For some reason the last line of my /etc/sysctl.d/40-ipv6.conf file (see above) isn't being applied, although the others are, and I can set the last one manually:

$ sysctl net.ipv6.conf.all.use_tempaddr
net.ipv6.conf.all.use_tempaddr = 2

$ sysctl net.ipv6.conf.default.use_tempaddr
net.ipv6.conf.default.use_tempaddr = 2

$ sysctl net.ipv6.conf.net0.use_tempaddr
net.ipv6.conf.net0.use_tempaddr = -1

$ sudo sysctl net.ipv6.conf.net0.use_tempaddr=2
net.ipv6.conf.net0.use_tempaddr = 2

If I then take the network down/up, I have a temporary Global (2a02:...) ULA (fd59:...) address that seem* to correctly be using Privacy Extensions. :-)

--------------------
What's the best way to "fix" (automate) this? Can I fix the 40-ipv6.conf file somehow, or troubleshoot the reason that the setting isn't being applied...?
--------------------
* - Alongside the private Global and ULA "temporary" addresses, I still have a Global, ULA and Link Local address that are all using EUI-64 (based on MAC address). Am I right in thinking that only the temporary addresses will be made public, and this is "IPv6 with Privacy Extensions" working correctly?

I only ask because, when I boot into Windows 7, none of my IPv6 addresses use EUI-64. :-/
--------------------

Cheers :-)

progandy · 2021-01-16 08:15:47

One solution might be to tell systemd to always enable the privacy extensions: "IPv6PrivacyExtensions=yes"

esuhl · 2021-01-16 21:10:12

progandy wrote:

One solution might be to tell systemd to always enable the privacy extensions: "IPv6PrivacyExtensions=yes"

Ah -yes! Thank you! I must have misunderstood the wiki. With that setting, I now get temporary non-EUI-64 addresses. :-)

However, unlike when I boot to Windows 7, I still get a set of non-temporary EUI-64 addresses. Is that to be expected? Can I/should I try to use non-EUI addresses for them as well?

Thanks again :-)

esuhl · 2021-01-16 23:17:13

esuhl wrote:

However, unlike when I boot to Windows 7, I still get a set of non-temporary EUI-64 addresses. Is that to be expected? Can I/should I try to use non-EUI addresses for them as well?

Well, I tried MAC spoofing, and now none of my IPv6 addresses use EUI-64:
https://wiki.archlinux.org/index.php/MA … s_spoofing

Brilliant! Thanks again for your help -- marking this "solved"! :-)

Arch Linux

#1 2021-01-15 17:50:29

[SOLVED] IPv6 Privacy Extensions not working?

#2 2021-01-16 07:29:59

Re: [SOLVED] IPv6 Privacy Extensions not working?

#3 2021-01-16 08:15:47

Re: [SOLVED] IPv6 Privacy Extensions not working?

#4 2021-01-16 21:10:12

Re: [SOLVED] IPv6 Privacy Extensions not working?

#5 2021-01-16 23:17:13

Re: [SOLVED] IPv6 Privacy Extensions not working?

Board footer