Is there a way to disable ipv6 in NetworkManager by default?

User Support General
1

Hi all,
is there a way to make NetworkManager fire up with ivp6 disabled. Currently whenever I am connecting to a new WIFI-Network ipv6 is set to automatic. I´d rather have it disabled when connecting.
I tried to tinker with the NetworkManager.conf and included the following:

[connection]
ipv6.method=disable

Unfortunately it did not do the trick. I am using debian12-template for my qube holding the wifi adapter.

1 Like
2

hi,

you could use this command to completely disable IPv6 in the qube.

sudo sysctl -w net.ipv6.conf.all.disable_ipv6=1
2 Likes
3

For good measure, run also:

sudo sysctl -w net.ipv6.conf.default.disable_ipv6=1

(this stops IPv6 from being enabled on further interfaces that may appear, e.g. a USB dongle ).

2 Likes
4

Thanks! I think it’s that sysctl I was looking for initially, there are so many of them about IPv6 :sweat:

2 Likes
5

An easier way would be to use kernelopts to disable ipv6 completely. No change to the original template is required:

qvm-prefs sys-net kernelopts ipv6.disable=1
3 Likes
6

DVM´s solution seems the way to go - works very smoothly. Networkmanager does not show ipv6 in the interface anymore although it is still set to “automatic” in the ipv6 section. Unfortunately solene´s and barto´s solution do not achieve the desired effect. The Networkmanager still shows an ipv6 for the interface.

4 Likes
7

And what is the difference between above solution

qvm-prefs sys-net kernelopts ipv6.disable=1

and docs mentioning

qvm-features sys-net ipv6 0
qvm-features sys-net ipv6 ''

? Does the first disable IPv6 only for sys-net, and in contrast qvm-features propagates down to all appVMs using sys-net?

What lead me here:
I noticed, my Mullvad VPN proxyVM has lots ip6 qubes nft firewall rules and I’d like to completely disable IPv6 for peace of mind with leaking and to de-clutter rules. Then, what command to use preferrably (knowing, there are Mullvad VPN app settings to disable IPv6, but I’d like to disable it for whole system)?

8

Using the “kernelopts” is really disabling ipv6 in the sys-net kernel, and makes it impossible to re-enable at run-time by a malicious (or maybe just “too smart”) program.

9

Thanks. In contrast qvm-features sys-net ipv6 0 doesn’t change kernel opts (there was no change in qube settings), this seems to be a qubes-internal network setting. But not sure, how it works.

What surprised me, that even with qvm-features <vm> ipv6 0, I got an IPv6 with qubesdb-read /qubes-ip6 within that qube - also tried this setting from a netvm to propagate. And no matter, if disabling ipv6 in kernel or this setting, nftables entries for ip6 qubes are created anyway, so cleanup of firewall rules is not possible I guess.

10

And they don’t (and can’t) harm, right?
I guess that a check for the ipv6 support was deemed an useless effort, and I mostly agree with that stance.

1 Like