diff --git a/LDP/users/Peter-Bieringer/Linux+IPv6-HOWTO.html b/LDP/users/Peter-Bieringer/Linux+IPv6-HOWTO.html index 89f2635d..f1f07c85 100644 --- a/LDP/users/Peter-Bieringer/Linux+IPv6-HOWTO.html +++ b/LDP/users/Peter-Bieringer/Linux+IPv6-HOWTO.html @@ -62,7 +62,7 @@ ALIGN="LEFT" >Revision 0.66wip2014-05-132014-05-15Revised by: PBRemoving an IPv6 address
6.4. Automatic IPv6 Address Configuration
6.5. Enable Privacy Extension
7.1. Displaying existing IPv6 routes
7.2. Add an IPv6 route through a gateway
7.3. Removing an IPv6 route through a gateway
7.4. Add an IPv6 route through an interface
7.5. Removing an IPv6 route through an interface
7.6. FAQ for IPv6 routes
8.1. Displaying neighbors using “ip”
8.2. Manipulating neighbors table using “ip”
9.1. Types of tunnels
9.2. Displaying existing tunnels
10.1. Displaying existing tunnels
10.2. Setup of point-to-point tunnel
10.3. Removing point-to-point tunnels
11.1. How to access the /proc-filesystem
14.1. Server socket binding
15.1. Red Hat Linux and “clones”
15.2. SuSE Linux
16.1. Stateless auto-configuration out-of-the-box
16.2. Stateless auto-configuration using Router Advertisement Daemon (radvd)
16.3. Dynamic Host Configuration Protocol v6 (DHCPv6)
17.1. Common information
18.2. Preparation
18.3. Usage of ip6tables
18.5. Firewalling using nftables
19.1. Node security
19.2. Access limitations
20.1. Modes of using encryption and authentication
20.2. Support in kernel (ESP and AH)
20.3. Automatic key exchange (IKE)
20.4. Additional informations:
21.1. General
21.2. Linux QoS using “tc”
23.2. Other programming languages
25.4. IPv6 Infrastructure
26. Revision history / Credits / The End
26.3. The End

6.4. Automatic IPv6 Address Configuration

In case, a Router Advertisement is received by a client, in case IPv6 autoconfiguration is enabled, the client configures itself an IPv6 address according to the prefix contained in the advertisement (see also Section 22.4).

6.5. Enable Privacy Extension

Privacy Extension as described in RFC 4941 / Privacy Extensions for Stateless Address Autoconfiguration in IPv6 (obsoleted RFC 3041) is replacing the static interface ID (mostly based on word-wide unique MAC address) used during autoconfiguration by a pseudo-random one and generating from time to time a new one deprecating the old one.

6.5.1. Enable Privacy Extension using sysctl

Temporary activation

Enable privacy extension for e.g. interface “eth0” and prefer the generated address:

# sysctl -w net.ipv6.conf.eth0.use_tempaddr=2

Afterwards, restart of the interface is necessary

# ip link set dev eth0 down
+# ip link set dev eth0 up

Once a router advertisement is received, the result should look like following

# ip -6 addr show dev eth0
+2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qlen 1000
+    inet6 2001:db8:0:1:8992:3c03:d6e2:ed72/64 scope global secondary dynamic   <- pseudo-random IID
+       valid_lft 604711sec preferred_lft 86311sec
+    inet6 2001:db8:0:1::224:21ff:fe01:2345/64 scope global     <- IID based on MAC
+       valid_lft 604711sec preferred_lft 86311sec
+    ...

Permanent activation

For permanent activation, either a special initscript value per interface will enable privacy or an entry in the /etc/sysctl.conf file like

net.ipv6.conf.eth0.use_tempaddr=2

Note: interface must already exists with proper name when sysctl.conf is applied. If this is not the case (udev or delayed initialization) one has to configure privacy for all interfaces by default:

net.ipv6.conf.all.use_tempaddr=2
+net.ipv6.conf.default.use_tempaddr=2

Values can be activated during runtime, but at least an interface down/up or a reboot is recommended.

# sysctl -p

6.5.2. Enable Privacy Extension using NetworkManager

Modern (client) systems are using NetworkManager (here: version 0.9.9.1-5.git20140319.fc21) for configuring interfaces. A command line tool is built-in which can be used to change settings which are not available via GUI.

Check existing interfaces with:

# nmcli connection 
+NAME UUID TYPE DEVICE
+ens4v1 d0fc2b2e-5fa0-4675-96b5-b723ca5c46db 802-3-ethernet ens4v1

Current amount of IPv6 privacy extension addresses can be checked with

# ip -o addr show dev ens4v1 | grep temporary | wc -l
+0

Current IPv6 privacy extension settings can be checked with

# nmcli connection show ens4v1 |grep ip6-privacy
+ipv6.ip6-privacy: -1 (unknown)

Enable IPv6 privacy extension and restart interface

# nmcli connection modify ens4v1 ipv6.ip6-privacy 2
+# nmcli connection down ens4v1; nmcli connection up ens4v1

New IPv6 privacy extension settings can be checked with

# nmcli connection show ens4v1 |grep ip6-privacy
+ipv6.ip6-privacy: 2 (active, prefer temporary IP)

Now IPv6 privacy extension addresses are configured on the interface

# ip -o addr show dev ens4v1 | grep temporary | wc -l
+2

6.5.3. Test real use of Privacy Extension

Whether the IPv6 address with an Interface ID generated by Privacy Extension is really used for outgoing connections, one can browse to http://ip.bieringer.de/, in case EUI64_SCOPE shows “iid-privacy”, then everything is working fine.

7.1. Displaying existing IPv6 routes

7.1.1. Using "ip"

7.1.2. Using "route"

7.2. Add an IPv6 route through a gateway

7.2.1. Using "ip"

7.2.2. Using "route"

7.3. Removing an IPv6 route through a gateway

7.3.1. Using "ip"

7.3.2. Using "route"

7.4. Add an IPv6 route through an interface

7.4.1. Using "ip"

7.4.2. Using "route"

7.5. Removing an IPv6 route through an interface

7.5.1. Using "ip"

7.5.2. Using "route"

7.6. FAQ for IPv6 routes

7.6.1. Support of an IPv6 default route

7.6.1.1. Clients (not routing any packet!)

7.6.1.2. Routers in case of packet forwarding

8.1. Displaying neighbors using “ip”

8.2. Manipulating neighbors table using “ip”

8.2.1. Manually add an entry

8.2.2. Manually delete an entry

8.2.3. More advanced settings

9.1. Types of tunnels

9.1.1. Static point-to-point tunneling

9.1.2. Automatically tunneling

9.1.3.1. Generation of 6to4 prefix

9.1.3.2. 6to4 upstream tunneling

9.1.3.3. 6to4 downstream tunneling

9.1.3.4. Possible 6to4 traffic

9.1.4. UDP encapsulated IPv6 tunneling

9.1.4.1. Teredo Tunnel

9.1.4.2. AYIYA Tunnel

9.1.4.3. gogo6 Tunnel

9.2. Displaying existing tunnels

9.2.1. Using "ip"

9.2.2. Using "route"

9.3.1. Add point-to-point tunnels

9.3.1.1. Using "ip"

9.3.1.2. Using "ifconfig" and "route" (deprecated)

9.3.1.3. Using "route" only

9.3.2. Removing point-to-point tunnels

9.3.2.1. Using "ip"

9.3.2.2. Using "ifconfig" and "route" (deprecated because not very funny)

9.3.2.3. Using "route"

9.3.3. Numbered point-to-point tunnels

9.4.1. Add a 6to4 tunnel

9.4.1.1. Using "ip" and a dedicated tunnel device

9.4.1.2. Using "ifconfig" and "route" and generic tunnel device “sit0” (deprecated)

9.4.2. Remove a 6to4 tunnel

9.4.2.1. Using "ip" and a dedicated tunnel device

9.4.2.2. Using “ifconfig” and “route” and generic tunnel device “sit0” (deprecated)

10.1. Displaying existing tunnels

10.2. Setup of point-to-point tunnel

10.3. Removing point-to-point tunnels

11.1. How to access the /proc-filesystem

11.1.1. Using “cat” and “echo”

11.1.1.1. Retrieving a value

11.1.1.2. Setting a value

11.1.2. Using “sysctl”

11.1.2.1. Retrieving a value

11.1.2.2. Setting a value

11.1.2.3. Additionals

11.1.3. Values found in /proc-filesystems

11.2.1. conf/default/*

11.2.2. conf/all/*

11.2.2.1. conf/all/forwarding

11.2.3. conf/interface/*

11.2.3.1. accept_ra

11.2.3.2. accept_redirects

11.2.3.3. autoconf

11.2.3.4. dad_transmits

11.2.3.5. forwarding

11.2.3.6. hop_limit

11.2.3.7. mtu

11.2.3.8. router_solicitation_delay

11.2.3.9. router_solicitation_interval

11.2.3.10. router_solicitations

11.2.4. neigh/default/*

11.2.4.1. gc_thresh1

11.2.4.2. gc_thresh2

11.2.4.3. gc_thresh3

11.2.4.4. gc_interval

11.2.5. neigh/interface/*

11.2.5.1. anycast_delay

11.2.5.2. gc_stale_time

11.2.5.3. proxy_qlen

11.2.5.4. unres_qlen

11.2.5.5. app_solicit

11.2.5.6. locktime

11.2.5.7. retrans_time

11.2.5.8. base_reachable_time

11.2.5.9. mcast_solicit

11.2.5.10. ucast_solicit

11.2.5.11. delay_first_probe_time

11.2.5.12. proxy_delay

11.2.6. route/*

11.2.6.1. flush

11.2.6.2. gc_interval

11.2.6.3. gc_thresh

11.2.6.4. mtu_expires

11.2.6.5. gc_elasticity

11.2.6.6. gc_min_interval

11.2.6.7. gc_timeout

11.2.6.8. min_adv_mss

11.2.6.9. max_size

11.3.1. ip_*

11.3.1.1. ip_local_port_range

11.3.2. tcp_*

11.3.3. icmp_*

11.3.4. others

11.4.1. if_inet6

11.4.2. ipv6_route

11.4.3. sockstat6

11.4.4. tcp6

11.4.5. udp6

11.4.6. igmp6

11.4.7. raw6

11.4.8. ip6_flowlabel

11.4.9. rt6_stats

11.4.10. snmp6

11.4.11. ip6_tables_names

Address Resolver & Destination Address Selection

Source Address Selection

Source Address Selection with “ip addrlabel”

14.1. Server socket binding

14.1.1. Using “netstat” for server socket binding check

14.2.1. Router discovery

14.2.1.1. Router advertisement

14.2.1.2. Router solicitation

14.2.2. Neighbor discovery

14.2.2.1. Neighbor discovery solicitation for duplicate address detection

14.2.2.2. Neighbor discovery solicitation for looking for host or gateway

15.1. Red Hat Linux and “clones”

15.1.1. Test for IPv6 support of network configuration scripts

15.1.2. Short hint for enabling IPv6 on current RHL 7.1, 7.2, 7.3, ...

15.2. SuSE Linux

15.2.1. SuSE Linux 7.3

15.2.2. SuSE Linux 8.0

15.2.2.1. IPv6 address configuration

15.2.2.2. Additional information

15.2.3. SuSE Linux 8.1

15.2.3.1. IPv6 address configuration

15.2.3.2. Additional information

15.3.1. Further information

16.1. Stateless auto-configuration out-of-the-box

16.2. Stateless auto-configuration using Router Advertisement Daemon (radvd)

16.3. Dynamic Host Configuration Protocol v6 (DHCPv6)

17.1. Common information

17.1.1. Node Mobility

17.1.2. Network Mobility

17.1.3. Links

18.1.1. More information

18.2. Preparation

18.2.1. Get sources

18.2.2. Extract sources

18.2.3. Apply latest iptables/IPv6-related patches to kernel source

18.2.4. Configure, build and install new kernel

18.2.5. Rebuild and install binaries of iptables

18.3. Usage of ip6tables

18.3.1. Check for support

18.3.2. Learn how to use ip6tables

18.3.2.1. List all IPv6 netfilter entries

18.3.2.2. List specified filter

18.3.2.3. Insert a log rule at the input filter with options

18.3.2.4. Insert a drop rule at the input filter

18.3.2.5. Delete a rule by number

18.3.2.6. Enable connection tracking

18.3.2.7. Allow ICMPv6

18.3.2.8. Rate-limiting

18.3.2.9. Allow incoming SSH

18.3.2.10. Enable tunneled IPv6-in-IPv4

18.3.2.11. Protection against incoming TCP connection requests

18.3.2.12. Protection against incoming UDP connection requests

18.3.3. Examples

18.3.3.1. Simple example for Fedora

18.3.3.2. Sophisticated example

18.4.1. IPv6 Masquerading

18.4.2. IPv6 Destination NAT

18.4.3. IPv6 Port Forwarding

18.5. Firewalling using nftables

18.5.1. Preparation for nftables usage

18.5.2. Basic nftables configuration

18.5.3. Simple filter policy with nftables using only table “inet”

18.5.3.1. Configuration

18.5.3.2. Result

18.5.3.3. Hints for logging

18.5.4. Filter policy with nftables using tables “ip”, “ip6” and “inet”

19.1. Node security

19.2. Access limitations

19.3.1. Legal issues

19.3.2. Security auditing using IPv6-enabled netcat

19.3.3. Security auditing using IPv6-enabled nmap

19.3.4. Security auditing using IPv6-enabled strobe

19.3.5. Security auditing using online tools

19.3.6. Audit results

20.1. Modes of using encryption and authentication

20.1.1. Transport mode

20.1.2. Tunnel mode

20.2. Support in kernel (ESP and AH)

20.2.1. Support in vanilla Linux kernel 2.4.x

20.2.2. Support in vanilla Linux kernel 2.6.x

20.3. Automatic key exchange (IKE)

20.3.1. IKE daemon “racoon”

20.3.1.1. Manipulation of the IPsec SA/SP database with the tool “setkey”

20.3.1.2. Configuration of the IKE daemon “racoon”

20.3.1.3. Running IPsec with IKE daemon “racoon”

20.3.2. IKE daemon “pluto”

20.3.2.1. Configuration of the IKE daemon “pluto”

20.3.2.2. Running IPsec with IKE daemon “pluto”

20.4. Additional informations:

21.1. General

21.2. Linux QoS using “tc”

21.2.1. Example for a constant bitrate queuing

21.2.1.1. Root qdisc definition

21.2.1.2. QoS class definition

21.2.1.3. QoS filter definition

21.2.1.4. Testing filter definitions using iperf

22.1.1. Listening on IPv6 addresses

22.1.1.1. Enable BIND named for listening on IPv6 address

22.1.1.2. Disable BIND named for listening on IPv6 address

22.1.2. IPv6 enabled Access Control Lists (ACL)

22.1.3. Sending queries with dedicated IPv6 address

22.1.4. Per zone defined dedicated IPv6 addresses

22.1.4.1. Transfer source address

22.1.4.2. Notify source address

22.1.5. IPv6 DNS zone files examples

22.1.6. Serving IPv6 related DNS data

22.1.6.1. Current best practice

22.1.7. Checking IPv6-enabled connect

22.1.7.1. IPv6 connect, but denied by ACL

22.1.7.2. Successful IPv6 connect

22.3.1. Listening on IPv6 addresses

22.3.1.1. Virtual host listen on an IPv6 address only

22.3.1.2. Virtual host listen on an IPv6 and on an IPv4 address

22.3.1.3. Additional notes

22.4.1. Configuring radvd

22.4.1.1. Simple configuration

22.4.1.2. Special 6to4 configuration

22.4.2. Debugging

22.5.1. Configuration of the DHCPv6 server (dhcp6s)

22.5.1.1. Simple configuration

22.5.2. Configuration of the DHCPv6 client (dhcp6c)

22.5.2.1. Simple configuration

22.5.3. Usage

22.5.3.1. dhcpv6_server

22.5.3.2. dhcpv6_client

22.5.4. Debugging

22.5.4.1. dhcpv6_server

22.5.4.2. dhcpv6_client

22.6.1. Configuration of the ISC DHCP server for IPv6 (dhcpd)

22.6.1.1. Simple configuration

22.6.2. Usage

22.6.2.1. dhcpd

22.7.1. Configuration of the Dibbler DHCP server for IPv6

22.7.1.1. Simple configuration

22.7.2. Usage

22.7.2.1. dibbler-server

22.8.1. Filtering capabilities

22.8.2. Which program uses tcp_wrapper

22.8.3. Usage

22.8.3.1. Example for /etc/hosts.allow

22.8.3.2. Example for /etc/hosts.deny

22.8.4. Logging

22.8.4.1. Refused connection

22.8.4.2. Permitted connection

22.9.1. Listening on IPv6 addresses

22.10.1. Listening on IPv6 addresses

23.1.1. Address Structures

23.1.1.1. IPv4 sockaddr_in

23.1.1.2. IPv6 sockaddr_in6

23.1.1.3. Generic Addresses

23.1.2. Lookup Functions

23.1.3. Quirks Encountered

23.1.3.1. IPv4 Mapped Addresses

23.1.3.2. Cannot Specify the Scope Identifier in /etc/hosts

23.1.3.3. Client & Server Residing on the Same Machine

23.1.4. Putting It All Together (A Client-Server Programming Example)

Porting applications to IPv6 HowTo. For the record, the source code presented here is original, developed from scratch, and any similarity between it and any other publicly available 'daytime' example is purely coincidental.]. The source code presented in this section was developed and tested on a RedHat Linux release using the 2.6 kernel (2.6.9 to be specific). Readers may use the source code freely, so long as proper credit is attributed; but of course the standard disclaimer must be given first:

23.1.4.1. 'Daytime' Server Code

23.1.4.2. 'Daytime' TCP Client Code

23.1.4.3. 'Daytime' UDP Client Code

23.2. Other programming languages

23.2.1. JAVA

23.2.2. Perl

25.1.1. Printed Books (English)

25.1.1.1. Cisco

25.1.1.2. General

25.1.2. Articles, eBooks, Online Reviews (mixed)

25.1.4. Others

25.2.1. 2004

25.3.2. Latest news and URLs to other documents

25.3.3. Protocol references

25.3.3.1. IPv6-related Request For Comments (RFCs)

25.3.3.2. Current drafts of working groups

25.3.3.3. Others

25.3.4. More information

25.3.4.1. Linux related

25.3.4.2. Linux related per distribution

25.3.4.3. General

25.3.5. By countries

25.3.5.1. Europe

25.3.5.2. Austria

25.3.5.3. Australia

25.3.5.4. Belgium

25.3.5.5. Brasil

25.3.5.6. China

25.3.5.7. Czech

25.3.5.8. Germany

25.3.5.9. France

25.3.5.10. Italy

25.3.5.11. Japan

25.3.5.12. Korea

25.3.5.13. Mexico

25.3.5.14. Netherland

25.3.5.15. Portugal

25.3.5.16. Russia

25.3.5.17. Switzerland

25.3.5.18. United Kingdom

25.3.6. By operating systems

25.3.6.1. *BSD

25.3.6.2. Cisco IOS

25.3.6.3. HPUX

25.3.6.4. IBM

25.3.6.5. Microsoft

25.3.6.6. Solaris

25.3.6.7. Sumitoma

25.3.6.8. ZebOS

25.3.8. Application lists

25.3.8.1. Analyzer tools

25.3.8.2. IPv6 Products

25.4. IPv6 Infrastructure

25.4.1. Statistics

25.4.2. Internet Exchanges

25.4.4.4. Radio Stations, Music Streams

25.6.1. Testing tools

25.6.2. Information retrievement

25.6.3. IPv6 Looking Glasses

25.6.4. Helper applications

Chapter 26. Revision history / Credits / The End

26.1.1. Releases 0.x

0.66

2010-04-20/PB: extend QoS section with examples, 20130513/PB: add IPv6 NAT hints, 20130521/PB: review dhcpd, 20131019/bie: general review, 20140502/bie: add hints for nftables, 20140513/bie: extend section regarding address resolution and add source/destination address selection information

2010-04-20/PB: extend QoS section with examples, 20130513/PB: add IPv6 NAT hints, 20130521/PB: review dhcpd, 20131019/bie: general review, 20140502/bie: add hints for nftables, 20140513/bie: extend section regarding address resolution and add source/destination address selection information, 20140515/bie: add hints for activation of privacy extension

0.65

26.2.2. Other credits

26.2.2.1. Document technique related

26.3. The End

0.66wip 2014-05-13 0.66wip 2014-05-15 PB \end_layout @@ -5093,6 +5093,269 @@ Example: # /sbin/ifconfig eth0 inet6 del 2001:0db8:0:f101::1/64 \end_layout +\begin_layout Section +Automatic IPv6 Address Configuration +\end_layout + +\begin_layout Standard +In case, a Router Advertisement is received by a client, in case IPv6 autoconfig +uration is enabled, the client configures itself an IPv6 address according + to the prefix contained in the advertisement (see also +\begin_inset CommandInset ref +LatexCommand ref +reference "hints-daemons-radvd" + +\end_inset + +). +\end_layout + +\begin_layout Section +Enable Privacy Extension +\end_layout + +\begin_layout Standard +Privacy Extension as described in +\begin_inset CommandInset href +LatexCommand href +name "RFC 4941 / Privacy Extensions for Stateless Address Autoconfiguration in IPv6" +target "http://www.faqs.org/rfcs/rfc4941.html" + +\end_inset + + (obsoleted +\begin_inset CommandInset href +LatexCommand href +name "RFC 3041" +target "http://www.faqs.org/rfcs/rfc3041.html" + +\end_inset + +) is replacing the static interface ID (mostly based on word-wide unique + MAC address) used during autoconfiguration by a pseudo-random one and generatin +g from time to time a new one deprecating the old one. +\end_layout + +\begin_layout Subsection +Enable Privacy Extension using sysctl +\end_layout + +\begin_layout Subsection* +Temporary activation +\end_layout + +\begin_layout Standard +Enable privacy extension for e.g. + interface +\begin_inset Quotes sld +\end_inset + +eth0 +\begin_inset Quotes srd +\end_inset + + and prefer the generated address: +\end_layout + +\begin_layout Code +# sysctl -w net.ipv6.conf.eth0.use_tempaddr=2 +\end_layout + +\begin_layout Standard +Afterwards, restart of the interface is necessary +\end_layout + +\begin_layout Code +# ip link set dev eth0 down +\end_layout + +\begin_layout Code +# ip link set dev eth0 up +\end_layout + +\begin_layout Standard +Once a router advertisement is received, the result should look like following +\end_layout + +\begin_layout Code +# ip -6 addr show dev eth0 +\end_layout + +\begin_layout Code +2: eth0: mtu 1500 qlen 1000 +\end_layout + +\begin_layout Code + inet6 2001:db8:0:1:8992:3c03:d6e2:ed72/64 scope global secondary dynamic + <- pseudo-random IID +\end_layout + +\begin_layout Code + valid_lft 604711sec preferred_lft 86311sec +\end_layout + +\begin_layout Code + inet6 2001:db8:0:1::224:21ff:fe01:2345/64 scope global <- IID based + on MAC +\end_layout + +\begin_layout Code + valid_lft 604711sec preferred_lft 86311sec +\end_layout + +\begin_layout Code + ... +\end_layout + +\begin_layout Subsection* +Permanent activation +\end_layout + +\begin_layout Standard +For permanent activation, either a special initscript value per interface + will enable privacy or an entry in the /etc/sysctl.conf file like +\end_layout + +\begin_layout Code +net.ipv6.conf.eth0.use_tempaddr=2 +\end_layout + +\begin_layout Standard +Note: interface must already exists with proper name when sysctl.conf is + applied. + If this is not the case (udev or delayed initialization) one has to configure + privacy for all interfaces by default: +\end_layout + +\begin_layout Code +net.ipv6.conf.all.use_tempaddr=2 +\end_layout + +\begin_layout Code +net.ipv6.conf.default.use_tempaddr=2 +\end_layout + +\begin_layout Standard +Values can be activated during runtime, but at least an interface down/up + or a reboot is recommended. +\end_layout + +\begin_layout Code +# sysctl -p +\end_layout + +\begin_layout Subsection +Enable Privacy Extension using NetworkManager +\end_layout + +\begin_layout Standard +Modern (client) systems are using NetworkManager (here: version 0.9.9.1-5.git2014031 +9.fc21) for configuring interfaces. + A command line tool is built-in which can be used to change settings which + are not available via GUI. +\end_layout + +\begin_layout Standard +Check existing interfaces with: +\end_layout + +\begin_layout Code +# nmcli connection +\end_layout + +\begin_layout Code +NAME UUID TYPE DEVICE +\end_layout + +\begin_layout Code +ens4v1 d0fc2b2e-5fa0-4675-96b5-b723ca5c46db 802-3-ethernet ens4v1 +\end_layout + +\begin_layout Standard +Current amount of IPv6 privacy extension addresses can be checked with +\end_layout + +\begin_layout Code +# ip -o addr show dev ens4v1 | grep temporary | wc -l +\end_layout + +\begin_layout Code +0 +\end_layout + +\begin_layout Standard +Current IPv6 privacy extension settings can be checked with +\end_layout + +\begin_layout Code +# nmcli connection show ens4v1 |grep ip6-privacy +\end_layout + +\begin_layout Code +ipv6.ip6-privacy: -1 (unknown) +\end_layout + +\begin_layout Standard +Enable IPv6 privacy extension and restart interface +\end_layout + +\begin_layout Code +# nmcli connection modify ens4v1 ipv6.ip6-privacy 2 +\end_layout + +\begin_layout Code +# nmcli connection down ens4v1; nmcli connection up ens4v1 +\end_layout + +\begin_layout Standard +New IPv6 privacy extension settings can be checked with +\end_layout + +\begin_layout Code +# nmcli connection show ens4v1 |grep ip6-privacy +\end_layout + +\begin_layout Code +ipv6.ip6-privacy: 2 (active, prefer temporary IP) +\end_layout + +\begin_layout Standard +Now IPv6 privacy extension addresses are configured on the interface +\end_layout + +\begin_layout Code +# ip -o addr show dev ens4v1 | grep temporary | wc -l +\end_layout + +\begin_layout Code +2 +\end_layout + +\begin_layout Subsection +Test real use of Privacy Extension +\end_layout + +\begin_layout Standard +Whether the IPv6 address with an Interface ID generated by Privacy Extension + is really used for outgoing connections, one can browse to +\begin_inset CommandInset href +LatexCommand href +name "http://ip.bieringer.de/" +target "http://ip.bieringer.de/" + +\end_inset + +, in case EUI64_SCOPE shows +\begin_inset Quotes sld +\end_inset + +iid-privacy +\begin_inset Quotes srd +\end_inset + +, then everything is working fine. +\end_layout + \begin_layout Chapter \begin_inset CommandInset label LatexCommand label @@ -29873,7 +30136,8 @@ Releases 0.x 0.66 2010-04-20/PB: extend QoS section with examples, 20130513/PB: add IPv6 NAT hints, 20130521/PB: review dhcpd, 20131019/bie: general review, 20140502/bi e: add hints for nftables, 20140513/bie: extend section regarding address - resolution and add source/destination address selection information + resolution and add source/destination address selection information, 20140515/b +ie: add hints for activation of privacy extension \end_layout \begin_layout Description diff --git a/LDP/users/Peter-Bieringer/Linux+IPv6-HOWTO.pdf b/LDP/users/Peter-Bieringer/Linux+IPv6-HOWTO.pdf index cd9654c2..8017c107 100644 Binary files a/LDP/users/Peter-Bieringer/Linux+IPv6-HOWTO.pdf and b/LDP/users/Peter-Bieringer/Linux+IPv6-HOWTO.pdf differ diff --git a/LDP/users/Peter-Bieringer/Linux+IPv6-HOWTO.sgml b/LDP/users/Peter-Bieringer/Linux+IPv6-HOWTO.sgml index be56a2f7..16441252 100644 --- a/LDP/users/Peter-Bieringer/Linux+IPv6-HOWTO.sgml +++ b/LDP/users/Peter-Bieringer/Linux+IPv6-HOWTO.sgml @@ -13,7 +13,7 @@ Linux IPv6 HOWTO (en) PeterBieringer

pb at bieringer dot de
- 0.66wip 2014-05-13 PB + 0.66wip 2014-05-15 PB 0.65 2009-12-13 PB 0.64 2009-06-11 PB 0.60 2007-05-31 PB @@ -737,7 +737,59 @@ inet6 addr: fec0:0:0:f101::1/64 Scope:Site inet6 del / ]]>Example: +]]> +Automatic IPv6 Address Configuration +In case, a Router Advertisement is received by a client, in case IPv6 autoconfiguration is enabled, the client configures itself an IPv6 address according to the prefix contained in the advertisement (see also ). +Enable Privacy Extension +Privacy Extension as described in RFC 4941 / Privacy Extensions for Stateless Address Autoconfiguration in IPv6 (obsoleted RFC 3041) is replacing the static interface ID (mostly based on word-wide unique MAC address) used during autoconfiguration by a pseudo-random one and generating from time to time a new one deprecating the old one. +Enable Privacy Extension using sysctl +Temporary activation +Enable privacy extension for e.g. interface “eth0” and prefer the generated address: +Afterwards, restart of the interface is necessary +Once a router advertisement is received, the result should look like following + mtu 1500 qlen 1000 + inet6 2001:db8:0:1:8992:3c03:d6e2:ed72/64 scope global secondary dynamic <- pseudo-random IID + valid_lft 604711sec preferred_lft 86311sec + inet6 2001:db8:0:1::224:21ff:fe01:2345/64 scope global <- IID based on MAC + valid_lft 604711sec preferred_lft 86311sec + ... +]]>Permanent activation +For permanent activation, either a special initscript value per interface will enable privacy or an entry in the /etc/sysctl.conf file like +Note: interface must already exists with proper name when sysctl.conf is applied. If this is not the case (udev or delayed initialization) one has to configure privacy for all interfaces by default: +Values can be activated during runtime, but at least an interface down/up or a reboot is recommended. + +Enable Privacy Extension using NetworkManager +Modern (client) systems are using NetworkManager (here: version 0.9.9.1-5.git20140319.fc21) for configuring interfaces. A command line tool is built-in which can be used to change settings which are not available via GUI. +Check existing interfaces with: +Current amount of IPv6 privacy extension addresses can be checked with +Current IPv6 privacy extension settings can be checked with +Enable IPv6 privacy extension and restart interface +New IPv6 privacy extension settings can be checked with +Now IPv6 privacy extension addresses are configured on the interface + +Test real use of Privacy Extension +Whether the IPv6 address with an Interface ID generated by Privacy Extension is really used for outgoing connections, one can browse to http://ip.bieringer.de/, in case EUI64_SCOPE shows “iid-privacy”, then everything is working fine. <!-- anchor id="chapter-configuration-route" -->Configuring normal IPv6 routes If you want to leave your link and want to send packets in the world wide IPv6-Internet, you need routing. If there is already an IPv6 enabled router on your link, it's possible enough to add IPv6 routes. Just note that addresses beginning with “fec0” are deprecated, but shown here for completness! @@ -5228,7 +5280,7 @@ Publisher: MarketResearch.com; ISBN B00006334Y; (November 1, 2001) Versions x.y.z are work-in-progress and published as LyX and SGML file on CVS. Because Deep Space 6 mirrors these SGML files and generate independend from TLDP public versions, this versions will show up there and also on its mirrors. Releases 0.x -0.662010-04-20/PB: extend QoS section with examples, 20130513/PB: add IPv6 NAT hints, 20130521/PB: review dhcpd, 20131019/bie: general review, 20140502/bie: add hints for nftables, 20140513/bie: extend section regarding address resolution and add source/destination address selection information0.652009-12-13/PB: minor fixes0.642009-06-11/PB: extend DHCP server examples (ISC DHCP, Dibbler)0.632009-02-14/PB: Fix FSF address, major update on 4in6 tunnels, add new section for address resolving, add some URLs, remove broken URLs0.622008-11-09/PB: Adjust URL to Turkish howto, add some HIP related URLs, remove broken URLs0.61.12007-11-11/PB: fix broken description of shortcut BIND0.612007-10-06/PB: fix broken URLs to TLDP-CVS, minor URL update.0.60.22007-10-03/PB: fix description of sysctl/autoconf (credits to Francois-Xavier Le Bail)0.60.12007-06-16/PB: speling fixes (credits to Larry W. Burton)0.602007-05-29/PB: import major contribution to Programming using C-API written by John Wenker, minor fixes0.522007-05-23/PB: update firewalling chapter, improve document for proper SGML validation, minor bugfixes0.512006-11-08/PB: remove broken URLs, add a new book (credits to Bryan Vukich)0.50.22006-10-25/PB: fix typo in dhcp6 section (credits to Michele Ferritto)0.50.12006-09-23/PB: add some URLs0.502006-08-24/PB: check RFC URLs, fix URL to Chinese translation, finalize for publishing0.49.52006-08-23/PB: fix/remove broken URLs0.49.42006-08-21/PB: some review, update and enhancement of the content, replace old 6bone example addresses with the current defined ones.0.49.32006-08-20/PB: fix bug in maillist entries, 'mobility' is now a separate chapter0.49.22006-08-20/PB: update and cleanup of maillist entries0.49.12006-06-13/PB: major update of mobility section (contributed by Benjamin Thery)0.492005-10-03/PB: add configuration hints for DHCPv6, major broken URL cleanup (credits to Necdet Yucel)0.48.12005-01-15/PB: minor fixes0.482005-01-11/PB: grammar check and minor review of IPv6 IPsec section0.47.12005-01-01/PB: add information and examples about IPv6 IPsec, add some URLs0.472004-08-30/PB: add some notes about proftpd, vsftpd and other daemons, add some URLs, minor fixes, update status of Spanish translation0.46.42004-07-19/PB: minor fixes0.46.32004-06-23/PB: add note about started Greek translation, replace Taiwanese with Chinese for related translation0.46.22004-05-22/PB: minor fixes0.46.12004-04-18/PB: minor fixes0.462004-03-04/PB: announce Italian translation, add information about DHCPv6, minor updates0.45.12004-01-12/PB: add note about the official example address space0.452004-01-11/PB: minor fixes, add/fix some URLs, some extensions0.44.22003-10-30/PB: fix some copy&paste text bugs0.44.12003-10-19/PB: add note about start of Italian translation0.442003-08-15/PB: fix URLs, add hint on tcp_wrappers (about broken notation in some versions) and Apache20.43.42003-07-26/PB: fix URL, add archive URL for maillist users at ipv6.org, add some ds6 URLs0.43.32003-06-19/PB: fix typos0.43.22003-06-11/PB: fix URL0.43.12003-06-07/PB: fix some URLs, fix credits, add some notes at IPsec0.432003-06-05/PB: add some notes about configuration in SuSE Linux, add URL of French translation0.422003-05-09/PB: minor fixes, announce French translation0.41.42003-05-02/PB: Remove a broken URL, update some others.0.41.32003-04-23/PB: Minor fixes, remove a broken URL, fix URL to Taiwanese translation0.41.22003-04-13/PB: Fix some typos, add a note about a French translation is in progress0.41.12003-03-31/PB: Remove a broken URL, fix another0.412003-03-22/PB: Add URL of German translation0.40.22003-02-27/PB: Fix a misaddressed URL0.40.12003-02-12/PB: Add Debian-Linux-Configuration, add a minor note on translations0.402003-02-10/PB: Announcing available German version0.39.22003-02-10/GK: Minor syntax and spelling fixes0.39.12003-01-09/PB: fix an URL (draft adopted to an RFC)0.392003-01-13/PB: fix a bug (forgotten 'link” on “ip link set” (credits to Yaniv Kaul)0.38.12003-01-09/PB: a minor fix0.382003-01-06/PB: minor fixes0.37.12003-01-05/PB: minor updates0.372002-12-31/GK: 270 new links added (searched in 1232 SearchEngines) in existing and 53 new (sub)sections0.36.12002-12-20/PB: Minor fixes0.362002-12-16/PB: Check of and fix broken links (credits to Georg Käfer), some spelling fixes0.352002-12-11/PB: Some fixes and extensions0.34.12002-11-25/PB: Some fixes (e.g. broken linuxdoc URLs)0.342002-11-19/PB: Add information about German translation (work in progress), some fixes, create a small shortcut explanation list, extend “used terms” and add two German books0.332002-11-18/PB: Fix broken RFC-URLs, add parameter ttl on 6to4 tunnel setup example0.322002-11-03/PB: Add information about Taiwanese translation0.31.12002-10-06/PB: Add another maillist0.312002-09-29/PB: Extend information in proc-filesystem entries0.302002-09-27/PB: Add some maillists0.292002-09-18/PB: Update statement about nmap (triggered by Fyodor)0.28.12002-09-16/PB: Add note about ping6 to multicast addresses, add some labels0.282002-08-17/PB: Fix broken LDP/CVS links, add info about Polish translation, add URL of the IPv6 Address Oracle0.272002-08-10/PB: Some minor updates0.26.22002-07-15/PB: Add information neighbor discovery, split of firewalling (got some updates) and security into extra chapters0.26.12002-07-13/PB: Update nmap/IPv6 information0.262002-07-13/PB: Fill /proc-filesystem chapter, update DNS information about depricated A6/DNAME, change P-t-P tunnel setup to use of “ip” only0.25.22002-07-11/PB: Minor spelling fixes0.25.12002-06-23/PB: Minor spelling and other fixes0.252002-05-16/PB: Cosmetic fix for 2^128, thanks to José Abílio Oliveira Matos for help with LyX0.242002-05-02/PB: Add entries in URL list, minor spelling fixes0.232002-03-27/PB: Add entries in URL list and at maillists, add a label and minor information about IPv6 on RHL0.222002-03-04/PB: Add info about 6to4 support in kernel series 2.2.x and add an entry in URL list and at maillists0.212002-02-26/PB: Migrate next grammar checks submitted by John Ronan 0.20.42002-02-21/PB: Migrate more grammar checks submitted by John Ronan, add some additional hints at DNS section 0.20.32002-02-12/PB: Migrate a minor grammar check patch submitted by John Ronan0.20.22002-02-05/PB: Add mipl to maillist table0.20.12002-01-31/PB: Add a hint how to generate 6to4 addresses0.202002-01-30/PB: Add a hint about default route problem, some minor updates0.19.22002-01-29/PB: Add many new URLs0.19.12002-01-27/PB: Add some forgotten URLs0.192002-01-25/PB: Add two German books, fix quote entinities in exported SGML code0.18.22002-01-23/PB: Add a FAQ on the program chapter0.18.12002-01-23/PB: Move “the end” to the end, add USAGI to maillists0.182002-01-22/PB: Fix bugs in explanation of multicast address types0.17.22002-01-22/PB: Cosmetic fix double existing text in history (at 0.16), move all credits to the end of the document0.17.12002-01-20/PB: Add a reference, fix URL text in online-test-tools0.172002-01-19/PB: Add some forgotten information and URLs about global IPv6 addresses0.162002-01-19/PB: Minor fixes, remove “bold” and “emphasize” formats on code lines, fix “too long unwrapped code lines” using selfmade utility, extend list of URLs.0.152002-01-15/PB: Fix bug in addresstype/anycast, move content related credits to end of document0.142002-01-14/PB: Minor review at all, new chapter “debugging”, review “addresses”, spell checking, grammar checking (from beginning to 3.4.1) by Martin Krafft, add tcpdump examples, copy firewalling/netfilter6 from IPv6+Linux-HowTo, minor enhancements0.132002-01-05/PB: Add example BIND9/host, move revision history to end of document, minor extensions0.122002-01-03/PB: Merge review of David Ranch0.112002-01-02/PB: Spell checking and merge review of Pekka Savola0.102002-01-02/PB: First public release of chapter 1 +0.662010-04-20/PB: extend QoS section with examples, 20130513/PB: add IPv6 NAT hints, 20130521/PB: review dhcpd, 20131019/bie: general review, 20140502/bie: add hints for nftables, 20140513/bie: extend section regarding address resolution and add source/destination address selection information, 20140515/bie: add hints for activation of privacy extension0.652009-12-13/PB: minor fixes0.642009-06-11/PB: extend DHCP server examples (ISC DHCP, Dibbler)0.632009-02-14/PB: Fix FSF address, major update on 4in6 tunnels, add new section for address resolving, add some URLs, remove broken URLs0.622008-11-09/PB: Adjust URL to Turkish howto, add some HIP related URLs, remove broken URLs0.61.12007-11-11/PB: fix broken description of shortcut BIND0.612007-10-06/PB: fix broken URLs to TLDP-CVS, minor URL update.0.60.22007-10-03/PB: fix description of sysctl/autoconf (credits to Francois-Xavier Le Bail)0.60.12007-06-16/PB: speling fixes (credits to Larry W. Burton)0.602007-05-29/PB: import major contribution to Programming using C-API written by John Wenker, minor fixes0.522007-05-23/PB: update firewalling chapter, improve document for proper SGML validation, minor bugfixes0.512006-11-08/PB: remove broken URLs, add a new book (credits to Bryan Vukich)0.50.22006-10-25/PB: fix typo in dhcp6 section (credits to Michele Ferritto)0.50.12006-09-23/PB: add some URLs0.502006-08-24/PB: check RFC URLs, fix URL to Chinese translation, finalize for publishing0.49.52006-08-23/PB: fix/remove broken URLs0.49.42006-08-21/PB: some review, update and enhancement of the content, replace old 6bone example addresses with the current defined ones.0.49.32006-08-20/PB: fix bug in maillist entries, 'mobility' is now a separate chapter0.49.22006-08-20/PB: update and cleanup of maillist entries0.49.12006-06-13/PB: major update of mobility section (contributed by Benjamin Thery)0.492005-10-03/PB: add configuration hints for DHCPv6, major broken URL cleanup (credits to Necdet Yucel)0.48.12005-01-15/PB: minor fixes0.482005-01-11/PB: grammar check and minor review of IPv6 IPsec section0.47.12005-01-01/PB: add information and examples about IPv6 IPsec, add some URLs0.472004-08-30/PB: add some notes about proftpd, vsftpd and other daemons, add some URLs, minor fixes, update status of Spanish translation0.46.42004-07-19/PB: minor fixes0.46.32004-06-23/PB: add note about started Greek translation, replace Taiwanese with Chinese for related translation0.46.22004-05-22/PB: minor fixes0.46.12004-04-18/PB: minor fixes0.462004-03-04/PB: announce Italian translation, add information about DHCPv6, minor updates0.45.12004-01-12/PB: add note about the official example address space0.452004-01-11/PB: minor fixes, add/fix some URLs, some extensions0.44.22003-10-30/PB: fix some copy&paste text bugs0.44.12003-10-19/PB: add note about start of Italian translation0.442003-08-15/PB: fix URLs, add hint on tcp_wrappers (about broken notation in some versions) and Apache20.43.42003-07-26/PB: fix URL, add archive URL for maillist users at ipv6.org, add some ds6 URLs0.43.32003-06-19/PB: fix typos0.43.22003-06-11/PB: fix URL0.43.12003-06-07/PB: fix some URLs, fix credits, add some notes at IPsec0.432003-06-05/PB: add some notes about configuration in SuSE Linux, add URL of French translation0.422003-05-09/PB: minor fixes, announce French translation0.41.42003-05-02/PB: Remove a broken URL, update some others.0.41.32003-04-23/PB: Minor fixes, remove a broken URL, fix URL to Taiwanese translation0.41.22003-04-13/PB: Fix some typos, add a note about a French translation is in progress0.41.12003-03-31/PB: Remove a broken URL, fix another0.412003-03-22/PB: Add URL of German translation0.40.22003-02-27/PB: Fix a misaddressed URL0.40.12003-02-12/PB: Add Debian-Linux-Configuration, add a minor note on translations0.402003-02-10/PB: Announcing available German version0.39.22003-02-10/GK: Minor syntax and spelling fixes0.39.12003-01-09/PB: fix an URL (draft adopted to an RFC)0.392003-01-13/PB: fix a bug (forgotten 'link” on “ip link set” (credits to Yaniv Kaul)0.38.12003-01-09/PB: a minor fix0.382003-01-06/PB: minor fixes0.37.12003-01-05/PB: minor updates0.372002-12-31/GK: 270 new links added (searched in 1232 SearchEngines) in existing and 53 new (sub)sections0.36.12002-12-20/PB: Minor fixes0.362002-12-16/PB: Check of and fix broken links (credits to Georg Käfer), some spelling fixes0.352002-12-11/PB: Some fixes and extensions0.34.12002-11-25/PB: Some fixes (e.g. broken linuxdoc URLs)0.342002-11-19/PB: Add information about German translation (work in progress), some fixes, create a small shortcut explanation list, extend “used terms” and add two German books0.332002-11-18/PB: Fix broken RFC-URLs, add parameter ttl on 6to4 tunnel setup example0.322002-11-03/PB: Add information about Taiwanese translation0.31.12002-10-06/PB: Add another maillist0.312002-09-29/PB: Extend information in proc-filesystem entries0.302002-09-27/PB: Add some maillists0.292002-09-18/PB: Update statement about nmap (triggered by Fyodor)0.28.12002-09-16/PB: Add note about ping6 to multicast addresses, add some labels0.282002-08-17/PB: Fix broken LDP/CVS links, add info about Polish translation, add URL of the IPv6 Address Oracle0.272002-08-10/PB: Some minor updates0.26.22002-07-15/PB: Add information neighbor discovery, split of firewalling (got some updates) and security into extra chapters0.26.12002-07-13/PB: Update nmap/IPv6 information0.262002-07-13/PB: Fill /proc-filesystem chapter, update DNS information about depricated A6/DNAME, change P-t-P tunnel setup to use of “ip” only0.25.22002-07-11/PB: Minor spelling fixes0.25.12002-06-23/PB: Minor spelling and other fixes0.252002-05-16/PB: Cosmetic fix for 2^128, thanks to José Abílio Oliveira Matos for help with LyX0.242002-05-02/PB: Add entries in URL list, minor spelling fixes0.232002-03-27/PB: Add entries in URL list and at maillists, add a label and minor information about IPv6 on RHL0.222002-03-04/PB: Add info about 6to4 support in kernel series 2.2.x and add an entry in URL list and at maillists0.212002-02-26/PB: Migrate next grammar checks submitted by John Ronan 0.20.42002-02-21/PB: Migrate more grammar checks submitted by John Ronan, add some additional hints at DNS section 0.20.32002-02-12/PB: Migrate a minor grammar check patch submitted by John Ronan0.20.22002-02-05/PB: Add mipl to maillist table0.20.12002-01-31/PB: Add a hint how to generate 6to4 addresses0.202002-01-30/PB: Add a hint about default route problem, some minor updates0.19.22002-01-29/PB: Add many new URLs0.19.12002-01-27/PB: Add some forgotten URLs0.192002-01-25/PB: Add two German books, fix quote entinities in exported SGML code0.18.22002-01-23/PB: Add a FAQ on the program chapter0.18.12002-01-23/PB: Move “the end” to the end, add USAGI to maillists0.182002-01-22/PB: Fix bugs in explanation of multicast address types0.17.22002-01-22/PB: Cosmetic fix double existing text in history (at 0.16), move all credits to the end of the document0.17.12002-01-20/PB: Add a reference, fix URL text in online-test-tools0.172002-01-19/PB: Add some forgotten information and URLs about global IPv6 addresses0.162002-01-19/PB: Minor fixes, remove “bold” and “emphasize” formats on code lines, fix “too long unwrapped code lines” using selfmade utility, extend list of URLs.0.152002-01-15/PB: Fix bug in addresstype/anycast, move content related credits to end of document0.142002-01-14/PB: Minor review at all, new chapter “debugging”, review “addresses”, spell checking, grammar checking (from beginning to 3.4.1) by Martin Krafft, add tcpdump examples, copy firewalling/netfilter6 from IPv6+Linux-HowTo, minor enhancements0.132002-01-05/PB: Add example BIND9/host, move revision history to end of document, minor extensions0.122002-01-03/PB: Merge review of David Ranch0.112002-01-02/PB: Spell checking and merge review of Pekka Savola0.102002-01-02/PB: First public release of chapter 1 <!-- anchor id="credits" -->Credits The quickest way to be added to this nice list is to send bug fixes, corrections, and/or updates to me ;-). If you want to do a major review, you can use the native LyX file (see original source) and send diffs against it, because diffs against SGML don't help too much.