Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I have manually specified only ipv4 address for my interfaces. But all the interfaces automatically show inet6 address as well. Does it mean that ubuntu starts an ipv6 tunnel by default. If it does, isn't it dangerous, as ipv6 assigns public ips for all LAN clients. I only have a firewall on my NAT router, and my clients, who's interfaces show ipv6 address, do not have firewalls. Here is a screenshot:

eth0      Link encap:Ethernet  HWaddr 34:dc:47:2e:ad:13
          inet6 addr: fe80::28cf:38ff:fb7b:da19/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:5783 errors:0 dropped:0 overruns:0 frame:0
          TX packets:6098 errors:0 dropped:0 overruns:0 carrier:1
          collisions:0 txqueuelen:1000
          RX bytes:2961324 (2.9 MB)  TX bytes:1573757 (1.5 MB)
          Interrupt:46

Note: For privacy reasons I have modified the HWaddr and inet6 addr values.

share|improve this question
    
+1 well stated question. –  msw Jan 28 '11 at 23:59
    
fe80::0/10 will never leave your LAN, and as such will not be of any harm for you. If you have an address within 2000::0/3, which is a global address, you should be a bit more worried. And then you need to set up a firewall (ufw is great for this). –  Anders Jul 15 '12 at 5:11

3 Answers 3

up vote 5 down vote accepted

IPv6 addresses are shown because IPv6 is enabled on network interfaces by default. The only way this would matter (I believe) is if the network you were connected to supported IPv6.

I don't believe that Ubuntu would create a IPv6 tunnel to anything, it just leaves the protocol active on that interface. If IPv6 is available on your network, and the IPv6 side does not employ NAT, than there is the possibility that it is directly connecting you to the Internet.

In that case, if you were worried about your security, you could disable IPv6 using CYREX's answer.

share|improve this answer
    
+1 complete, accurate, and provides a solution if wanted –  msw Jan 28 '11 at 23:59
    
You don't need to disable IPv6. Addresses that starts with 2000::0/3 is global addresses. This is only Link local addresses that starts with fe80::0/10 which is only visible and used to communicate in your lan and usually only between your IPv6 router and your computer. They should never leave your LAN. –  Anders Jul 15 '12 at 5:09

The IPv6 address shown is link-local - this means that it is not publically accessible outside of your LAN, but is an automatic address assigned for communicating within your local network. For people to be able to access your computer via IPv6, there would need to be a public address on the interface & for it to be routed.

share|improve this answer

Try:

echo 1 > /proc/sys/net/ipv6/conf/all/disable_ipv6

You can also change the ALL part in the line to specify eth0, eth1... the one you actually want to change that.

NOTE: You NEED to be root to do this.

share|improve this answer
    
And this is not necessary at all, as the addresses that starts with fe80::0/10 is link local and should never be transfered by a router. If the address is 2000::0/3, them it is a global address and you should set up a IPv6 firewall (like ufw). –  Anders Jul 15 '12 at 5:06

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.