50

How can we disable IPv6 system wide via terminal commands?

I've read editing /etc/modprobe.d/aliases and replacing:

alias net-pf-10 ipv6

with:

alias net-pf-10 off
alias ipv6 off

Is this safe to apply and does it permanently disable ipv6 across reboots?

  • 5
    Why do you want to disable IPv6 permanently? – Anderson Green Jun 17 '13 at 23:59
  • 2
    There are absolutly (well, I can actually find one, on MS Windows) no reason to turn IPv6 off. Why would you want to do that? – Anders Jun 20 '13 at 1:00
  • 15
    There is absolutely no reasons, to turn ipv6 on actually. Everything is still ipv4 and it offers no advantages to someone who is managing a small network and who has limited time. It's one more vector for attack and potential misconfiguration and it's prudent to disable it. Probably not what any IETF engineer wants to hear, but it's their problem not mine. I'll enable it when I have a good reason, until then, just another attack vector I have to manage. – Jonathan S. Fisher Jan 30 '14 at 3:55
  • 8
    Disabling IPv6 doesn't make you immune to IPv6 attacks. It is much better to have it enabled, deal with it and learn from it, that is the only way make your environment a bit safier. It is better for everybody to learn "How to to disable IPv4 permanently", instead. IPv6 is far much easier than IPv4, to begin with, there no NAT anymore, so, one less thing to manage... The Internet is growing really fast, in a few years, the IPv6 network will be bigger than IPv4, so, with IPv4, you'll be out of the real Internet. Go ahead man! Upgrade your IP!! Change is a good thing. – ThiagoCMC Feb 24 '14 at 6:12
  • 6
    @JonathanS.Fisher and others - These comments are no helpful. Just because you may not be aware of a reason to disable IPv6, doesn't mean there isn't one. One major case is for VPN services that don't support IPv6. If you don't disable it, you will leak your IPv6 address. – Scone Jan 26 '17 at 1:44
68

I successfully disabled IPv6 once putting the following lines in /etc/sysctl.conf:

net.ipv6.conf.all.disable_ipv6 = 1
net.ipv6.conf.default.disable_ipv6 = 1
net.ipv6.conf.lo.disable_ipv6 = 1

also run this command to load changes

sudo sysctl -p
  • Uubuntu on VMware can't be ping, and I close the ipv6 on Ubuntu, it is ok now. – Honghe.Wu Oct 16 '13 at 8:10
  • 12
    After these adding lines to sysctl.conf, run sudo sysctl -p or reboot to let changes take effect. – Rajat Gupta Mar 13 '14 at 18:14
  • 4
    I need to do this only on wireless as a bug workaround so I can connect again. Here's how to do it for one adapter only: net.ipv6.conf.wlan0.disable_ipv6 = 1 – cmc Nov 21 '14 at 11:20
  • This didn't work for me on UbuntuMate 16.10. I had to specific the Wifi interface specifically, similar to how @cmc suggests above. – Scone Jan 26 '17 at 1:45
  • This does not work on Ubuntu 17.10. See NullNoname comment below for the grub fix. – Luke Jan 1 '18 at 4:54
51

If your PC doesn't load /etc/sysctl.conf at boot time (which is the case for me), disabling IPv6 from grub is needed. Linux kernel has a boot option named "ipv6.disable=1" which disables IPv6 from startup.

To edit the boot options, edit "/etc/default/grub" with any text editor as root user:

sudo nano /etc/default/grub

Find the line that contain "GRUB_CMDLINE_LINUX_DEFAULT":

GRUB_CMDLINE_LINUX_DEFAULT="quiet splash"

Add "ipv6.disable=1" to the boot option, then save your grub file:

GRUB_CMDLINE_LINUX_DEFAULT="ipv6.disable=1 quiet splash"

Finally, update grub:

sudo update-grub
  • 6
    +1 this works and disables IPv6 completely, so there are no traces of /proc/sys/net/ipv6/ left which may produce problems like X11 forwarding request failed because sshd tries to bind to a non-configured IPv6 interface. Note that similarly you can get rid of IPv4 this way on pure IPv6 VMs. Thanks. – Tino May 29 '14 at 7:48
7

Carvalho's answer including the comment about having to run sudo sysctl -P has helped me the most.

However, in my case at least:

net.ipv6.conf.all.disable_ipv6 = 1
net.ipv6.conf.<mydevice>.disable_ipv6 = 1

and it seems the second line was necessary.

Maybe this has to do with the fact that I am using the TP-Link Archer T2U, for which I had to customly build a driver from source.
My assumption is that as a result, <mydevice> doesn't count as one of "all".
So, in a nutshell, if you have customly added a ( custom) networking driver, net.ipv6.conf.all.disable_ipv6 = 1 might not be sufficient to disable IPv6 networking.

Have to admit though, that I didn't try the line
net.ipv6.conf.default.disable_ipv6 = 1

  • 1
    Upvote for mentioning that disabling different devices is sometimes required. – Scone Jan 26 '17 at 1:47
  • The lack of the default line is probably the problem here. If your driver wasn't loaded yet at the point in the boot process when the sysctl was executed, then it wasn't included in all -- but setting the default would have meant it would have gotten the setting later, when it was loaded. – Charles Duffy Mar 15 '17 at 20:11
  • 1
    I had the default entry and I had to configure the specific device to successfully disable it. – Alfonso Nishikawa May 14 '18 at 18:55
7

Here's how to check to see if ipv6 is enabled on your computer

test -f /proc/net/if_inet6 && echo "Running kernel is IPv6 ready"

If you see

Running kernel is IPv6 ready

it is enabled.

If you see no output, it is not.

To disable ipv6 if the other answers on this page don't work for you, blacklist ipv6 all-together. To do this, use the following command:

echo 'blacklist ipv6' | sudo tee -a '/etc/modprobe.d/blacklist.local' >/dev/null 

Also, this might help as well:

echo 'install ipv6 /bin/true' | sudo tee -a '/etc/modprobe.d/blacklist.local' >/dev/null

Reboot for the changes to take effect. To check if it's enabled after startup run this command again:

test -f /proc/net/if_inet6 && echo "Running kernel is IPv6 ready"

There should be no output.

Click here for info on how to disable IPV6 at boot.

  • This answer assumes that the kernels ipv6 feature is a kernel module (using blacklist.local to prevent its loading). There is a case that ipv6 is compiled into the kernel (not a module) in which case it is necessary to boot the kernel with ipv6.disable=1 boot paremeter (to do so one would: (1) sudo gedit /etc/default/grub (2) search for the line GRUB_CMDLINE_LINUX_DEFAULT=<args> and (3) add ipv6.disable=1 to the boot parameters ) – humanityANDpeace May 19 '17 at 10:32
  • @humanityANDpeace You may be interested in this more comprehensive answer: unix.stackexchange.com/a/190189 – mchid May 21 '17 at 20:29
6

If you are using a modern version (I'm on 16.04 LTS) of Ubuntu then you can use this tidy solution:

Create /etc/sysctl.d/60-ipv6-disable.conf containing the following text:

net.ipv6.conf.all.disable_ipv6 = 1
net.ipv6.conf.default.disable_ipv6 = 1
net.ipv6.conf.lo.disable_ipv6 = 1

Run service procps start

  • 2
    this is the cleanest way to do it - don't understand why was downvoted. it works on fedora/centos/redhat, too. it has the advantage that it does not alter system defaults files (like directly sysctl.conf as suggested in most popular answer) – Costin Gușă Nov 9 '17 at 9:23
  • @Costin I didn't downvote, but this won't always work. Sometimes you have to put the specific device name (e.g. in case of custom driver installations). See Alfonso Nishikawas comment on my answer. – polynomial_donut Oct 3 '18 at 19:09
  • I'm thankful I followed this approach, because I ended up losing my connection on a remote server (it needed IPv6), and it was very easy to direct my assistant on site to remove the one file and reboot. – Roger Dueck Mar 2 at 15:32
  • i had to run service procps restart instead on ubuntu 18.04 – iPherian May 28 at 2:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.