8

I have a domain name that points toward my home server. Under every Ubuntu release up through Wily, by default I had a stable EIU-64 address that I could use for my AAAA record. However, after installing Xenial, I don't seem to get a stable address by default.

joejoe@myserver:~$ ip address
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host
       valid_lft forever preferred_lft forever
2: enp2s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
    link/ether 00:24:1d:d2:e3:f4 brd ff:ff:ff:ff:ff:ff
    inet 192.168.0.101/24 brd 192.168.0.255 scope global enp2s0
       valid_lft forever preferred_lft forever
    inet6 2601:280:3068:2945:74ed:b303:6474:6e29/64 scope global temporary dynamic
       valid_lft 6965sec preferred_lft 3363sec
    inet6 2601:280:3068:2945:ac34:ea15:4340:29a4/64 scope global temporary deprecated dynamic
       valid_lft 6965sec preferred_lft 0sec
    inet6 2601:280:3068:2945:bdfd:6253:b07e:1308/64 scope global mngtmpaddr noprefixroute dynamic
       valid_lft 6965sec preferred_lft 6965sec
    inet6 fe80::dc3e:6127:bd4e:18b/64 scope link
       valid_lft forever preferred_lft forever

As you can see, all of the inet6 addresses with scope global have limited lifetimes. Is there a way to get my EIU-64 address back, or is there some other way to get a stable address that I can use in a domain name record?

7

I just figured this out. For each connection in /etc/NetworkManager/system-connections/, you need to set the following property:

[ipv6]
addr-gen-mode=eui64

NetworkManager in 16.04 appears to set a default of stable-privacy for the addr-gen-mode setting. When stable-privacy is set, a random address is generated each time, even when ip6-privacy is set to 0.

0
7

The other answers here are a bit incomplete: changing NetworkManager configs doesn't help if you don't have one (which is actually the problem, see below), and disabling IPv6 privacy extensions is actually somewhat unrelated (again if your supposedly-stable IPv6 address changes on each boot, removing the extra privacy addresses doesn't help).

As detailed in this thread, a default, new install of 16.04 has a slight oversight if you are using a wired connection. NetworkManager automatically generates an "ephemeral" configuration, which works great but is, well, ephemeral. This means that the GUID used to hash into a supposedly-consistent IPv6 address isn't stored, and so you get a new one each boot. Just going into NetworkManager, pressing "edit" on the wired connection, and saving it with no changes will generate an actual NM config, with a saved GUID, and so you'll get the same IPv6 address each boot.

This address is an RFC7217 address (a crypto hash of the GUID, your prefix, etc etc) -- so although it's stable each boot, it isn't the sort that includes your MAC address into the address directly. If you want one of those EUI64 addresses, this other answer on this question details how to change that.

6

Ubuntu 16.04 and previous releases have always defaulted to the EIU-64 for me, so for servers I have to disable it. I'm happy to use the privacy address on my desktop.

So you need something like:

    sysctl -w net.ipv6.conf.all.use_tempaddr=0
    sysctl -w net.ipv6.conf.default.use_tempaddr=0
    sysctl -w net.ipv6.conf.default.use_tempaddr=0
    sysctl -w net.ipv6.conf.<devname>.use_tempaddr=0

Then ifdown/ifup. The result for me, note the MAC/IPv6 relationship:

$ ifconfig enp3s0 | egrep 'HWaddr|Global'
enp3s0    Link encap:Ethernet  HWaddr 74:d0:2b:90:8b:90  
          inet6 addr: 2501:300:d008:61c8:76d0:2bff:fe90:8b90/64 Scope:Global

You can name specific interfaces if you need it enabled on some interfaces not others. You can see the list with:

$ sysctl -a | grep tempaddr

I don't recommend Network manager for production services. For instance it doesn't it does't play well others, like /etc/sysctl.conf for instance. If you want to do that you willl need an entry in /etc/networking/interfaces for a static address or an automatically configured one. I'm just using:

auto enp3s0 
iface enp3s0 inet dhcp
iface enp3s0 inet6 auto
pre-up modprobe ipv6

Adjust to taste of course.

5
  • Sorry for taking to long to accept, but I'm having trouble with your answer. Beyond your suggestion of using sysctl -w, I've tried writing net.ipv6.conf.all.use_tempaddr = 0, net.ipv6.conf.default.use_tempaddr = 0 to /etc/sysctl.d/10-ipv6-privacy.conf and restarting, and the Network Manager GUI indicates that privacy extensions are disabled, but I still end up with IPv6 addresses that are temporary and not related to my MAC address. May 11 '16 at 5:01
  • Well tinkering with sysctl is incompatible with the network manager. Do you have something like this in /etc/network/interfaces: auto enp3s0 \n iface enp3s0 inet dhcp \n iface enp3s0 inet6 auto \n pre-up modprobe ipv6 \n That should disable network manager for that interface. But the places it can be are /etc/sysctl.conf or something like /etc/sysctl.d/10-ipv6-privacy.conf. If you want to fix it with networkmanager there should be a per interface file under /etc/NetworkManager/system_connections and you can put a ip6-privacy=0 under [ipv6]
    – user206966
    May 14 '16 at 2:44
  • Hrm, thanks for the tip about the NetworkManager config files, but ip6-privacy=0 is already present there. Seems like possibly a NetworkManager bug. I'll switch to ifup/down as you suggest and see what that does. May 15 '16 at 18:24
  • This Launchpad bug says NM should now be reading from the sysctl settings but there are reports near the end that it is not fixed. May 15 '16 at 18:31
  • Confirmed: switching to ifup/down and sysctl instead of Network Manager can disable IPv6 privacy extensions. May 15 '16 at 18:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.