Serious Discussion Why do some members disable IPv6 in their setup configurations?

lokamoka820

lokamoka820

Level 52
Thread author
Verified
Top Poster
Well-known
Mar 1, 2024
4,123
3
14,688
5,069
Banana Republic
Yesterday, while checking the forum's setup configurations, I noticed that some members disable IPv6. After doing some research, I found that it is now considered the standard and not recommended to disable. This made me wonder why some members choose to turn it off—could it be due to security or privacy concerns?

Thanks.
 
  • Like
Reactions: SeriousHoax, stonjean633, Wrecker4923 and 2 others
Some member's older modem/router may not support ipv6. Like 6 yr or more old routers.
IPv6 is still consider new, and it's features are not considered well understood, so that could be a security concern as well. I used to turn it off for that reason.
Then for enhanced connectivity, I turn it on now. You don't need to turn on dhcpv6 on the router, ipv6 automatically generate addresses beginning with fe80: for every machine on the networrk. On the PC just set ipv6 to auto.
 
Last edited:
  • Like
  • +Reputation
  • Thanks
Reactions: SeriousHoax, lokamoka820, Parkinsond and 2 others
Parkinsond said:
After Windows fresh install, I turn off every single feature or service I am not going to use, and remove all unncessary apps and components.

Run safer, run faster.
Click to expand...
I don't even bother with services now except for RDP, ERROR REPORTING & UNUP. Too much hassle for little benefit.

You can lock down your PC but in the end someone somewhere will find a way around it. Even airgapped boxes are compromised.
 
  • Like
  • Hundred Points
  • Sad
Reactions: Divine_Barakah, Parkinsond, lokamoka820 and 1 other person
Zero Knowledge said:
You can lock down your PC but in the end someone somewhere will find a way around it.
Click to expand...
Depends what is the focus of the lockdown. I focus on Mitre Attack's Persistence column. Because I take it that there are zero days and no amount of patching will do you any good. And reputable antimalware miss 9-15 on any day. So I take on the next phase, which is persistence. And most TTP's are understood. Eg: Run from writable directories like AppData, scheduler abuse etc. And those can be countered with lockdown. Not all TTPs, but lets say 90%.
 
  • Like
Reactions: SeriousHoax, Parkinsond, Zero Knowledge and 1 other person
I never turned mine off intentionally. I note that IPv4 sites sometimes flag shared IPv4 (CGNAT, duh!). Bitwarden used to be one of the sites. Reddit has since become one of the sites (rate-limiting responses, etc.).

I think VPN services didn't protect IPv6 for a while, so people may have turned it off too to prevent leaking. IPv6 also identifies the machine, whereas IPv4 identifies the router. An IPv6 VPN that gives you a new address on reconnect may mitigate some of that.
 
  • Like
  • +Reputation
Reactions: SeriousHoax, Parkinsond, bjm_ and 2 others
When I bought my router, the IPv6 had default configurations which I could not set in the router's console. When the console update it turned out that all security features of IPv6 were configured well. Because I did not know it was configured well out of the box (and my VPN did not work on IPv6), I opted to disable it because there was some FUD about IPv6 not configured well out of the box at that time.

I could enable all security features for IPv4 (NAT of course but also SPI-firewall, IP & MAC binding, DDOS protection and FLOOD attacks etc), so I opted for the version which gave me control. Because it works well and IPv4 will be supported for some time, I did not bother to change it again (don´t fix what ain't broken).
 
Last edited:
  • Like
  • +Reputation
Reactions: Parkinsond and lokamoka820
lokamoka820 said:
But how can you tell if a device supports it, and does the operating system matter?
Click to expand...
My 3–4-year-old ISP router supported it out of the box (preconfigured). My 4-year-old Android phone also supported it out of the box. A quick way (without checking all the devices) is to connect your newer phones directly to the ISP router, check if the phone receives IPv6 addresses, and then check WhatIsMyIP to see if machines outside your ISP network can your IPv6 address.
 
  • +Reputation
Reactions: Parkinsond
Zero Knowledge said:
Yeah but it's the 1% that gets you pwned. When MS patches 400 vulnerabilities/exploits a month there is no hope for even the seasoned security pro.
Click to expand...
Yes, it is that one hole that you don't know about that gets your pwned, all it takes is one. Regardless if you have perfectly mitigated the rest.

But as for that 400 vulnerabilities they are finding per month, it actually gives us hope - hope that the good guys AI will find the vulnerability before the bad guys do. And MS has access to Anthropic's Mythos, and they have their in house MDASH. So now it is just a matter of man power dedicated to the task of finding those vulnerabilities using automated tools. The Linux Foundation also have access to Mythos, and I am sure work is under way. Antrhopic called it their GlassWing group of orgs, and hasn't allowed anybody else access to Mythos.
 
Last edited:
  • Like
Reactions: SeriousHoax and Parkinsond
I was disabling because my ISP didn't support it. Later moved to an ISP that does, so I am using it now.
I mainly experience two practical benefits, one is torrenting (had to open a port in the router firewall, not port forwarding) and the other one is far fewer Google Capcha verifications around the web while using IPv6. I used to get it every single time when I searched something in Google in the browser's private mode (somewhat IP blacklisting by Google), which has completely disappeared with IPv6. If I disable IPv6, then I get them again. When you're on a dual-stack network, Windows and Android both give priority to IPv6. I noticed that my IPv6 ping for Google is higher (bad routing by my ISP's upstream provider) than IPv4, yet I always get connected to IPv6 Google.
Victor M said:
Some member's older modem/router may not support ipv6. Like 6 yr or more old routers.
IPv6 is still consider new, and it's features are not considered well understood, so that could be a security concern as well. I used to turn it off for that reason.
Then for enhanced connectivity, I turn it on now. You don't need to turn on dhcpv6 on the router, ipv6 automatically generate addresses beginning with fe80: for every machine on the networrk. On the PC just set ipv6 to auto.
Click to expand...
Not an IPv6 expert, but I see that my ISP only delegates a /64 IPv6 prefix to me. With only a /64 prefix, the guest wifi VLAN that I created and devices connected to that don't get IPv6. /64 can only give IPv6 to one interface. So I had to use NAT66 to to give guest_wifi clients IPv6. They don't really need IPv6 but I gave them anyway. I had to seek Claude's help for understanding and configuring this on the router.
Zero Knowledge said:
Yeah but it's the 1% that gets you pwned. When MS patches 400 vulnerabilities/exploits a month there is no hope for even the seasoned security pro.
Click to expand...
Yeah, 400 thanks to AI. Didn't Firefox found a plethora of security issues in their code using Claude's AI a couple of months ago?
I see that even Linus Torvalds of Linux is using AI to make his job easier to manage and merge fixes. AI is a tool for both good and bad guys
Phoronix, which closely tracks the cycle, describes the current environment as one in which AI and LLM coding and review agents keep kernel activity at an all-time high. It has resulted in a much larger-than-normal Release Candidate this late in the cycle; RC7 comes packed with a plethora of bug fixes that would otherwise have been in play much earlier in past cycles.

By one count of the RC7 pull, more than 400 fixes came in from upwards of 230 contributors, a volume more typical of an early merge window than a closing candidate.
Click to expand...

 

You may also like...