topic IPv6 single-stack? (Points!) in Operating System - Linux

IPv6 single-stack? (Points!)

Christian Deutsch_1 — Fri, 17 Dec 2010 14:39:49 GMT

Hi there,

I am doing some testing with IPv6.

I am wondering, if I got this right, Linux 2.6 kernel systems are usually dual-stack (IPv4+IPv6) out of the box after installation.

Is it easy to set up a Linux 2.6 kernel machine as IPv6 only with really only the IPv6 networking stack on that system?

All truly helpful responses will be generously rewarded with points!

Thanks, Christian

Re: IPv6 single-stack? (Points!)

Matti_Kurkela — Fri, 17 Dec 2010 15:35:54 GMT

Even the latest Linux kernel (2.6.36.2 at this time) does not yet support compiling the IPv4 support as a module.

The kernel compilation option that controls IPv4 support is CONFIG_INET, and disabling that will also disable IPv6 support.

So it seems it isn't possible to _remove_ the IPv4 stack from Linux yet. Although I believe that may eventually become possible, when/if IPv6-only networks become common enough.

However, you can *completely block* the IPv4 functionality very simply using iptables:

iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT DROP
iptables -F
iptables -X

This will set all the built-in IPv4 chains (INPUT, FORWARD and OUTPUT) to DROP all packets unless other rules say otherwise, then clears all the other rules and removes any custom rule-chains.

After this, even if you still have IPv4 addresses configured on a NIC, the system will not process any incoming IPv4 packets.

To be doubly sure, you can then remove all IPv4 address assignments from the NICs, making them IPv6-only.

The IPv6 firewall rules are controlled with the command "ip6tables", so they aren't affected by this.

MK

Re: IPv6 single-stack? (Points!)

Christian Deutsch_1 — Mon, 20 Dec 2010 15:25:39 GMT

Thanks MK,

That's very helpful indeed!

What about if I want to restore IPv4 communication?

To get the complete picture would be nice :)

Thanks, Christian

Re: IPv6 single-stack? (Points!)

Matti_Kurkela — Tue, 21 Dec 2010 14:44:21 GMT

Those iptables settings are not persistent unless you write a script that does them at each boot, or use a distribution-specific method to save the iptables settings.

In RHEL 4 and newer, the command to make the current iptables settings persistent is:

service iptables save

(NOTE: this will overwrite the previous rule set. If you want to save it, backup "/etc/sysconfig/iptables" before running this command.)

To re-enable IPv4 traffic without rebooting, just reload your previous iptables rules. Or if you didn't use iptables before, these commands can be used to restore the kernel default "allow everything" policy:

iptables -P INPUT ACCEPT
iptables -P OUTPUT ACCEPT
iptables -P FORWARD ACCEPT

(The "-F" and "-X" options are not needed this time: they would delete any exceptions to the default rules.)

MK

Re: IPv6 single-stack? (Points!)

Christian Deutsch_1 — Thu, 23 Dec 2010 14:33:06 GMT

Thanks MK,

That's wonderful!

Very helpful!

Happy Christmas!

Christian

Re: IPv6 single-stack? (Points!)

Christian Deutsch_1 — Thu, 23 Dec 2010 14:33:52 GMT