bullseye - how to configure eth1 for LAN only ?

My Mint uses neither. There is an nm-applet. But dhcp is only used at boot time normally.

Only think that looks relevant on my rig is 'NetworkManager

The config file seems to be

/etc/NetworkManager/system-connections/Wired connection 1.nmconnection

------>

Just a small quibble - while the whole /boot/cmfline.txt thing is Pi specific, the ipv6.disable=1 kernel parameter setting should work on all Linux kernels.

Either dhclient or dhcpcd should persist so that it can renew the lease when the time comes - try a ps -elf | grep dhclient or pgrep -lf dhclient.

Could be, no real reason to try it.

Chris,

I tried both seperatily and together (even though the latter seems to includ the former), but ifconfig still shows ipv6 adresses. :-\

Thats pretty much the first thing I did after your suggestion to edit that file. Its where I got that "ipv4only" thingy from (which doesn't work as I imagine it would).

I've got to take your word for that, as I do not (yet) posess that knowledge - which is why I mentioned what my starting point is, so we would be on the same page. Thank you for mentioning it.

And thanks for those. I think I found those myself too, but didn't actually read them as it /looked like/ dhcpcd.conf had the means to gouvern them (and assumed a similar problem as in regard to dhclient - looking at the wrong thing)

But a bit of a bummer : I was assuming that I could disable it for one interface, but keep it enabled for another.

Regards, Rudy Wieser

Ahem A Rivet's Shot,

it (eth1) is.

So every of those "noipv6" and "ipv4only" things in (man) dhcpcd.config are fake ? They actually don't do squat ? That would perhaps have been a good april first joke, but not on any other day. :-(

:-) All computers on my LAN (and probably yours too) have local ipv4 adresses, but they can still connect to other computers all over the world.

The thing is that that I have multiple computers on my lan, and I don't want to discover that one of them is using ipv6 - which I do not use and as such have very little knowledge of - as a weakpoint to gain access to others.

Regards, Rudy Wieser

Not at all, they control whether or not dhcpcd issues public IPv6 addresses. You get link local addresses without dhcpcd or anything other than an IPv6 capable kernel.

The link local addresses that are provided by the kernel are nothing more than a standard wrapper around the MAC and they really are only valid on the LAN segment (same as the MAC) they cannot cross any kind of router internal or external, unlike IPv4 private addresses which are by convention not permitted to cross routers into the 'public internet' and have been known to cross boundary routers in both directions.

I'm not sure it's possible to NAT IPv6 link local addresses, you'd certainly have to work at it, by default there's no kind of NAT used for IPv6 the addresses are either link local or public.

Ahem,

I realized only later that what you mention in that the last line could be the case.

Do you happen to know if its possible and if so how to configure ipv6 to /not/ to generate such a "link local address" and only expose an address if provided thru dhcp (so it functions the same way ipv4 works and its a per interface thing) ?

:-) Just send the request to the "default gateway" machine and it does some NAT magic to get the request done using a "IPv4 private address" on the internet regardless.

Sort of. /Some/ "IPv4 private addresses" may go one way, /others/ may go the other way. Which ones is under control of and has to be configured per router.

Do you know What would be the difference between ipv4 and ipv6 that would make it especially hard to do for the latter ?

Thats just because there are way more ipv6 IPs available than we currently can use, and NAT-ing hem would (look to) be a bit silly - an exercise in futility.

Regards, Rudy Wieser

Chris,

I've applied all three, and after rebooting looking at ifconfig I do not see any ipv6 any more. Thank you.

One question though : The latter two entries seem to be subsets of the first one. Is there something I'm missing or is this just a case of wearing a belt /and/ suspenders ?

Regards, Rudy Wieser

Nope. xxx@juliet:~/Desktop$ ps -elf | grep dhclient

Nada. What does persist its network stuff

$ ps -elf | grep net

--run-startup-triggers

I conclude that in later versions of Mint desktop systems neither dhclient nor dhcpd are used.

I have found the layer upon layer of obsolete and obsolescent networking files to be a total pain to deal with.

And indeed even though my server is set to static IP address via network manager it also has a ghost IP address assigned by DHCP. This responds to pings and shows up on the router dhcp tables, but is otherwise completely unused for anything

I have concluded that like so much software, Mint/Ubuntu/Debian is being overwhelmed by the dreaded weed Creeping Featurism and and has been debugged only insofar as to work for 'normal' situations, and underneath is a BFM. A Bloody F****ng Mess, that like postscript and X windows has been stabilised by the general principle of 'buggering around till it sorta works'.

Unless you want to probe the dark slough of everyone else's hackery, I strongly suggest that you give DHCP the old heave-ho on that interface and go static.

DHCP is there to solve a problem you don't have. Don't fight it. Or its myrmidons. Cut the Gordian knot and shoot it in the head.

It is not DHCPv6 uses the link local addresses for communication. They're rather fundamental.

Quite it's by convention and if the router misbehaves the 'private' addresses leak. Whereas the link local addresses are protocol level and their behaviour is built into the IPv6 stack.

The Ipv6 NAT protocol definition :)

I rather think there are more than we will ever be able to use. If I turn on IPv6 from my ISP I get a /56 block all to myself, or Hurricane Electric will give me a /48 and a /64 over a free tunnel. By contrast I had to pay for the use of a *single* static IPv4 address.

It is not even sure where Raspian picks up its config files from. These may belong to obsolete software 'left in place' because no one dared touch it and the thing works now anyway.

I shouldn't worry. IPv6 like so many other great ideas invented by bright eyed bushy tailed ComputerScientists™, doesn't really work, and probably never will.

The reality is that there are 32 bits of IPV4 address and 32 bits of port addresses within that. More than enough

And 99% of all the worlds devices sit happily behind NAT routers. Like most of TCP/IP, NAT is a kludge invented to MakeStuffWork, is ugly, properly offends ComputerScientists™, but is robust enough to DoTheJob.

Its also worth remembering that your LAN's firewall router may well have a DHCP router buried in its innards and if this device suffers from bit rot in the EPROM that holds its firmware and configuration parameters, then you can get some unpleasant network problems, particularly a problem for those of us still limited to ADSL connections;

The only source of replacement ADSL routers now appears to be eBay:

Really?

Yeah, My well hated router was not D-link. That did well till lightning popped its front end, but Netgear. I have one of those serving as a wifi access point, it needs rebooting now and again. It also got unreliable after a heavy storm

Consumer routers are mostly utter crap. I have a Draytek now, and it all actually works.

Its got ADSL but Ive migrated to fibre, and id does ethernet WAN as well (like cable)

Ahem,

I'm still not grasping the distinction between an ipv6 and ipv4 "local address" I'm afraid.

I've just disabled ipv6 on my RPi and have not noticed anything failing. IOW, they can't be /that/ fundamental.

If you mean they are fundamental in regard to communication between computers on the same lan segment, than thats exactly what I want to limit - especially as I have no idea what services have ipv6 ports open.

I don't quite get that I'm afraid : If data send and received using such a link local address can be read by software connecting to the ipv6 stack, what than stops a router to do with as it pleases ?

Or, said otherwise : if the ipv6 stack somehow internally blocks data send using such a link local address how would a router - or even a standard 'puter - be able to use that local link address to begin with ?

:-) Thats what I tried to convey.

Regards, Rudy Wieser

Ah. Brain fade. Yes