bullseye - how to configure eth1 for LAN only ?

Raspbian uses systemd for configuration.

As stock, it will use whatever service is specified in /usr/lib/systemd/system/ (previous versions may use /lib/systemd/system/)

On mine it is dhcpcd.service with ExecStart=/usr/sbin/dhcpcd -b -q To me, that means configuration is done in /etc/dhcpcd.conf

Another possibility is NetworkManager.service, configuration in /etc/NetworkManager/*

One I've never seen is dhclient.service which would have configuration in /etc/dhclient/dhclient.conf

Yes, really. The DSL320B I've used for years currently has several problems:

- its screwing with the fourth term of the IP address,which causes pinging other hosts on my LAN to fail - this seems to be corrupting the 4th term of a fixed IP address

- my DSL320B can currently connect to the outside world from either of the two hosts on my LAN, but neither host can talk to the other one. AFAIK there's no problem with my CAT5/6 switch

- the DSL320B should be configurable via http or telnet, but neither Firefox nor Lynx shows any ability to access the DSL320B via an http connection. If I point telnet at it, it accepts the default user name, 'admin', but doesn't accept the password, which also defaults to 'admin'.

- I got a replacement off eBay, because I couldn't find a retailer with any in stock and its even worse. It won't even accept the default user name. and can't be pinged.

- The DSL320B manual says you can reset a DSL320B by poking a 'biro' into a 'reset' hole, but this is a lie: the hole is both too small and too deeply inset for any biro I've seen to work.

However it should be resettable if you push a toothpick, some 1mm alloy tube or a shaved down matchstick into the small (1.5mm) 'reset' hole until you hear the switch click while holding the power switch down and keeping it pressed 10-15 seconds, but this failed to reset either of the DSL320Bs.

My problem is that there currently is no fibre available where I live: its ADSL or nothing at present as I'm not keen on WiFi.

I'm currently on the Zen waiting list until fibre connectivity gets installed (I'm not holding my breath for this) but am about to see if they Zen can take over my current ADSL link anyway, by installing a Fritz box, which is what they apparently use as the fibre terminator, but for use as an ADSL terminator in the meantime.

IPv6 link local addresses are local to the LAN segment (they cannot be used for forwarding enforced by the stack), generated automatically on the host with a duplicate address detection phase and used for DHCPv6 communication to provide public addresses, router information etc.

IPv4 private addresses are local to the LAN, they can and are used for forwarding across routers on a LAN but should not be routed across the public internet. It is only firewall configuration in routers that prevents this.

fundamental to IPv6, it won't work without them.

The definition of the IPv6 protocol. Yes you could hack the protocol stack to do anything you like but as long as you have a compliant IPv6 stack then the link local address will never be used as a source address unless the target is another link local address and packets with link local addresses (either target or source) will never be forwarded they have to go direct or not at all.

It doesn't block sending it blocks forwarding - for a packet to leave a machine with link local addresses it has to originate on that machine, if it arrives for forwarding it will be dropped. IOW the only link local target address a host accepts is the one on the interface the packet arrived at.

The link local address can be used between hosts on the same LAN segment so for example it is very common for the link local address of a router to be used as the default route by every host using that router. This address will remain unchanged (and advertised via DHCPv6) no matter what changes are made to the routed networks.

Chris,

Now you say that I remember having seen that been mentioned before. Didn't focus on it though, as I thought dhcpcd.conf would rule those settings. :-\

Hmmmm... I wonder if I can use a

net.ipv6.conf.all.disable_ipv6 = 1 net.ipv6.conf.eth1.disable_ipv6 = 0

sequence to disable all /but for/ a specific interface ...

Yup, seems to work. Nice.

Are you sure about that ? I cannot just make up a word, put it there have the setting applied to the interface I was thinking of ? Bummer ... :-)

Regards, Rudy Wieser

Ahem,

My brain balks about something thats "fundamental to IPv6", but is not an /internal/ IP (like 127.x.x.x) is. One of my pet peeves with Windows is that certain open ports facing the LAN cannot be closed (no way to do it) and terminating the service that opens them cannot be done as the service is also used for the internal working of the OS (using a 127.x.x.x IP).

And thats an explanation I can understand : both the source and target must be "link local addresses" to be able to make it thru the ipv6 stack. Obvious when you are aware of it (as with so many things). Thank you.

:) That was not quite what I ment.

I was trying to wrap my head around how an "link local address" datapacket could come outof the ipv6 stack in a 'puter, but not outof the same in a router. Your "source and target must be of the same kind" explained it.

Regards, Rudy Wieser

I have a pretty good Cisco (Linksys rebadged) SOHO ADSL router Its even got PSTN ports for voip.

Needs a wall wart as I pinched that for the Netgear.

Runs warm in use, but never fails. If you are in the UK I'll post it

Oh. I can still buy ADSL routers without WiFi in the UK

It sort of is internal - to the LAN not the machine, rather like MAC addresses, the main use is to enable unicast addressing to be used for almost everything and minimise the use of broadcast addressing. It's all about scalability really - making it easy to manage a LAN with tens of thousands of hosts (horrible thought!).

Cellphone data plan connections use IPv6 and need it AFAICT, IPv4 NAT and DHCP would be a nightmare in that environment.

I use pfSense on NUC type PC circa 2016, before that I used tomato firmware on a cheap router, both very good.

I wouldn't recommend a bespoke router, unless you wanted everything in one box modem/router/wifi.

For Wifi the modern mesh systems are very good at roaming in a big house, very cheap. I have 4 access points or whatever they are called, dropped wifi is a thing of the past.

Sorry about the slow reply: I'm bringing up a new server (current AMD silicon, solid state storage) damn quick, and sort of lost track of the time. The problem it that I was almost too late on making the swap, because the last backup has a bit of minor file damage: just enoughto make life mire 'interesting' than I wanted. The old dual Athlon box totally shat on the update I ran after the backup and I thought that the backup had survived untouched, but it had just enough damage to be annoying.

That aside, Fedora 37 loaded easily, apart fom a bu=it of nonsense from Brave (crashed immdiately, but today's upgrade fixes that) and the latest Evolution is pretty much a mess on the new box and I've still to migrate PostgreSQL to v 14. On the other hand, Java is up an running without problems, most of my C stuff looks to be OK and Apache is doing its thing pretty well apart from geany needing a reinstall: not yet diagnosed.

My DSL320B ADSL' walwart has a 3.7mm OD coax plug that delivers 12v @

Thanks for the unexpected offer!

Ahem,

Thats the thing : I do *not* want my machine to just talk to other machines (on the same lan or not) - at least not without my explicit say-so.

I regard it as a weakspot, to be exploited when one of those machines on the LAN gets taken over by malware (and tries to find a way into other machines).

All I can think about when I read that is of companies who had to shut down and had to do a major cleanup because one person got its computer infected and than it spread from there. :-\

Regards, Rudy Wieser

Ah you sure? At some level my cellphone sits behind a massive NAT when contacting IPV4 hosts

My solution there has always been to run a firewall on every machine on my LAN so that only the ports used by the software your computers use to talk amongst themselves are open: this means that only ssh (22), smtp (25), http(80), sftp(115), nntp(119) ntp(123), rsync(873) and maybe ftp(21) and SAMBA (if you have Windows boxes on your LAN) are likely to be open, but its worth looking at /etc/services as a reminder of what the various ports are used for.

Then make a similar (and smaller) list of the ports you're willing to open in your LAN firewall to accept incoming traffic.

Note that these incoming ports do not need to be open if you always open connections FROM your systems TO external servers: IOW you can use a webreader such as Firefox without opening port 80 and you can send and receive mail without opening port 25 if you run a mail server on your LAN and use, say, getmail to collect incoming mail from your mailbox on your ISP.

So, call me paranoid, but I don't have any firewall ports open to the wider internet: I use getmail, run as a cron job every 10 minutes to retrieve incoming mail and pass it to a local Postfix server for distribution to laptops etc. The public copies of my websites are hosted by my ISP: I maintain identical master copies locally and update the public versions by exporting new and updated pages to the hosting site by using gftp.

Mmm. Its a Cisco 527W . I have full PDF docs. They are online anywhere.

If you don't want wifi you can turn it off.

It is actually a seriously reliable router for ADSL .

The input thingie is coaxial and says 12VDC on it OD looks like 5 or 6 mm

Oh. I checked. The Netgear POS has a Netgear PSU so I initiated a rummage through the cable box which elicited another PSU that seems to power the Cisco up. I think it is the one it always had. I lost track of the Cisco during the divorce.

Um you can email me at webmaster at gridwatch.org.uk

I'll then switch to a more used email address.

And I can post it to you.

IPv6 hardly even works via my telco with mobile broadband (usually fails to connect to the phone tower when enabled - with a modem sold by the same telco). If they're having nightmares, they must be from IPv6, not IPv4. But I suspect they don't care much.

NetworkManager is another all-encompassing thing from Red Hat, like Systemd. Over complicated and poorly documented as usual from what I've seen, but no sign of the Linux kernel itself requiring it, so it should be safe to ignore so long as your Linux distro doesn't become obsessed with it. If Ubuntu's desktop software requires it then maybe they are going down that path though.

CGNAT is pretty common on those to provide IPv4 connectivity. Mine currently has an address in the 10.x.x.x range, as well as an IPv6 address.