Guide for disabling ipv6

[darethas]

Hi, I asked the question in irc of how to get the nic to stop assigning an ipv6 address to my machine.

My first attempted solution was to use the cloud config's write_files section and write /etc/netconfig with the ipv6 lines commented out,

write_files:
  - path: /etc/netconfig
    permissions: 0644
    owner: root
    content: |
      udp        tpi_clts      v     inet     udp     -       -
      tcp        tpi_cots_ord  v     inet     tcp     -       -
      #udp6       tpi_clts      v     inet6    udp     -       -
      #tcp6       tpi_cots_ord  v     inet6    tcp     -       -
      rawip      tpi_raw       -     inet      -      -       -
      local      tpi_cots_ord  -     loopback  -      -       -
      unix       tpi_cots_ord  -     loopback  -      -       -

however I was still getting an ipv6 address.

@philips gave an answer in a gist to write a file called 10-disable-ipv6.conf to /etc/sysctl.d/ with the content net.ipv6.conf.eth0.disable_ipv6 = 1

so the cloud-config (or user_data if already installed on bare metal) would look something like this:

write_files:
  - path: /etc/sysctl.d/10-disable-ipv6conf
    permissions: 0644
    owner: root
    content: |
      net.ipv6.conf.eth0.disable_ipv6 = 1

This issue is per request. He asked if I could file an issue so they could remember to document it.

[dpetzel]

Was there anything else that need to due to have IPv6 disabled? I added the info above, and the /etc/sysctl.d/10-disable-ipv6conf file is created with the proper contents, but ipv6 still seems enabled.

Thanks

[marineam]

To apply to all interfaces replace eth0 with 'all' and probably another line with 'default' too. Then systemd-sysctl.service will need to be restarted or the machine rebooted.

[dpetzel]

Thanks, turns out the path is wrong in the example (I think).. changing /etc/sysctl.d/10-disable-ipv6conf to /etc/sysctl.d/10-disable-ipv6.conf and then restarting systemd-sysctl.service seemed to do the trick

[marineam]

Ah, doh. Yes .conf is significant.

[darethas]

Whoopsies, I missed a . (dot) between ipv6 and conf

[dpetzel]

No worries!. So I'm testing this out as part of bootstrapping new nodes, and it doesn't appear that the file gets laid down early enough to have an affect. On a fresh node I see the file (with the proper extension) put in place but IPV6 is still enabled. a manual systemctl restart systemd-sysctl.service does the trick, but I'd like the box to come up without it being enabled.

I tried leveraging the runcmd example that is listed in the cloud-config docs, but it appears it have ignored it saying Warning: unrecognized key "runcmd" in provided cloud config - ignoring section which is supported by the CoreOS docs suggesting only a subset of the cloud-config modules are supported.

So I think I could achieve this is a oneshot unit file, but I'm wondering if there is a better way?

[robszumski]

What's the status of this? Does this need to be addressed in any documentation we currently have?

[jumanjiman]

fwiw here's how i disable ipv6 on all interfaces:

# i actually use user-data (cloud-config) to write this file:
core@ip-192-168-17-202 ~ $ cat /etc/sysctl.d/10-disable-ipv6.conf 
net.ipv6.conf.all.disable_ipv6 = 1

# apply the config
core@ip-192-168-17-202 ~ $ sudo systemctl restart systemd-sysctl

# check addresses
core@ip-192-168-17-202 ~ $ ip -6 addr show
core@ip-192-168-17-202 ~ $ ip -4 addr show
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default 
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
2: ens3: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 9001 qdisc mq state UP group default qlen 1000
    inet 192.168.17.202/24 brd 192.168.17.255 scope global dynamic ens3
       valid_lft 3151sec preferred_lft 3151sec
3: docker0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 9001 qdisc noqueue state UP group default 
    inet 172.17.42.1/16 scope global docker0
       valid_lft forever preferred_lft forever

[gswallow]

I had to reboot my coreos vm after applying the changes through configdrive.iso. The first boot seems to write the file, while the second boot respects the applied changes.

Also, I disabled IPv6 (aside from the fact that it's wholly unnecessary in a 40-employee shop) because this:

Aug 05 11:24:14 localhost systemd-resolved[495]: Detected conflict on localhost IN AAAA 2604:8800:100:81a0:250:56ff:fe3f:92a5
Aug 05 11:24:14 localhost systemd-resolved[495]: Hostname conflict, changing published hostname from 'localhost' to 'localhost3'.
Aug 05 11:24:14 localhost systemd-resolved[495]: Assertion 'e->key == i->next_key' failed at /build/amd64-usr/var/tmp/portage/sys-apps/systemd-220-r4/work/systemd-220/src/shared/ha

[schneidexe]

@gswallow to get it on first boot you can add this to your cloud-config:

coreos:
  units:
    - name: systemd-sysctl.service
      command: restart

[codemedic]

#cloud-config

---
write_files:
- path: "/etc/sysctl.d/10-disable-ipv6conf"
  owner: root
  content: |
    net.ipv6.conf.all.disable_ipv6=1
coreos:
  units:
  - name: systemd-sysctl.service
    command: restart

The above cloud-config does not seem to make any difference. It does create the file, but no change to the kernel config.

Whereas when I run the sysctl command manually (as below) it does work.

sysctl net.ipv6.conf.all.disable_ipv6=1

Any idea why cloud config is not taking effect?

[mimmus]

Peraphs you need a .conf in the filename under /etc/sysctl.d

[simonvanderveldt]

Peraphs you need a .conf in the filename under /etc/sysctl.d

Yeah, that's probably it.
The combination of a .conf file containing the disables and a restart of sysctl works for us so far.

What net.ipv6.conf.all vs net.ipv6.conf.default does is a bit unclear, but judging by experiences from others it makes sense to disable both. See https://unix.stackexchange.com/questions/90443/sysctl-proc-sys-net-ipv46-conf-whats-the-difference-between-all-defau/90560#90560

write_files:
  - path: "/etc/sysctl.d/10-disable-ipv6.conf"
    owner: root
    content: |
      net.ipv6.conf.all.disable_ipv6=1
      net.ipv6.conf.default.disable_ipv6=1
coreos:
  units:
    - name: systemd-sysctl.service
      command: restart