Path: csiph.com!fu-berlin.de!uni-berlin.de!individual.net!not-for-mail From: "Carlos E. R." Newsgroups: alt.comp.software.firefox,alt.os.linux,comp.mobile.android,alt.internet.wireless,alt.comp.os.windows-10 Subject: Re: PSA: IPv6 browser privacy leaks are caused by the host yet there's a simple fix Date: Tue, 21 Jul 2026 19:28:23 +0200 Lines: 164 Message-ID: References: <113kg6k$s72$1@nnrp.usenet.blueworldhosting.com> <113n4f1$1chl$1@nnrp.usenet.blueworldhosting.com> <113nlki$1k8p$1@nnrp.usenet.blueworldhosting.com> Mime-Version: 1.0 Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 8bit X-Trace: individual.net F+8QhVLYQz+fmN38iZDS4g71AICb+Ho2+t2ybzB3RZh9T6FG5O Cancel-Lock: sha1:AGI7gXip191uhsz0gCPDDXD2WOI= sha256:8k5yLkQMXRjftV6kyYKSK+E2GYi6ySImLBNRsvMpI94= User-Agent: Mozilla Thunderbird Content-Language: en-GB In-Reply-To: <113nlki$1k8p$1@nnrp.usenet.blueworldhosting.com> Xref: csiph.com alt.comp.software.firefox:17859 alt.os.linux:82997 comp.mobile.android:154522 alt.internet.wireless:18900 alt.comp.os.windows-10:194697 On 2026-07-21 13:36, Maria Sophia wrote: > Carlos E. R. wrote: >> There are several ways to disable IPv6 on Linux, depending on whether >> you want the change to be temporary or permanent. > > I agree with everything Carlos suggested, where I ran a few searches to > help everyone on these newsgroups test, right now, their IPv6 protection. > There is another trick in Linux to make the system prefer IPv4 over IPv6 if both exist. Idon't remember what it was, so again I asked ChatGPT, and yes, that was it: Yes. You're probably thinking of **changing the address selection policy** so that applications **prefer IPv4 over IPv6** rather than disabling IPv6 entirely. On systems using the GNU C Library (`glibc`), this is controlled by `/etc/gai.conf`. Edit: ```bash sudo nano /etc/gai.conf ``` Find this line: ```text #precedence ::ffff:0:0/96 100 ``` Uncomment it: ```text precedence ::ffff:0:0/96 100 ``` This gives IPv4-mapped addresses a higher precedence, causing `getaddrinfo()` to return IPv4 addresses before IPv6 ones in most cases. ### What this does Suppose a host has both: ``` example.com ├── A 203.0.113.5 └── AAAA 2001:db8::5 ``` Normally, many Linux systems will try the IPv6 address first. With the `gai.conf` change, most applications will instead connect to the IPv4 address first. ### What it does *not* do * It **does not disable IPv6**. * Applications that explicitly request IPv6 can still use it. * Programs that don't use `getaddrinfo()` or implement their own address selection may ignore this preference. ### Why it exists This mechanism follows the address selection rules defined in RFC 6724. The default policy prefers IPv6, but `gai.conf` allows administrators to override the precedence. ### Is this useful for avoiding VPN leaks? Not really. It reduces the chance that applications will choose IPv6, but it doesn't eliminate it. If your concern is privacy or ensuring that **all** traffic goes through a VPN, the correct solution is one of: * use a VPN that tunnels both IPv4 and IPv6, * configure the VPN to disable IPv6 while connected, or * disable IPv6 system-wide. Changing `gai.conf` is more appropriate when you have a network where IPv6 technically works but performs poorly or is unreliable, and you want applications to favor IPv4 without removing IPv6 support altogether. > Below are some IPv6 leak tests I think everyone should run at least once. > > We're all working together as I'll wager many of us on these ngs were as > unaware as I was that IPv6 is, by design, a privacy hole par excellence. > > Reaffirming that this whole IPv6 privacy thing is new to me and that it > floored me when I found out how different it is from IPv4, to test if the > Windows or Linux or Android methods are working, these commands may help. > > 1. Test external visibility > start firefox https://test-ipv6.com (Windows) > firefox https://test-ipv6.com (Linux) > xdg-open https://test-ipv6.com (Android Termux) > 2. Check external reachability > ping -6 google.com > 3. Identify the local interface configuration > a. ipconfig (Windows) > b. ifconfig / ip a (Linux) > c. Termux > pkg install iproute2 > ip a (Android) > d. Termux > pkg install net-tools > ifconfig (Android > 4. Test DNS resolution > nslookup -type=AAAA google.com (Windows) > dig AAAA google.com (Linux, Android Termux) > 5. Test IPv6 routing table > route print -6 (Windows) > ip -6 route (Linux/Android Termux) > 6. Test IPv6 WebRTC leaks > firefox https://browserleaks.com/webrtc > firefox https://ipleak.net > 7. Test IPv6 prefix delegation > dhclient -6 -v (Linux/Android Termux) > 8. Test for VPN leaks > firefox https://ipleak.net > firefox https://browserleaks.com/ip > 9. Router setup > Netgear > Advanced > Advanced Setup > IPv6 > Internet Connection Type > Disabled (IPv6 is completely off) > Auto Detect (Router tries to detect IPv6 from your ISP) > 6to4 Tunnel (Legacy IPv6-over-IPv4 tunneling) > Pass Through (Router passes IPv6 directly to LAN devices) > Fixed (Manual IPv6 configuration) > DHCP (Used when the ISP hands out IPv6 via DHCPv6) > PPPoE (Used by DSL providers) > Auto Config (Router uses SLAAC (stateless autoconfiguration) > 6rd Tunnel (An IPv6-over-IPv4 method used by some ISPs) > Dual-Stack Lite (Used by ISPs that provide IPv6 but tunnel IPv4.\) > v6plus (Japan-specific IPv6 service) > > For example > a. No IPv6 addresses were detected by https://test-ipv6.com > b. ping -6 google.com fails > c. My Windows host only has link-local IPv6 (fe80::...) > d. I have no global IPv6 (2000::/3) > e. I have no IPv6 default gateway > f. I have no IPv6 DNS > g. All IPv6-only sites timed out > > Specifically for https://test-ipv6.com my IPv6 Firefox score was 0/10 > Test with IPv4 DNS record = ok (2.421s) using ipv4 > Test with IPv6 DNS record = timeout (5.611s) > Test with Dual Stack DNS record = ok (2.821s) using ipv4 > Test for Dual Stack DNS and large packet = ok (1.230s) using ipv4 > Test IPv6 large packet = bad (3.898s) > Test if your ISP's DNS server uses IPv6 = ok (1.293) using ipv4 > Find IPv4 Service Provider = ok (2.300s) using ipv4 > Find IPv6 Service Provider = bad (3.815s) > > May I ask others out there what your IPv6 results were with Firefox? My ISP does not provide IPv6 at all to homes. There was a Beta testing of IPv6, and for two months I had it. However, it does on mobile phones. On my phone I get an IPv6, and also an IPv4 on the 10.*.*.* range, thus using GNAT. -- Cheers, Carlos E.R. ES🇪🇸, EU🇪🇺;