Re: PSA: IPv6 browser privacy leaks are caused by the host yet there's a simple fix

From	"Carlos E. R." <robin_listas@es.invalid>
Newsgroups	alt.comp.software.firefox, alt.os.linux, comp.mobile.android, alt.internet.wireless, alt.comp.os.windows-10
Subject	Re: PSA: IPv6 browser privacy leaks are caused by the host yet there's a simple fix
Date	2026-07-21 11:18 +0200
Message-ID	<nc8rrqFc5a3U1@mid.individual.net> (permalink)
References	<113kg6k$s72$1@nnrp.usenet.blueworldhosting.com> <nc6h3vF167tU1@mid.individual.net> <113n4f1$1chl$1@nnrp.usenet.blueworldhosting.com>

Cross-posted to 5 groups.

Show all headers | View raw

On 2026-07-21 08:43, Maria Sophia wrote:
> Carlos E. R. wrote:
>>> If a router is in bridge mode (no IPv6 delegation, no prefix assignment),
>>> all connected devices never receive a global IPv6 address.
>>>       *No global IPv6 address = nothing for the browser to leak.*
>>
>> Look up Teredo, in Windows.
>>
>> In Linux, disabling Ipv6 is feasible.
> 
> Linux does allow complete IPv6 disablement because the kernel can be told
> not to accept IPv6 router advertisements or to generate IPv6 addresses.
> 
> So Carlos is correct! Linux can truly disable IPv6 at the kernel level.

There are several methods. I did it years ago because my machine 
thought, wrongly, that my ISP provided IPv6 when it doesn't, and I got 
no connectivity. I only needed that temporarily.

I asked ChatGpt for the methods (google is not working now for me, no 
answer at all), so here they go, without verification. Just for 
curiosity sake:

There are several ways to disable IPv6 on Linux, depending on whether 
you want the change to be temporary or permanent.

### Temporary (until reboot)

This disables IPv6 immediately:

```bash
sudo sysctl -w net.ipv6.conf.all.disable_ipv6=1
sudo sysctl -w net.ipv6.conf.default.disable_ipv6=1
```

To also disable it on the loopback interface:

```bash
sudo sysctl -w net.ipv6.conf.lo.disable_ipv6=1
```

Verify:

```bash
cat /proc/sys/net/ipv6/conf/all/disable_ipv6
```

A value of `1` means IPv6 is disabled.

---

### Permanent using `sysctl`

Create a configuration file:

```bash
sudo nano /etc/sysctl.d/99-disable-ipv6.conf
```

Add:

```text
net.ipv6.conf.all.disable_ipv6 = 1
net.ipv6.conf.default.disable_ipv6 = 1
net.ipv6.conf.lo.disable_ipv6 = 1
```

Apply it immediately:

```bash
sudo sysctl --system
```

Or reboot.

---

### Disable via the kernel boot parameter

This is the most complete method because it prevents the IPv6 module 
from initializing.

For systems using GRUB:

1. Edit:

```bash
sudo nano /etc/default/grub
```

2. Add `ipv6.disable=1` to `GRUB_CMDLINE_LINUX_DEFAULT`, for example:

```text
GRUB_CMDLINE_LINUX_DEFAULT="quiet splash ipv6.disable=1"
```

3. Update GRUB:

* Debian/Ubuntu:

```bash
sudo update-grub
```

* RHEL/Fedora:

```bash
sudo grub2-mkconfig -o /boot/grub2/grub.cfg
```

(On UEFI systems, the output path may instead be 
`/boot/efi/EFI/<distro>/grub.cfg`.)

4. Reboot.

---

### Disable IPv6 in NetworkManager (per connection)

If you only want to disable IPv6 for one network connection:

```bash
nmcli connection modify "<connection-name>" ipv6.method disabled
nmcli connection up "<connection-name>"
```

List connections:

```bash
nmcli connection show
```

---

### Check whether it's disabled

```bash
ip -6 addr
```

or

```bash
cat /proc/cmdline
```

If you used the kernel parameter, you should see:

```text
ipv6.disable=1
```

### Which method should you use?

* **Only for testing or troubleshooting:** Use the `sysctl` method.
* **For one specific network connection:** Use `nmcli`.
* **To completely disable IPv6 system-wide:** Use the kernel boot 
parameter (`ipv6.disable=1`), as it's the most thorough approach.



> 
> Funny he mentions "taredo" because in the OP of Usenet thread discussing
> how to disable IPv6, the very first step performed was disabling Taredo!
> 
>   netsh interface ipv6 set teredo disabled
>   netsh interface ipv6 set 6to4 disabled (deprecated on my Win10 Pro box)
>   netsh interface ipv6 set isatap disabled (deprecated on my Win10 Pro box)
>   reg add "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters" /v
> DisabledComponents /t REG_DWORD /d 0xFF /f
> 
> WARNING! Do not set Tcpip6 DisabledComponents to hex FF like I did.
> All hell will break loose the instant you do that (ask me how I know that).
> Instead, set Tcpip6 DisabledComponents to hex 20 like everyone else does.
> 
> To Carlos' astutely helpful accurate technical point, on Windows, Teredo is
> an IPv6-over-IPv4 tunneling mechanism that can, in and of itself, create
> IPv6 connectivity (literally behind your back unless you disable it).
> 
> Teredo works by encapsulating IPv6 packets inside IPv4 UDP packets to give
> a PC IPv6 connectivity even when you think IPv6 doesn't exist or is off.
> 
> It's named for Teredo navalis, a shipworm that burrows through wood.
>   a. IPv6 === the ship
>   b. IPv4 NAT === the wood
>   c. Taredo === the worm that tunnels through NAT to create deliver IPv6
> 
> Teredo can be disabled, but it requires:
>   a. disabling the Teredo interface
>   b. disabling IPv6 transition technologies
>   c. ensuring no partial IPv6 configuration exists
>   d. ensuring the router does not advertise IPv6 at all
> 
> Those steps are why this PSA focuses on removing IPv6 at the router level.
>     modem <-> dumb bridge <-> router <-> any OS <-> any browser
> 
> If the LAN never provides IPv6, Teredo has nothing to tunnel	.

Eum... no, Teredo function works on an IPv4 only LAN and WAN. It is a 
tunnel. It punches a hole using IPv4.

What I don't remember is where is the outside hole of that tunnel, and 
what apps inside Windows can use that tunnel. Not general traffic, I 
believe.


> BTW, in the thread below where disabling Taredo was the first step, the
> setup that caused the epiphany had the wireless bridge later on the LAN
>   modem <-> router <-> Wireless bridge <-> Windows OS <-> Firefox browser
> 
> The distinction being that everything *after* the bridge is protected.
> 	
> REFERENCE:
>   Newsgroups: alt.comp.os.windows-10,alt.comp.microsoft.windows,alt.comp.os.windows-11
>   Subject: Have you ever disabled IPv6 for privacy (to prevent IP leaks)?
>   Date: Sat, 18 Jul 2026 12:47:22 -0400
>   Message-ID: <113gamq$ii0$1@nnrp.usenet.blueworldhosting.com>


-- 
Cheers,
        Carlos E.R.
        ES🇪🇸, EU🇪🇺;

Thread

PSA: IPv6 browser privacy leaks are caused by the host yet there's a simple fix Maria Sophia <mariasophia@comprehension.com> - 2026-07-20 02:45 -0400
  Re: PSA: IPv6 browser privacy leaks are caused by the host yet there's a simple fix "Carlos E. R." <robin_listas@es.invalid> - 2026-07-20 14:03 +0200
    Re: PSA: IPv6 browser privacy leaks are caused by the host yet there's a simple fix Maria Sophia <mariasophia@comprehension.com> - 2026-07-21 02:43 -0400
      Re: PSA: IPv6 browser privacy leaks are caused by the host yet there's a simple fix "Carlos E. R." <robin_listas@es.invalid> - 2026-07-21 11:18 +0200
        Re: PSA: IPv6 browser privacy leaks are caused by the host yet there's a simple fix Maria Sophia <mariasophia@comprehension.com> - 2026-07-21 07:36 -0400
          Re: PSA: IPv6 browser privacy leaks are caused by the host yet there's a simple fix "Carlos E. R." <robin_listas@es.invalid> - 2026-07-21 19:28 +0200
            Re: PSA: IPv6 browser privacy leaks are caused by the host yet there's a simple fix Maria Sophia <mariasophia@comprehension.com> - 2026-07-21 14:32 -0400
              Re: PSA: IPv6 browser privacy leaks are caused by the host yet there's a simple fix Hank Rogers <Hank@nospam.invalid> - 2026-07-21 18:31 -0500
                Re: PSA: IPv6 browser privacy leaks are caused by the host yet there's a simple fix Maria Sophia <mariasophia@comprehension.com> - 2026-07-22 15:40 -0400
                Re: PSA: IPv6 browser privacy leaks are caused by the host yet there's a simple fix Maria Sophia <mariasophia@comprehension.com> - 2026-07-22 18:53 -0400
    Re: PSA: IPv6 browser privacy leaks are caused by the host yet there's a simple fix Brian Gregory <void-invalid-dead-dontuse@email.invalid> - 2026-07-28 00:36 +0100
  Re: PSA: IPv6 browser privacy leaks are caused by the host yet there's a simple fix David Higton <dave@davehigton.me.uk> - 2026-07-20 20:47 +0100
    Re: PSA: IPv6 browser privacy leaks are caused by the host yet there's a simple fix "Carlos E. R." <robin_listas@es.invalid> - 2026-07-20 21:59 +0200
      Re: PSA: IPv6 browser privacy leaks are caused by the host yet there's a simple fix Maria Sophia <mariasophia@comprehension.com> - 2026-07-21 02:04 -0400
        Re: PSA: IPv6 browser privacy leaks are caused by the host yet there's a simple fix "Adam H. Kerman" <ahk@chinet.com> - 2026-07-21 06:37 +0000
          Re: PSA: IPv6 browser privacy leaks are caused by the host yet there's a simple fix Maria Sophia <mariasophia@comprehension.com> - 2026-07-21 03:23 -0400
        Re: PSA: IPv6 browser privacy leaks are caused by the host yet there's a simple fix Nuno Silva <nunojsilva@invalid.invalid> - 2026-07-21 07:59 +0100
          Re: PSA: IPv6 browser privacy leaks are caused by the host yet there's a simple fix Maria Sophia <mariasophia@comprehension.com> - 2026-07-21 04:41 -0400
            Re: PSA: IPv6 browser privacy leaks are caused by the host yet there's a simple fix "Carlos E. R." <robin_listas@es.invalid> - 2026-07-21 11:03 +0200
              Re: PSA: IPv6 browser privacy leaks are caused by the host yet there's a simple fix Maria Sophia <mariasophia@comprehension.com> - 2026-07-21 05:47 -0400
                Re: PSA: IPv6 browser privacy leaks are caused by the host yet there's a simple fix "Carlos E. R." <robin_listas@es.invalid> - 2026-07-21 12:27 +0200
                Re: PSA: IPv6 browser privacy leaks are caused by the host yet there's a simple fix Maria Sophia <mariasophia@comprehension.com> - 2026-07-21 14:10 -0400
          Re: PSA: IPv6 browser privacy leaks are caused by the host yet there's a simple fix "Carlos E. R." <robin_listas@es.invalid> - 2026-07-21 10:53 +0200
            Re: PSA: IPv6 browser privacy leaks are caused by the host yet there's a simple fix Maria Sophia <mariasophia@comprehension.com> - 2026-07-21 05:19 -0400
              Re: PSA: IPv6 browser privacy leaks are caused by the host yet there's a simple fix "Carlos E. R." <robin_listas@es.invalid> - 2026-07-21 11:30 +0200
                Re: PSA: IPv6 browser privacy leaks are caused by the host yet there's a simple fix Maria Sophia <mariasophia@comprehension.com> - 2026-07-21 06:10 -0400
              Re: PSA: IPv6 browser privacy leaks are caused by the host yet there's a simple fix Maria Sophia <mariasophia@comprehension.com> - 2026-07-22 19:13 -0400
            Re: PSA: IPv6 browser privacy leaks are caused by the host yet there's a simple fix Nuno Silva <nunojsilva@invalid.invalid> - 2026-07-22 09:47 +0100
              Re: PSA: IPv6 browser privacy leaks are caused by the host yet there's a simple fix Maria Sophia <mariasophia@comprehension.com> - 2026-07-22 16:30 -0400
      Re: PSA: IPv6 browser privacy leaks are caused by the host yet there's a simple fix Brian Gregory <void-invalid-dead-dontuse@email.invalid> - 2026-07-22 21:35 +0100
        Re: PSA: IPv6 browser privacy leaks are caused by the host yet there's a simple fix Maria Sophia <mariasophia@comprehension.com> - 2026-07-22 16:46 -0400
          Re: PSA: IPv6 browser privacy leaks are caused by the host yet there's a simple fix Brian Gregory <void-invalid-dead-dontuse@email.invalid> - 2026-07-23 04:33 +0100
            Re: PSA: IPv6 browser privacy leaks are caused by the host yet there's a simple fix Nuno Silva <nunojsilva@invalid.invalid> - 2026-07-23 08:12 +0100
              Re: PSA: IPv6 browser privacy leaks are caused by the host yet there's a simple fix Maria Sophia <mariasophia@comprehension.com> - 2026-07-23 16:23 -0400
    Re: PSA: IPv6 browser privacy leaks are caused by the host yet there's a simple fix Oregonian Haruspex <no_email@invalid.invalid> - 2026-07-25 04:58 +0000
      Re: PSA: IPv6 browser privacy leaks are caused by the host yet there's a simple fix Maria Sophia <mariasophia@comprehension.com> - 2026-07-26 14:25 -0700
  Re: PSA: IPv6 browser privacy leaks are caused by the host yet there's a simple fix Maria Sophia <mariasophia@comprehension.com> - 2026-07-21 01:38 -0400
    Re: PSA: IPv6 browser privacy leaks are caused by the host yet there's a simple fix Nuno Silva <nunojsilva@invalid.invalid> - 2026-07-21 07:51 +0100
      Re: PSA: IPv6 browser privacy leaks are caused by the host yet there's a simple fix Maria Sophia <mariasophia@comprehension.com> - 2026-07-21 03:45 -0400
        Re: PSA: IPv6 browser privacy leaks are caused by the host yet there's a simple fix Nuno Silva <nunojsilva@invalid.invalid> - 2026-07-22 09:37 +0100
          Re: PSA: IPv6 browser privacy leaks are caused by the host yet there's a simple fix Maria Sophia <mariasophia@comprehension.com> - 2026-07-24 11:36 -0700
  Re: PSA: IPv6 browser privacy leaks are caused by the host yet there's a simple fix Brian Gregory <void-invalid-dead-dontuse@email.invalid> - 2026-07-22 21:32 +0100
    Re: PSA: IPv6 browser privacy leaks are caused by the host yet there's a simple fix Maria Sophia <mariasophia@comprehension.com> - 2026-07-22 16:54 -0400
      Re: PSA: IPv6 browser privacy leaks are caused by the host yet there's a simple fix agris <agris@invalid.tld> - 2026-07-22 17:05 -0700
        Re: PSA: IPv6 browser privacy leaks are caused by the host yet there's a simple fix Maria Sophia <mariasophia@comprehension.com> - 2026-07-22 23:06 -0400
          Re: PSA: IPv6 browser privacy leaks are caused by the host yet there's a simple fix Brian Gregory <void-invalid-dead-dontuse@email.invalid> - 2026-07-23 04:50 +0100
            Re: PSA: IPv6 browser privacy leaks are caused by the host yet there's a simple fix Maria Sophia <mariasophia@comprehension.com> - 2026-07-23 16:51 -0400

csiph-web