Feature request: Env variable to disable IPv6 auto-enable

[buroa]

What's the feature 🧐

Allow us to complete disable IPv6, instead of automatically checking if our system supports it.

https://github.com/qdm12/gluetun/blob/master/internal/netlink/ipv6.go#L9
https://github.com/qdm12/gluetun/blob/master/internal/provider/utils/wireguard.go#L12
https://github.com/qdm12/gluetun/blob/master/internal/wireguard/address.go#L14
https://github.com/qdm12/gluetun/blob/master/internal/configuration/sources/env/wireguard.go#L12

Something like a env variable that goes into the user settings. Looks like the wireguard is already checking that setting so as long as we can pass it as an override, this will work for anyone that has the same setup.

Extra information and references

No response

[qdm12]

Why do you need this? What's the use case?

[buroa]

@qdm12 If I use mullvad for example, it attempts to connect to a lot of IPv6-enabled wireguard servers -- but I don't actually have IPv6 enabled in my homelab -- so it shouldn't even attempt this. It's causing a ton of delay until it actually grabs a IPv4-enabled server.

[qdm12]

Ok that's interesting, maybe a better way to address this would be to fix the IPv6 detection mechanism 😉

The mechanism right now is

gluetun/internal/netlink/ipv6.go

Line 9 in 3100cc1

func (n *NetLink) IsIPv6Supported() (supported bool, err error) {

and it basically goes through the routes of each links, and if one route is IPv6, it assumes IPv6 is supported. What's the output of

docker run -it --rm alpine ip route
docker run -it --rm alpine ip -6 route

Maybe you do have IPv6 enabled on your machine, but not on your network?? In which case, adding an extra step to query an IPv6 address and see if it works would do I think 🤔

[qriff]

#1648 @qriff can you mention in more details this in #1563 and answer:

1. Do you think there would be a more reliable way to detect IPv6? One could try creating an unattached ipv6 link and see if it works I guess?

2. If not, we can go ahead and add an optional env variable to enable/disable IPv6 (defaulting to `auto`).

So AFAIK, YMMV et al, the definition of IPv6 detection is the (enabled) state in Sysctl.

https://serverfault.com/questions/660979/how-to-disable-ipv6-support-in-linux-entirely

I know it is not specifically what you asked, but...

Regarding autodetection, the multitude of ways how IPv6 can be utilized is quite wast and just like the realization in #1648 indicates the current detection fails due to being done before actually setting the IPv6 address and getting a IPv6 route (no local IPv6 connectivity, only remote (VPN) IPv6 connectivity, proxies, net-containers, etc). It might not even matter if IPv6 is configured or not (even if only enabled), firewall rules should still be set nonetheless etc, principally a IPv6 address might pop-up at any time and the default configuration should account for it.

https://docs.docker.com/engine/reference/run/#network-settings
https://stackoverflow.com/questions/55399695/attaching-a-docker-container-to-another-containers-network-with-net-container

AFAIK, YMMV et al, a sidenote on the technicalities of IPv6 disabling/enabling, in containers it is inherited by the container from the host, or kernel tuned via sysctl by the container engine (also remebering container namespacing). Obviously a complimentary environment variable is fully valid in ADDITION to the actual implementation, (it is considered courteous to notify of this circumstance in the setting description/documentation, for guidance toward proper configuration)

The decision made here might define the longevitiy and suitability of this project (i.e. compliance, compatibility).

[buroa]

ip -6 route

ip r && ip -6 route
default via 10.244.1.220 dev eth0 mtu 9000
10.244.1.220 dev eth0 scope link
fe80::/64 dev eth0 proto kernel metric 256 pref medium

[qdm12]

@qriff interesting points, I am thinking to add an ipv6 dummy route to test for ipv6 support, instead of checking existing routes for IPv6 source or destination.

Would you have any suggestion of what ip6 route add ... you would use to not affect existing routing tables (not a routing expert to be honest) 🤔

[samip5]

This also happens with airvpn as I have blocked IPv6 outbound (via network policy in Kubernetes), and it stil tries to connect via v6.

For reference (inside gluetun container):

# ip r && ip -6 r 
default via 10.244.4.77 dev eth0 mtu 1500 
10.0.0.0/8 via 10.244.4.77 dev eth0 
10.244.4.77 dev eth0 scope link 
172.16.2.0/24 dev vxlan0 proto kernel scope link src 172.16.2.1 
192.168.0.0/16 via 10.244.4.77 dev eth0 
fd7d:76ee:e68f:a993:16a9:9a73:9cd9:c35c dev wg0 proto kernel metric 256 pref medium
fddf:f7bc:9670:4::bd91 dev eth0 proto kernel metric 256 pref medium
fddf:f7bc:9670:4::c7a7 dev eth0 metric 1024 pref medium
fe80::/64 dev eth0 proto kernel metric 256 pref medium
fe80::/64 dev vxlan0 proto kernel metric 256 pref medium
default via fddf:f7bc:9670:4::c7a7 dev eth0 metric 1024 mtu 1500 pref medium