Generating random IPv6 suffixes comparable to privacy extension [Solved]

[ffries]

I really don't know. This is OpenWRT default installation.

[trendy]

https://openwrt.org/docs/guide-user/network/ipv6/start#protocol_static_with_ipv6

ip6ifaceid ipv6 suffix no ::1 Allowed values: 'eui64', 'random', fixed value like '::1:2'.

When IPv6 prefix (like 'a:b:c:d::') is received from a delegating server, use the suffix (like '::1') to form the IPv6 address ('a:b:c:d::1') for this interface. Useful with several routers in LAN. The option was introduced by this commit to netifd in Jan 2015.

[krazeh]

@trendy

ip6ifaceid ipv6 suffix no ::1 Allowed values: 'eui64', 'random', fixed value like '::1:2'.

Isn't that just for the IPv6 interface on the router? It won't have any effect on client devices.

[ffries]

OK, my router has a static IPv6, this is normal.
But how do I serve random IPv6 suffices to my clients on br-lan?

[krazeh]

Use SLAAC and privacy extensions on the client.

[ffries]

I don't know how to configure SLAAC and don't see any webpage on WIKI about SLAAC.

[trendy]

Yes, you are right.
As far as SLAAC is concerned, the hosts will create their own IPv6 from the prefix advertised in the RA.
So the other option is DHCPv6, where if you don't specify some hostid it will assign kind of randomly an IP

[ffries]

It would be nice if a general SLAAC configuration was documented.

[ffries]

I disabled dhcp assignment and enabled ra advertisement:

config dhcp 'lan'
        option interface 'lan'
        option start '100'
        option limit '150'
        option leasetime '12h'
        option ra 'server'

Still I am getting the same IPv6.

[ffries]

This works, disabling dhcpv6 and setting-up SLAAC made the trick.
These settings are correct and allow to generate a random IPv6 suffix.

Tested on Android and Debian GNU/Linux.

Under Debian GNU Linux, you need to set up privacy extensions to '2".
cat /etc/sysctl.conf
net.ipv6.conf.all.use_tempaddr = 2
The ipv6 is generated after each reboot.

Under Android, disconnecting and reconnecting to WIFI is enough to generate a new random IPv6 suffix.

[lleachii]

IPv6 prefix privacy

A method to change the Privacy Secret is noted in this thread.

Cascading routers, dhcpv6 and unwanted EUI64 w/SLAAC on wan6

Interesting stuff! If have done the following but I am not sure if the outcome is the same as you have mentioned above: to /etc/sysctl.conf I added net.ipv6.conf.default.stable_secret=71c3:0126:4b41:96a4:a98f:5323:5341:2be9 rebooted and the check shows: sysctl -a | grep stable_secret sysctl: error reading key 'net.ipv6.conf.all.stable_secret': I/O error net.ipv6.conf.br-lan.stable_secret = 71c3:0126:4b41:96a4:a98f:5323:5341:2be9 net.ipv6.conf.default.stable_secret = 71c3:0126:4b41:96a4:a9…

and to generate the secret:

Cascading routers, dhcpv6 and unwanted EUI64 w/SLAAC on wan6

You could probably also use head -c 16 /dev/urandom | hexdump -e '8/2 "%04x:" "\n"'| sed 's/.$//' That's 8 iterations over 2 byte pairs, printed as 4 hex digits each, where hexdump itself includes the colon. You just have to strip the last colon then, with sed. I myself did generate the number just once for each host, and stored it in /etc/sysctl.conf. Which is the recommended way if you want to have maximum interface identifier stability with infrequently changing prefixes. Like with ULAs, …

If you have a RNG, you can use the device /dev/hwrng instead.

Then on a Static Interface in /etc/config/network - I add:

option ip6ifaceid 'random'

@ffries

using dhcp server or any mechanism to server IPv6 addresses to hosts.

EDIT: oh wow...no, the client has to have this enabled, I thought you meant the router

[ffries]

Thanks. I am using Network-manager in Debian GNU/Linux.
It does pick-up sysctl.conf setting.

So what are your settings for Debian, could you show your config files?

[ffries]

You are probably right I need a stable IPv6 for example when using wireguard.

[ffries]

head -c 16 /dev/urandom | hexdump -e '8/2 "%04x:" "\n"'| sed 's/.$//'
generates a full IPv6 address.

So I need to aggregage my prefix with the suffix of your command?

[ffries]

Setting this issue to solved.

[lleachii]

@ffries

generates a full IPv6 address

It's a HASH for the privacy secret...so your router will have a new IPv6 Privacy address on configured interfaces on every reboot.

It's not an IP in the example...I don't think you followed the instructions in that thread (probably because you were referring to privacy on the client).

Nonetheless, glad your issue is solved with a static IP address.

EDIT: I think it's extremely important to be clear - that command does not magically generate a valid IP address..

[ffries]

You are right, disabling DHCPv6 and enabling SLAAC was the solution.

[vgaetera]

Which network manager service do you use on the client?

[ffries]

• Debian Linux with Gnome Network-manager
• Android
• Mac OS X
• iOS

We never use Windows or very rarely.