Close OpenVPN IPv6 leakage

[eclp]

When using OpenVPN, is it possible to disable IPv6 via the configuration file (*.ovpn) so that no leakage occurs (or any other possibility)? My VPN provider supports IPv6 but unfortunately the protocol will not be supported by the Merlin firmware in the foreseeable future. I want to avoid to disable IPv6 completely in the router settings because devices not using VPN will still get an IPv6 address.

Any answer or help is highly appreciated!

 

[martinr]

What about IPV6 tab set to disable (the default).? Below WAN in Advanced Settings.

 

[eclp]

IPv6 is enabled in my IPv6 tab and I also get a native IPv6 address from my service provider. This setting should be kept for clients that do not use VPN.

 

[Kingp1n]

When using OpenVPN, is it possible to disable IPv6 via the configuration file (*.ovpn) so that no leakage occurs (or any other possibility)? My VPN provider supports IPv6 but unfortunately the protocol will not be supported by the Merlin firmware in the foreseeable future. I want to avoid to disable IPv6 completely in the router settings because devices not using VPN will still get an IPv6 address.

Any answer or help is highly appreciated!

If you add the following lines under custom configuration:

pull-filter ignore "ifconfig-ipv6"
pull-filter ignore "route-ipv6"

Adding these 2 lines in custom configurations insures that the VPN doesn't use ipV6 traffic.

Would this work?

 

[eclp]

Thank you very much for your reply.

The VPN connection with pull-filter works, but the IPv6 leak still exists.
The following notes appear in the syslog:

ovpn-client1: OpenVPN ROUTE6: OpenVPN needs a gateway parameter for a --route-ipv6 option and no default was specified by either --route-ipv6-gateway or --ifconfig-ipv6 options
ovpn-client1: OpenVPN ROUTE: failed to parse/resolve route for host/network: fc00::/7
ovpn-client1: OpenVPN ROUTE6: OpenVPN needs a gateway parameter for a --route-ipv6 option and no default was specified by either --route-ipv6-gateway or --ifconfig-ipv6 options
ovpn-client1: OpenVPN ROUTE: failed to parse/resolve route for host/network: 3000::/4
ovpn-client1: OpenVPN ROUTE6: OpenVPN needs a gateway parameter for a --route-ipv6 option and no default was specified by either --route-ipv6-gateway or --ifconfig-ipv6 options
ovpn-client1: OpenVPN ROUTE: failed to parse/resolve route for host/network: 2000::/4
ovpn-client1: OpenVPN ROUTE6: OpenVPN needs a gateway parameter for a --route-ipv6 option and no default was specified by either --route-ipv6-gateway or --ifconfig-ipv6 options
ovpn-client1: OpenVPN ROUTE: failed to parse/resolve route for host/network: ::/3

 

[eclp]

It disappoints me a little bit that in case of an IPv6 leak there seems to be no other possibility than to pull the "IPv6 plug" out of the socket. Or maybe the right people who know the possible answer have not read it yet? It would be nice if there were other approaches I could try.

Please help me further!

 

[Jack Yaz]

It disappoints me a little bit that in case of an IPv6 leak there seems to be no other possibility than to pull the "IPv6 plug" out of the socket. Or maybe the right people who know the possible answer have not read it yet? It would be nice if there were other approaches I could try.

Please help me further!

You could probably do something with ip6tables

 

[ankhazam]

1) the firmware supports dual stack VPN... using TAP tunnels.
2) No you cannot disable it this way, you need to disable it in your LAN/Wifi adapter... Yes that sucks but there is no reasonable way to do that. You can also try to give your TUN IPV4 rule highest priority on the client side.

 

[eclp]

You could probably do something with ip6tables

Not sure, but would this possible solution apply to all clients? And could we exclude devices that should not use VPN? Do you have a sample code that I could try?

 

[eclp]

1) the firmware supports dual stack VPN... using TAP tunnels.

This I do not understand, what would this mean?

 

[ankhazam]

switch tun to tap tunnel and you get dual stack ipv4 and ipv6 tunnel.. doesn't work on Android clients though :/

 

[eclp]

Thanks for the answers so far.

Unfortunately I don't understand enough about this topic myself, but maybe one last question is allowed. Could this tutorial possibly be a help for the solution?

https://www.jacobdevans.com/ipv6-openvpn-tunneling-with-asus-merlinwrt/