IPv6 leak through VPN

[Jimbo]

Hi all,


I managed to get my AC56U to run both OpenVPN client and Server.
For the client, I have setup the firewall rules to drop any connection outside in case the VPN drops. All working well until I enabled IPV6.

The router is doing DHCP6 (IPV6 enabled), since my I receive IPV6 from my ISP. (!)

The surprise comes because now my IPV6 is visible, instead of being obscured by the VPN tunnel just like my IPV4. -> Leak!

I'm wondering if this is already a bug from the firmware that should not be there. But in any other case, does anyone have a clue on how to prevent this?.
IPV6 are bound to interfaces, which is shared with my IPV4 of course, so not sure how to block/drop the connection via ipv6tables for example, while keeping the VPN alive via IPV4 of course.

Appreciated if any input is available. As well as I'd like to hear a piece of mind message from @RMerlin, in case this is an unintended leak and users might not be aware, or only a false alarm. FW I'm running is 378.54_alpha3, which was so far so good till now.

 

[RMerlin]

OpenVPN only supports IPv4.

 

[Jimbo]

That's not really right, you can run the proto tcp6-server, etc rules, can't you?.

At least I anabled listening to IPv6 port via the IPv4 VPN connection with proto tcp6.

But what I'm asking has nothing to do with IPv6 support on OpenVPN. How would the router allow to publish my IPv6, when there is an OpenVPN tunnel running, for which I have policy rules (IPv4 of course). This should not happen in my opinion.

Could you tell me how to prevent this leak?....IPv6 address & DNS6 being exposed outside the tunnel?. Otherwise this looks like a serious vulnerability from the firmware, in my opinion as I mentioned.

 

[RMerlin]

That's not really right, you can run the proto tcp6-server, etc rules, can't you?.

I meant the OpenVPN implementation in Asuswrt.

But what I'm asking has nothing to do with IPv6 support on OpenVPN. How would the router allow to publish my IPv6, when there is an OpenVPN tunnel running, for which I have policy rules (IPv4 of course). This should not happen in my opinion.

IPv6 and IPv4 run on separate stacks, each with its own routing tables. There's no simple solution there beside disabling IPv6 support (that includes Teredo on Windows clients).

To reroute IPv6 traffic, you'd need a tunnel that is also connected through IPv6. https://community.openvpn.net/openvpn/wiki/IPv6

Note that the problem will also affect people running the tunnel provider's own client in many cases.

https://www.bestvpn.com/blog/21935/report-raps-vpns-for-ipv6-dns-leakage/