Re: Have you ever disabled IPv6 for privacy (to prevent IP leaks)?

On 18/07/2026 18:42, Maria Sophia wrote:
> Brian Gregory wrote:
>>> Q: Have you ever disabled IPv6 for privacy (to prevent IP leaks)?
>>>      What are your experiences?
>>
>> No. I know how to enable and use the RFC 8981 IPv6 privacy extensions.
> 
> Thank you for that suggestion of comparing the two different methods:
>   1. Enable and use the RFC 8981 IPv6 privacy extensions
>   2. versus partially disabling Windows Tcpip6\Parameters (0x20)
> 
> Your experience, and that of others, should they volunteer to help out,
> is invaluable because there is no escaping that IPv6 is part of Windows.
> 
> Hence, we all have to consider how to protect our IPv6 privacy now.
> 
> To be perfectly honest, I know almost nothing about IPv6, simply
> because I've never used it, never needed to use it and don't want it.
> 
> The only reason I care about IPv6 is to prevent IP leaks from something
> I know nothing about, which is why I wiped it out completely today.
> 
> But that caused the routing table to be unpredictable, so let's compare
> the two methods for what matters to each of us on our Windows boxes.
> 
> Q: Specifically, is it better to partially disable IPv6 (0x20), or to
>     leave IPv6 enabled & rely on RFC 8981 privacy extensions instead?
> A: ???
> 
> Knowing absolutely nothing about RF8981, I needed to look it up first.
>   <https://www.rfc-editor.org/rfc/rfc8981>
>   RFC 8981 defines IPv6 privacy extensions, which make IPv6 addresses
>   rotate frequently so websites cannot track us by stable IPv6 address.
>   It does not hide the IPv6 prefix (which still reveals the ISP & region),
>   but it hides the interface identifier, which is the part that could
>   otherwise be tied to the device	
> 
> Hence, at first inspection, this seems to be the one-line difference:
> 1. RFC 8981 rotates IPv6 addresses frequently to prevent tracking.
> 2. Tcpip6\Parameters (0x20) disables IPv6 on all LAN/Wi-Fi interfaces.
> 
> Knowing nothing about each before today, is this a reasonable comparison?
> 1. RFC 8981
>     a. IPv6 stays enabled
>     b. IPv6 addresses rotate
>     c. IPv6 still leaks if VPN doesn't tunnel it
>     d. Using RFC 8981 IPv6 privacy extensions requires understanding IPv6
>     e. Routing becomes more complex
>     f. The kill switch must handle IPv6 routes too
> 2. Partially disabling IPv6 with Windows Tcpip6\Parameters (0x20)
>     a. IPv6 disabled on interfaces
>     b. No IPv6 leaks
>     c. No IPv6 routing
>     d. No IPv6 DNS
>     e. Windows routing stays stable
>     f. Kill switch works as designed
>     g. No need to understand IPv6
> 
> In summary, RFC 8981 is powerful, and, for most people, I think that may be
> the right solution, but using it still has some privacy implications
> (such as the ISP & region are still revealed even as the ID is not).
> 
> Partially disabling IPv6 with Windows Tcpip6\Parameters (0x20) is more
> brutal, and it negates any use of IPv6, but it keeps my current
> LiquidVPN-based "dumb" killswitch working without modifications.
> 
> Having never even heard of RFC 8981 until just now, anything I said
> above can be wrong (and likely is), but I do thank you for suggesting it.
> 
> I think everyone will benefit from knowing more about RFC 8981
> implementation on their Windows box to rotate their temporary IPv6 address!

IP leak is vague name for the privacy problems with IPv6.

The source IP of an outgoing connection ALWAYS leaks. You couldn't get 
any reply back if you kept your IP address secret.

However with IPv6 the problem is that each device on your LAN has, at 
any point in time, it's own IPv6 address. So with IPv6 things you 
connect to can potentially tell which of your devices connected, where 
as with IPv4 all connections appear to come from your single IPv4 
address, so determining which one the connection came from is either not 
so straightforward, or even impossible if your devices don't give away 
their identity in any other way (such as in their http headers).

Basically what RFC8981 does, when a device implements it (it's 
implemented on each device, not in your router or gateway), is to change 
the IPv6 address a device uses to make outgoing connections at regular 
intervals. Typically it changes once every 24 hours. The device also has 
another IPv6 address that doesn't change, which can be used for incoming 
connections or local connections, which can be useful in some situations.

I'm not paranoid about this kind of thing so generally I just make sure 
it is enabled and leave it as every 24 hours. It is enabled by default 
in Windows 10 and 11 for instance. But the situation varies with other 
OSs. For instance I had to enable it on my Raspberry Pi web server if I 
wanted it on there too.

-- 
Brian Gregory (in England).