Re: Have you ever disabled IPv6 for privacy (to prevent IP leaks)?

Brian Gregory wrote on 7/18/2026 1:13 PM:
> IP leak is vague name for the privacy problems with IPv6.
> 
> The source IP of an outgoing connection ALWAYS leaks. You couldn't get 
> any reply back if you kept your IP address secret.
> 
> However with IPv6 the problem is that each device on your LAN has, at 
> any point in time, it's own IPv6 address. So with IPv6 things you 
> connect to can potentially tell which of your devices connected, where 
> as with IPv4 all connections appear to come from your single IPv4 
> address, so determining which one the connection came from is either not 
> so straightforward, or even impossible if your devices don't give away 
> their identity in any other way (such as in their http headers).
> 
> Basically what RFC8981 does, when a device implements it (it's 
> implemented on each device, not in your router or gateway), is to change 
> the IPv6 address a device uses to make outgoing connections at regular 
> intervals. Typically it changes once every 24 hours. The device also has 
> another IPv6 address that doesn't change, which can be used for incoming 
> connections or local connections, which can be useful in some situations.
> 
> I'm not paranoid about this kind of thing so generally I just make sure 
> it is enabled and leave it as every 24 hours. It is enabled by default 
> in Windows 10 and 11 for instance. But the situation varies with other 
> OSs. For instance I had to enable it on my Raspberry Pi web server if I 
> wanted it on there too.


Hi Brian Gregory,

I think we're each discussing different aspects of "privacy", both of 
which are valid.

You bring up good points about rotation where I need to first explain I
never thought about IPv6 until I tried to plug leaks, if any, when
torrenting on VPN.

Specifically I thank you for introducing RFC 8981 to me (and others).
Given that, you clearly know far more than I do about IPV6 privacy.

My concern isn't IPv6 privacy in the general sense. My concern is mainly in
the specific case where a VPN tunnels only IPv4, but Windows still prefers
IPv6.

In that situation, a BitTorrent client (or any app) can make IPv6
connections outside the VPN tunnel, even if the user thinks they're
protected.

As far as I can tell, while RFC 8981 is great, RFC 8981 doesn't solve that
problem. It only rotates the IPv6 interface identifier; it does not prevent
IPv6 traffic from bypassing the VPN.

So the comparison in this case isn't so much IPv6 privacy extensions vs.
disabling IPv6 but more likely the question for all of us to ask:
 Q: Do we want IPv6 to exist at all if our VPN doesn't support it?
 A: ??? 

For example, I use thousands of free openvpn config files found on the net
(mostly for basic IP obfuscation, not so much for activity protection).

If the VPN is IPv4-only, my thought process was that the only reliable way
to prevent leaks is to disable IPv6 on the interfaces the VPN doesn't
tunnel.

I haven't posted in a day because I screwed up my network given Windows 10
is IPv6-first, so disabling IPv6 incorrectly can (and did!) break routing,
NCSI, and killswitch logic, even as using DisabledComponents = 0x20 is
intended to avoid those issues while still preventing IPv6 leaks.

So in this specific threat model (VPN + BitTorrent + IPv4-only tunnel), RFC
8981 is interesting, but not a solution. The solution I'm asking about here
is whether anyone has been successful in preventing IPv6 traffic from ever
leaving the machine outside the VPN.

Still, the RFC8981 information is news to me, and very interesting.
Thank you for your insight on how you protect yourself when using IPv6.
-- 
Usenet is where you can often find people who know much more than you do.
	.