Skip to content
This repository has been archived by the owner on Jun 4, 2021. It is now read-only.

OpenVPN IPv6 address information leaks #97

Open
summerjob opened this issue Dec 1, 2014 · 15 comments
Open

OpenVPN IPv6 address information leaks #97

summerjob opened this issue Dec 1, 2014 · 15 comments
Labels
kind/network kind/privacy provider/digital-ocean status/help-wanted For items we'd love help with

Comments

@summerjob
Copy link

I'm on OS X connected via OpenVPN-direct using Tunnelblick (plus custom DNS) and IPv4 is assigned correctly to my Streisand VPN servers IP.
However IPv6 shows my original IP & provider info as you can test here:
http://test-ipv6.com
What to do?
@jlund
Copy link
Member

jlund commented Dec 3, 2014

If I'm remembering right, you are using DigitalOcean. Most DigitalOcean regions don't support IPv6 yet, so the OpenVPN server doesn't (and can't) send IPv6 routing information. Because of this, Tunnelblick is only routing IPv4 traffic through the VPN.

You can disable IPv6 support in your OS X settings to prevent this type of leak.

IPv6 adoption is definitely trending upwards. Hopefully DigitalOcean, AWS, and other major server providers will get on board soon.

@mndfcked
Copy link

mndfcked commented May 9, 2015

Just a little reminder on this issue. IPv6 is officially supported by DO but only via APIv2. Since v1 is sunsetting (#156) and this issue may render streisand useless for naive users we may push the adpotion of v2.

@SyedAmerGilani
Copy link

this is not only a possible leak, it is one.
When creating a streisand instance on DO with APIv2, the droplet is created without ipv6 support.
Then the OpenVPN config does not disable ipv6 routing on the client. When the client does have a native ipv6 connection, all ipv6 traffic is routed around the VPN. Since ipv6 adoption is very high, most of the traffic is routed around the VPN, which makes it pointless.

example with a OpenVPN connection to my fresh streisand instance:
ipv4

tracepath -n google.de
 1?: [LOCALHOST]                                         pmtu 1500
 1:  10.8.0.1                                             28.613ms 
 1:  10.8.0.1                                             27.775ms <- OpenVPN Tunnel
 2:  46.101.128.xxx                                       28.608ms <- DO droplet
 3:  5.101.109.28                                         29.065ms 
 4:  5.101.109.21                                         28.524ms asymm  3 
...

ipv6:

tracepath6 -n google.de
 1?: [LOCALHOST]                        0.189ms pmtu 1492
 1:  2003:4c:6832:4100:224:xxxx:xxxx:xxxx                  4.166ms <- local ipv6 router
 1:  2003:4c:6832:4100:224:xxxx:xxxx:xxxx                  1.252ms 
 2:  2003:0:1203:207::1                                   19.143ms 
 3:  2003:0:1203:248::2                                   21.455ms 
 4:  2003:0:1206::1                                       19.743ms 
...

@jlund
Copy link
Member

jlund commented Nov 27, 2015

Adding full IPv6 support and documentation is high on my list of things to do.

@alxlion
Copy link

alxlion commented Jun 11, 2016

Waiting for ipv6 for DO... someone is working on it ?

@msteindorfer
Copy link

I'd be also interested to see IPv6 support. I setup streisand yesterday, it is an awesome tool!

@alxlion
Copy link

alxlion commented Jun 12, 2016

I do not know for L2TP/IPsec but for OpenVPN config files may contains proto udp6 to route on both ipv4 and ipv6. It does not seem too complicated to implement.

https://community.openvpn.net/openvpn/wiki/IPv6

@DavidWittman
Copy link
Collaborator

Until IPv6 support is added, it'd be nice to see these commands added to the documentation:

Linux

sysctl -w net.ipv6.conf.all.disable_ipv6=1

Mac

networksetup -setv6off Ethernet && networksetup -setv6off Wi-Fi

@brightonbob
Copy link

Just installed and noticed leak of IPv6 info from my DO server. I didn't see this issues flagged or the temp solution (as noted by DavidWhittman - sysctl -w net.ipv6.conf.all.disable_ipv6=1
) in the docs yet?
Is there any progress or plans for this?

@weyert
Copy link

weyert commented Apr 8, 2017

Yes, I noticed the same issue when using Linode to create a Streisand server. Connecting with OpenVN then it will show a IPv6 ip address from my ISP (Sky UK)

This was referenced Apr 8, 2017
Closed
Closed
@cpu cpu changed the title possible IPv6 leak OpenVPN IPv6 address information leaks Apr 8, 2017
@cpu cpu added the status/help-wanted For items we'd love help with label Apr 8, 2017
alimakki added a commit to alimakki/streisand that referenced this issue Apr 29, 2017
@alimakki
# This is a combination of 129 commits.
023ebef 
# This is the 1st commit message:
initial fr commit

# This is the commit message StreisandEffect#2:

readme completed

# This is the commit message StreisandEffect#3:

corrections

# This is the commit message StreisandEffect#4:

readme done

# This is the commit message StreisandEffect#5:

readme even more done

# This is the commit message StreisandEffect#6:

more corrections

# This is the commit message StreisandEffect#7:

initial commit for translated instructions

# This is the commit message StreisandEffect#8:

fixed typos

# This is the commit message StreisandEffect#9:

fixed markdown

# This is the commit message StreisandEffect#10:

fixed anchor

# This is the commit message StreisandEffect#11:

grammar and typos

# This is the commit message StreisandEffect#12:

fixed markdown

# This is the commit message StreisandEffect#13:

finished french instructions for windows l2tp/ipsec

# This is the commit message StreisandEffect#14:

androïde

# This is the commit message StreisandEffect#15:

finished osx instructions for l2tp/ipsec

# This is the commit message StreisandEffect#16:

finished linux l2tp/ipsec

# This is the commit message StreisandEffect#17:

finished ios l2tp/ipsec

# This is the commit message StreisandEffect#18:

common entries in l2tp translated

# This is the commit message StreisandEffect#19:

minor corrections

# This is the commit message StreisandEffect#20:

android l2tp/ipsec translations done

# This is the commit message StreisandEffect#21:

l2tp/ipsec french done

# This is the commit message StreisandEffect#22:

typos

# This is the commit message StreisandEffect#23:

initial commit for openconnect

# This is the commit message StreisandEffect#24:

partial windows instructions completed

# This is the commit message StreisandEffect#25:

removed idea files

# This is the commit message StreisandEffect#26:

renamed readme_fr to readme-fr

# This is the commit message StreisandEffect#27:

windows oc instructions done

# This is the commit message StreisandEffect#28:

finished osx instructions, updated brew url to https

# This is the commit message StreisandEffect#29:

oc linux instructions done, minor corrections

# This is the commit message StreisandEffect#30:

stuff

# This is the commit message StreisandEffect#31:

oc instructions french done

# This is the commit message StreisandEffect#32:

minor correction

# This is the commit message StreisandEffect#33:

initial commit for openvpn instructions fr

# This is the commit message StreisandEffect#34:

finished windows ovpn instructions

# This is the commit message StreisandEffect#35:

copypasta the common stuff

# This is the commit message StreisandEffect#36:

typos

# This is the commit message StreisandEffect#37:

removed azure from upcoming features fr

# This is the commit message StreisandEffect#38:

updated azure Readme-fr.md

# This is the commit message StreisandEffect#39:

Silence la censure. Automatiser l'effet

# This is the commit message StreisandEffect#40:

minor corrections

# This is the commit message StreisandEffect#41:

minor corrections

# This is the commit message StreisandEffect#42:

more translations

# This is the commit message StreisandEffect#43:

finished macos ovpn instructions

# This is the commit message StreisandEffect#44:

eeeeeeeeee

# This is the commit message StreisandEffect#45:

openvpn linux cli done

# This is the commit message StreisandEffect#46:

finish linux ovpn network manager

# This is the commit message StreisandEffect#47:

ovpn android done

# This is the commit message StreisandEffect#48:

finished ovpn ios instructions

# This is the commit message StreisandEffect#49:

minor correction

# This is the commit message StreisandEffect#50:

initial commit for shadowsocks-fr

# This is the commit message StreisandEffect#51:

windows shadowsocks done

# This is the commit message StreisandEffect#52:

shadowsocks macos done

# This is the commit message StreisandEffect#53:

really macos is done

# This is the commit message StreisandEffect#54:

commit before merge

# This is the commit message StreisandEffect#55:

finished ff shadowsocks instructions

# This is the commit message StreisandEffect#56:

shadowsocks done

# This is the commit message StreisandEffect#57:

initial commit for wg fr

# This is the commit message StreisandEffect#58:

initial commit for ssh fr

# This is the commit message StreisandEffect#59:

windows ssh instructions done

# This is the commit message StreisandEffect#60:

linux-osx ssh done

# This is the commit message StreisandEffect#61:

linux osx alternative ssh done

# This is the commit message StreisandEffect#62:

android almost done

# This is the commit message StreisandEffect#63:

finished instructions for shadowsocks

# This is the commit message StreisandEffect#64:

mirror index fr done

# This is the commit message StreisandEffect#65:

tunnel ssh

# This is the commit message StreisandEffect#66:

progress for streisang-gateway fr

# This is the commit message StreisandEffect#67:

finished windows gateway instructions

# This is the commit message StreisandEffect#68:

manual ssl verification done

# This is the commit message StreisandEffect#69:

one more line

# This is the commit message StreisandEffect#70:

finished osx android gateway fr

# This is the commit message StreisandEffect#71:

ios gateway done

# This is the commit message StreisandEffect#72:

finished all of gateway instructions fr

# This is the commit message StreisandEffect#73:

initial commit for tor-fr

# This is the commit message StreisandEffect#74:

tor done

# This is the commit message StreisandEffect#75:

initial commit for azure-fr.md

# This is the commit message StreisandEffect#76:

azure-fr done

# This is the commit message StreisandEffect#77:

preparing to link it all up

# This is the commit message StreisandEffect#78:

working on i18n generation

# This is the commit message StreisandEffect#79:

Streisand CI Testing

# This is the commit message StreisandEffect#80:

attempt i18n..

# This is the commit message StreisandEffect#81:

removed commented stuff

# This is the commit message StreisandEffect#82:

fixed lang loop in md templates

# This is the commit message StreisandEffect#83:

spelling

# This is the commit message StreisandEffect#84:

regex_replace

# This is the commit message StreisandEffect#85:

regex_replace

# This is the commit message StreisandEffect#86:

langauge_name

# This is the commit message StreisandEffect#87:

item in loop

# This is the commit message StreisandEffect#88:

trying iteritems

# This is the commit message StreisandEffect#89:

ocserv i18n

# This is the commit message StreisandEffect#90:

openvpn i18n

# This is the commit message StreisandEffect#91:

fixed stunnel status

# This is the commit message StreisandEffect#92:

updated shadowsocks instructions

# This is the commit message StreisandEffect#93:

shadowsocks i18n

# This is the commit message StreisandEffect#94:

finished ssh i18n

# This is the commit message StreisandEffect#95:

finished gateway i18n

# This is the commit message StreisandEffect#96:

adding index and firewall fr

# This is the commit message StreisandEffect#97:

finished tor i18n, adding .html to templates

# This is the commit message StreisandEffect#98:

finished wg i18n

# This is the commit message StreisandEffect#99:

wg with_dict not with_items

# This is the commit message StreisandEffect#100:

fixed streisand mirror index task

# This is the commit message StreisandEffect#101:

fixed shadowsocks mirror index fr

# This is the commit message #102:

streisand_markdown_mirror_page removed

# This is the commit message StreisandEffect#103:

streisand_ci = no

# This is the commit message StreisandEffect#104:

fixed tor gateway instructions

# This is the commit message StreisandEffect#105:

hopefully fixes all page generation issues

# This is the commit message StreisandEffect#106:

updated index-fr.html

# This is the commit message StreisandEffect#107:

l2tp oconnect should generate correctly now

# This is the commit message StreisandEffect#108:

fixed mirror links for i18n

# This is the commit message StreisandEffect#109:

finished remaining translation, mirror link fixes

# This is the commit message StreisandEffect#110:

fixed stunnel instructions

# This is the commit message StreisandEffect#111:

hopefully the last of the corrections

# This is the commit message StreisandEffect#112:

typos and grammatics

# This is the commit message StreisandEffect#113:

more corrections

# This is the commit message StreisandEffect#114:

mirroring french localized tor

# This is the commit message StreisandEffect#115:

minor corrections

# This is the commit message StreisandEffect#116:

clarifications

# This is the commit message StreisandEffect#117:

Somme de contrôle

# This is the commit message StreisandEffect#118:

s/potatso/cross

# This is the commit message StreisandEffect#119:

changed google links for fr to hl=fr

# This is the commit message StreisandEffect#120:

copypasta quirk

# This is the commit message StreisandEffect#121:

cleanup, removed shadowsocks OTA

# This is the commit message StreisandEffect#122:

removed shadowsocks from unattended upgrades

# This is the commit message StreisandEffect#123:

removed unecessary stuff from unattended upgrades

# This is the commit message StreisandEffect#124:

Streisand CI Testing

# This is the commit message StreisandEffect#125:

CI updates based on feedback

# This is the commit message StreisandEffect#126:

permissions

# This is the commit message StreisandEffect#127:

updated readme-fr

# This is the commit message StreisandEffect#128:

Update readme-fr

No need for brew update anymore

# This is the commit message StreisandEffect#129:

removed ci
@sebastienbarre
Copy link

Just a quick note that for Mac/OSX users, the above command by @DavidWittman:

networksetup -setv6off Ethernet && networksetup -setv6off Wi-Fi

might fail to disable IPv6 for your Wi-Fi adapter on recent laptops, which do not have an Ethernet adapter (the first call to networksetup will fail, preventing the second from executing).

Better safe than sorry, execute them separately:

networksetup -setv6off Ethernet
networksetup -setv6off Wi-Fi

BTW, this is the error message you might get:

networksetup -setv6off Ethernet
Ethernet is not a recognized network service.
** Error: The parameters were not valid.

@Lexy2
Copy link
Contributor

Lexy2 commented May 4, 2018

@sebastienbarre , you could use a command
networksetup -setv6off Ethernet; networksetup -setv6off Wi-Fi
This way the second command will execute even if the first one fails.

@grigorig
Copy link

grigorig commented Aug 5, 2018

In this day and age, it is a horrible idea to disable IPv6 system-wide. Nobody should ever recommend this!

It should be quite easy to push IPv6 configuration to clients and then null-route it on the Streisand server side, though. This should always work and does not require any special client configuration.

@asomov
Copy link

asomov commented Jan 25, 2020

@grigorig : (I am one of those who disabled IP6 in order to use Streisand)
Can you please provide a descriptions of steps to follow your proposal ?

@grigorig
Copy link

grigorig commented Jan 26, 2020 •
edited
Loading

I think it should be enough to add command to OpenVPN to have clients add a route for all global IPv6 addresses. Add push "route-ipv6 2000::/3" to the OpenVPN server configuration. That way, all globally routable IPv6 traffic should be sent over the VPN interface, but it will end up nowhere because the VPN server cannot route it. You might also need to add a bogus IPv6 server configuration (as described in the OpenVPN documentation), not sure.

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees
No one assigned
Labels
kind/network kind/privacy provider/digital-ocean status/help-wanted For items we'd love help with
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests