Habr

[Перевод] Практическое руководство по атакам на IPv6 в локальной сети

Отключение IPv6 на шлюзе давно перестало быть надежной защитой. Протокол по умолчанию активен на большинстве клиентских машин, которые периодически отправляют в сеть служебные запросы вроде Router Solicitation. Именно эта «скрытая» активность открывает двери для целого класса атак, позволяющих перехватить трафик, подменить DNS или провести NTLM-Relay. В этой статье мы подробно, с примерами кода на Python/Scapy и командами для настройки, рассмотрим самые распространенные векторы атак на IPv6 в локальном сегменте: RA Spoofing: Как навязать себя в качестве шлюза по умолчанию. RDNSS Spoofing: Как стать DNS-сервером для современных ОС без DHCPv6. DHCPv6-атаки: Механика работы mitm6 и ее ручная реализация. Пассивный сбор данных: Как составить карту сети, просто слушая эфир. Материал будет полезен пентестерам, сетевым инженерам и системным администраторам, которые хотят понять реальные риски IPv6 и научиться им противостоять.

habr.com/ru/articles/930526/

#ipv6 #пентест #RA_Spoofing #RDNSS #DHCPv6 #Scapy #MITM #Kali_Linux #информационная_безопасность #infosec

Практическое руководство по атакам на IPv6 в локальной сети

Безопасность IPv6 в последнее время стала насущной…

Хабр
Erik Nygren :verified:

I've published the -00 for a new IETF draft: #DHCPv6 Recommended #IPv6 Address Option"

datatracker.ietf.org/doc/html/

The primary use-case for this is hosting, datacenter, and cloud environments that want to assign a /64 per host but which also want to ensure the host configures one or more addresses (such as for management and running services). Operators configuring servers in these environments want to be able to ensure that a host will be available on a given /128 (for ssh'ing into, putting into DNS as a service endpoint, etc) while DHCPv6-PD also means that the host is free to use the rest of the /64 for its own purposes (eg, containers, K8s pods, temporary addresses, etc).

I'd also be happy to add a co-author if someone else is interested in seeing this through.

DHCPv6 Recommended IPv6 Address Option

This document defines a new DHCPv6 option for communicating…

IETF Datatracker
Jul 03, 2025, 19:47 · · · 2 · 0
KMJ 🇦🇹

Is there any way to assign a #IPv6 IP Adress to #GrapheneOS on a #DHCPv6 net?

9pfs

For those who specialize in DHCPv6 and systemd: Is there a way to tell the DHCPv6 server "If this IP is available, just give me it, don't give me anything else", or at least get systemd to do that? I'm trying to make an oracle cloud instance running Arch+systemd-networkd that uses DHCPv6 for IP configuration only use one of two IPs assigned to the oracle instance, but leave the other one unused so I can do NDP proxying and route it to my laptop over wireguard, giving my laptop a public IPv6 address as a result, but it appears that oracle is forcing my VPS to use both IPv6 addresses, which is not what I want.
Redacted logs, for context:

Jun 18 06:08:27 somewhere systemd-networkd[-1]: eth0: DHCPv6 address 2000::4201/128 (valid for 1d 5
9min 59s, preferred for 23h 59min 59s)
Jun 18 06:08:27 somewhere systemd-networkd[-1]: eth0: DHCPv6 address 2000::1337/128 (valid for 1d 5
9min 59s, preferred for 23h 59min 59s)

Feel free to boost this for increased visibility if you wish, and if you know of any mailing lists or IRC channels I should ask on, please let me know.
Relevant tags to try to help people who might know something see this:
#dhcp #ipv6 #systemd #oracle #dhcpv6 #networking #systemdnetworkd #systemd-networkd

Adi'Vaala vas Miðgarðr 👨🏼‍💻

#DHCPv6 isch au e Wüsseschaft für sich 😄
Aber die knack ich scho no, schwör!

Jedefalls: Persönleche Iidruck bishär isch, das falsch alles, was me so a Router überchund, sich mal hauptsächlech (au Feature-Mässig) uf IPv4 fokussiert, so das me praktisch zwunge isch, Dual Stack z fahre.
Ich glaube darum, NAT isch cho, um z bliibe - für immer 🙃

IPv6-only, anyone? 😅

Adam ♿

[Update: yes, at least on Launtel]

#IPv6 experts, is #DHCPv6 *required* for Prefix Delegation?

My ISP seems to send Router Advertisements with a single address out of a /64 (should that be a /128?), but OpenWrt is sending a DHCPv6 request to get my normal /48

#AskFedi

Mar 07, 2025, 10:37 · · · 0 · 0
Ondřej Caletka

Ha! Great news from #MikroTik #RouterOS changelog. Looks like somebody finally tried to use #DHCPv6 Relay and figured out it was completely useless for DHCP-PD.

7.18
*) dhcpv6-relay - added option to create routes for bindings passing through relay;
7.18.1
*) dhcpv6-relay - clear saved routes on DHCP release;

mikrotik.com/download/changelo

MikroTik

MikroTik makes networking hardware and software, which…

mikrotik.com
Mar 07, 2025, 08:24 · · · 0 · 0
Tomi

**IPv6 connectivity and Synology Router**

Read it on my blog, it has a nicer image/text layout.

I’m writing this blog post for other users of Telekom SI who wonder ‘How to establish IPv6 connection on Synology RT6600ax router‘?

The issue: which IPv6 mode?

Maybe it is obvious how to setup IPv6 connection for networking professionals, for me it wasn’t. It took few days I managed to connect to IPv6.

The story went like this.

Firstly I connected Synology router to the Innobox G92 modem and Telekom support put it in bridge mode (more about wifi mesh issues).
I activated a static IPv4 and IPv6 address in ‘Moj Telekom’ portal.I got IPv6 address in the form of: xxxx:xxx:xxxx:xxxx:0:0:0:0/56
I wanted to activate IPv6 connection (Network center / Internet / IPv6 setup). There were 8 possibilities (Auto, Manual, 6in4, 6to4, DHCPv6-PD, IPv6 relay and FLET’s IPv6 service)

I was puzzled and called Telekom SI support. They had no clue and said it should work automatically. ‘Auto‘ mode in IPv6 setup didn’t work.
I tried to activate it by using ‘Manual‘ mode. I entered the following:IPv6 address: I tried xxxx:xxx:xxxx:xxxx:0:0:0:0 and xxxx:xxx:xxxx:xxxx:0:0:0:1
Prefix length: 64
Gateway: the number was filled automatically (local modem address I think) fe80: ….
Preferred DNS server: left as it was
Prefix: I entered the address I got in the form xxxx:xxx:xxxx:xxxx:: (double semicolons at the end) /56

And it worked! But not for long. Next day, modem showed it was connected, but when I checked my IP (https://whatismyipaddress.com/), it didn’t show my IPv6 address and the network behaved strangely. I clicked DHCPv6-PD and then back to ‘manual’ and it worked again. But every day the connection broke and I have to repeat the procedure.

The solution – DHCPv6-PD

Then I read some German and Polish forums and found out they use DHCPv6-PD mode.

I tried it and it works! The SRM user interface behaves very strange – when I switch mode (IPv6 Setup pulldown) to DHPv6 I can not set prefix, DNS server etc. The solution was that I switched to ‘manual’ first, clicked OK, opened the setup again and switched to DHCPv6-PD. Then it worked.

The IPv6 connection is now stable.

Nevertheless, this setup works strange: Every day the router gets a new IPv6 address (DIFFERENT from the assigned static IPv6 range). Maybe because of security or something. But my devices have correct IPv6 addresses (from the assigned range).

Most probably, I just don’t know well enough how IPv6 works.

LAN setup

After establishing IPv6 Internet connection, I enabled IPv6 on my LAN.

Finally I could choose the prefix (xxxx:xxx:xxxx:xxx0-7::). As long as the setup on the ‘Internet’ page was wrong, I couldn’t select the prefix in LAN setup.

I’ve selected ‘Stateless DHCPv6 mode’.

I’ve also set static IPv6 addresses to my 2 Piholes and entered them here.

TL;DR

The good:

At the end, I’ve managed to setup IPv6 connection, it works and I’m already using it. I’ve noticed some minor speedups when accessing some web pages.

The bad:

ISP (Telekom SI) could explain somewhere how to connect to IPv6 in some document or FAQ. And educate its helpdesk support. Basic instructions (like – choose DHCPv6-PD) would be nice.

Synology could improve IPv6 setup menu. As it is currently designed (greyed out input fields that can be changed only when choosing ‘manual’ mode), it is completely illogical to me.

Tags: #synology #innobox #ipv6 #telekomsi #DHCPv6-PD

https://blog.rozman.info/ipv6-connectivity-and-synology-router/

#DHCPv6 #innobox #ipv6 #synology #telekomsi

Feb 19, 2025, 15:12 · · · 1 · 0
Nicholas

@_elena it is interesting how #DNS and #Fediverse apps will "heal" themselves. For example if #Sidekiq goes down, when you restore it, it takes a few minutes for federation to complete

For DNS , #DNSv6 and #DHCPv6 should improve it a little bit

Dan Oachs

@litchralee_v6 Yeah, ip security cameras can be a pain. Luckily we are almost exclusively a single camera brand that has had decent #ipv6 support for a long time. They even support #dhcpv6 which is nice.

goetz 🚲

@kmj @lucasmz

You can only control the whole /64 subnet per routing. The devices get there configuration with the RA / RDNSS or with stateless #DHCPv6, but no static addresses for mobile devices, as it is best practice using temp addresses.
Monitoring should happen with Neighbor Discovery and also implement RA Guard etc.

academy.ripe.net/enrol/index.p

Jan ☕🎼🎹☁️🏋️‍♂️

@kevin I was looking at the options in #opnsense for registering the #dhcpv6 addresses, but.. It's unclear how that works.

Camille - stature de tragédien

#IPv6

Du coup j'étais en galère avec mon smartphone sur un réseau séparé à ne pas chopper IPv6 😂

Alors qu'en fait il suffisait de dégager #dhcpv6 et laisser les #RA annoncer le préfixe avec #RDNSS

Bon faut pas que je dégage tout, y a quand même un #PD (délégation de préfixe) à gérer 😅

Camille - stature de tragédien

#IPv6

Ok !
J'avais pas suivi ça : issuetracker.google.com/issues

#Google refuse (via un certain Lorenzo visiblement chef de projet IPv6 pour Android) d'implémenter #DHCPv6 dans #Android

L'idée c'est que DHCPv6 ne donne qu'une seule adresse IPv6/nœud (oui nœuds/liens/globale/locale c'est la novlangue IPv6, mettez vous à la page ! :p ) et que ça bloque quelques fonctionnalités IPv6 (genre les adresses privacy, le tethering etc...)

Google Issue Tracker

issuetracker.google.com
Mikael Hansson

Extremely surprising finding: while #FreeBSD has no problems at all taking part in an #IPv6 network via #SLAAC or manually assigned addresses in combination with regular router advertisements, even the version 14 base system still doesn’t seem to support #DHCPv6 in a standards-compliant way. forums.freebsd.org/threads/is- from 2018 suggests using dual-dhcpcd. Is that still the recommended solution?

Solved - Is there a working DHCPv6 client for FreeBSD?

It seems dhclient and dhcp6 are all broken at this…

forums.freebsd.org
Ondřej Caletka

Some arguments people use in the discussion about #DHCPv6 support in #Android are just ridiculous: “very SOPHISTICATED firewall,” “IPXE,” “part of the IPv6 spec” 🙄

I'm sort of getting allergic to mentions starting like “RFC says that…” without quoting the exact document.

K‮ly‬e

For anyone using the DHCPv6 client app (be.mygod.dhcpv6client) on a recent version of Android, here's something that might save you some frustration - I learned it the hard way.

In theory, you'd only need the app to run occasionally if your leasetimes are reasonably long, so it's tempting to try and save battery by not exempting it from background restrictions. I figured I'd be clever and rig up a trigger to fire it every day plus whenever I reconnected to the network, which is probably cheaper than running a separate app constantly. And lo and behold, my wifi just couldn't hold a connection anymore.

After a lot of troubleshooting, it turns out that, when the app is killed off by the system, the underlying library removes any addresses it's acquired. On its face, this doesn't seem so bad, as the network should revert to IPv4-only after those addresses are removed. But it gets worse: because you stop receiving IPv6 traffic immediately, but the connectivity check takes a while to invalidate the cached IPv6 address it's monitoring, Android will interpret the fact that it's no longer receiving responses as evidence that the network failed. So your phone disconnects from the wifi - and if the whole cycle triggers on every connection, you'll never get more than about a minute of connectivity before it all comes crashing down.

So as far as I can tell, there's no alternative but to exempt it from background restrictions, and leave it running constantly even though you only need it to exchange a couple packets with the router every 24 hours. If anyone figures out a way to overcome this, I'd love to hear about it. Otherwise, I hope this helps someone else facing similar frustrations.

#android
#ipv6
#dhcp
#dhcpv6

Andrei G. :unverified:

Are there any #Ubiquiti users who made #IPv6 over #PPPoE with #DHCPv6 work (prefix delegation)? I have spent months debugging it while feeding a support ticket that goes nowhere. I can see packets that advertise the network prefix allocated by the ISP but not replies to router solicitations later. In effect, I never end up with an IPv6 on the router (#UDMPro).

Obviously, the ISP's #Huawei router just works...

Did I ever mention my love-hate relationship with Ubiquiti?!