IPv6 Development

From Whonix
< Dev
Jump to navigation Jump to search

Development notes for adding IPv6 support to Whonix.

Essential Knowledge[edit]

  • Tor 6to4: Tor is capable of tunneling IPv6 over IPv4. Even if your ISP does not support IPv4, the user will still be able to reach IPv6 destinations. Tor will build circuits over IPv4. However, IPv6 traffic is tunneled through IPv4. There is no need to have functional IPv6 support for clearnet just to be able to reach IPv6 destinations over Tor.
  • Qubes specific.
    • https://www.qubes-os.org/doc/networking/#limitationsarchive.org

      • Currently only IPv4 DNS servers are configured, regardless of ipv6 feature state. It is done this way to avoid reconfiguring all connected qubes whenever IPv6 DNS becomes available or not. Configuring qubes to always use IPv6 DNS and only fallback to IPv4 may result in relatively long timeouts and poor usability. But note that DNS using IPv4 does not prevent to return IPv6 addresses. In practice this is only a problem for IPv6-only networks.

    • Qubes IPv6 only mode bug: Fix IPv6 connectivity on downstream qubesarchive.org

IPv6 Support in Whonix[edit]

IPv6 support are multiple parts.

Whonix TODO[edit]

iface eth0 inet6 static
    address ::FFFF:192.168.0.1
    netmask 96

VirtualBox[edit]

  • VirtualBox NAT currently doesn't support IPv6. It only provides an IPv4 address which we configured statically in etc/network/interfaces.d/30_non-qubes-whonix
  • As a workaround, we can switch the Gateway network to use a Bridged Adapter to the hosts network interface. This however exposes the Gateway to the hosts network. To allow IPv6 packages reaching the VM, Promiscuous mode needs to be changed to "Allow All".
  • We need to add an address to our network configuration in etc/network/interfaces.d/30_non-qubes-whonix or let it automatically be configured, such as with
iface eth0 inet6 auto


Libvirt[edit]

  • On the gateway, the network XML configuration needs to be modified to add an additional IPv6 address, such as the following:
<network>
 <name>Whonix-External</name>
 <uuid>0944b9e9-dd9c-4dd2-97e8-3b8d810d3b3f</uuid>
 <forward mode="nat"/>
 <bridge name="virbr1" stp="on" delay="0"/>
 <mac address="52:54:00:18:58:37"/>
 <dns enable="no"/>
 <ip family="ipv4" address="10.0.2.2" netmask="255.255.255.0">
 </ip>
 <ip family="ipv6" address="fd19:c33d:98bc::" prefix="64">
 </ip>
</network>
  • We need to add the same address also to our network configuration in etc/network/interfaces.d/30_non-qubes-whonix
auto eth0
iface eth0 inet6 static
       address fd19:c33d:98bc::15
       netmask 64
       gateway fd19:c33d:98bc::
  • On the host it may be necessary to allow forwarding of IPv6 traffic for the desired network on the firewall. The necessary rules may or may not be added by libvirt automatically. Here an example configuration for ip6tables created by libvirt:
-A LIBVIRT_FWI -d fd19:c33d:98bc::/64 -o virbr1 -j ACCEPT
-A LIBVIRT_FWI -o virbr1 -j REJECT --reject-with icmp6-port-unreachable
-A LIBVIRT_FWO -s fd19:c33d:98bc::/64 -i virbr1 -j ACCEPT
-A LIBVIRT_FWO -i virbr1 -j REJECT --reject-with icmp6-port-unreachable
-A LIBVIRT_FWX -i virbr1 -o virbr1 -j ACCEPT
  • On the host we also need to enable forwarding of IPv6 with sysctl net.ipv6.conf.all.forwarding=1

Tor IPv6 Configuration[edit]

sudo nano /etc/tor/torrc

SocksPort [::1]:9050

sudo systemctl restart tor

Note: If localhost on the system (inside the VM) does not have IPv6 support, Tor will fail to start. 

[warn] Could not bind to ::1:9050: Cannot assign requested address
[warn] Failed to parse/validate config: Failed to bind one of the listener ports.
[err] Reading config failed--see warnings above.

Functional[edit]

Definitions:

  • broken ISP IPv6: Your ISP does not provide IPv6. Visiting IPv6 pages are broken.

Overview:

  • broken ISP IPv6 + Debian + Tor IPv6 Configuration (see above) + curl --ipv6 + IPv6 localhost
    • using IP (without DNS)
      • curl --ipv6 --proxy socks5h://[::1]:9050 --resolve v6.ipv6test.app:443:[2600:9000:21f3:1800:18:3c03:3680:93a1] https://v6.ipv6test.app/
    • using DNS
      • curl --ipv6 --proxy socks5h://[::1]:9050 https://v6.ipv6test.app/
    • example output: 2a0b:f4c2:1::1
  • broken ISP IPv6 + Debian + Tor Browser + IPv6-only test page
  • broken ISP IPv6 + Whonix-Workstation + Tor Browser + IPv6-only test page

Notes:

  • Tor SocksPort configuration option IPv6Traffic is optional, not required.
  • Find out the IP address of an IPv6 test server. Requires functional IPv6 connectivity somewhere.
    • nslookup v6.ipv6test.app
      • 2600:9000:21f3:1800:18:3c03:3680:93a1

TODO Test[edit]

  • functional ISP IPv6 + Debian + curl --ipv6 + IPv6 via IP only (without DNS)
    • useful for testing if IP connectivity is functional while exluding potential DNS related issues
    • curl --ipv6 --resolve v6.ipv6test.app:443:[2600:9000:21f3:1800:18:3c03:3680:93a1] https://v6.ipv6test.app/

IPv6-only test pages[edit]

These are only reachable over IPv6. Not over IPv4 at all. This makes these test pages ideal for testing.

Test Scenario[edit]

After full IPv6 support has been added to Whonix, the following test might be ideal to test if IPv6 is fully functional.

IPv6 only ISP simulation:

  • Disable IPv4 either:
    • A) on the router or,
    • B) alternatively, in case of Non-Qubes-Whonix alternatively on the host operating system.
    • C) alternatively, in case of Qubes-Whonix use a VM sys-ipv4-breaker (A ProxyVM that disables IPv4 using sysctl)

Discussion[edit]

Your support makes
all the difference!

We believe security software like Whonix needs to remain open source and independent. Would you help sustain and grow the project? Learn more about our 12 year success story and maybe DONATE!

Retrieved from "https://www.whonix.org/w/index.php?title=Dev/ipv6&oldid=102759"