IPv6 Development

Whonix ®

Download

Windows Linux Mac VirtualBox KVM Qubes USB ISO (coming soon) More options Source Code

About

Overview Features Whonix vs VPNs Why Open Source? Project Activities Contributors Mission & Vision

Docs

Documentation FAQ Troubleshooting

Community

Forums Contribute

Support

Self Support First Policy Search Engines, Docs and AI Support (Limited) Reporting Bugs Contact (Restricted)

Tools Upload file Special pages Recent changes Print Version Page meta What links here Related changes Page information

Page Read Edit History Move Protection Unwatch Watch Delete Purge

User Preferences Watchlist Contributions Logout Create account Login

Donate

Development notes for adding IPv6 support to Whonix.

Essential Knowledge

• Tor 6to4: Tor is capable of tunneling IPv6 over IPv4. Even if your ISP does not support IPv4, the user will still be able to reach IPv6 destinations. Tor will build circuits over IPv4. However, IPv6 traffic is tunneled through IPv4. There is no need to have functional IPv6 support for clearnet just to be able to reach IPv6 destinations over Tor.
• Qubes specific.
  • https://www.qubes-os.org/doc/networking/#limitations

    • Currently only IPv4 DNS servers are configured, regardless of ipv6 feature state. It is done this way to avoid reconfiguring all connected qubes whenever IPv6 DNS becomes available or not. Configuring qubes to always use IPv6 DNS and only fallback to IPv4 may result in relatively long timeouts and poor usability. But note that DNS using IPv4 does not prevent to return IPv6 addresses. In practice this is only a problem for IPv6-only networks.

  • Qubes IPv6 only mode bug: Fix IPv6 connectivity on downstream qubes

IPv6 Support in Whonix

IPv6 support are multiple parts.

• A) Whonix-Workstation connecting to Whonix-Gateway using IPv6.
  • TODO
• B) Tor proxying connections to IPv6 destinations.
  • Already functional with Tor Browser.
    • NOTE: ISP IPv6 feature state does not matter. Tor does not require functional IPv6 by the ISP to be able to proxy/tunnel IPv6. Tor can tunnel IPv6 over IPv4.
  • curl: TODO
  • transparent proxying: TODO
• C) Tor using IPv6 to build Tor circuits.
  • TODO

Whonix TODO

• Whonix
  • In file /etc/sysctl.d/anonymizer-config-gateway.conf comment out net.ipv6.conf.all.disable_ipv6 = 1.
• Use ULA (unique local address)?
  • IPV6: Use GUA (Global Unicast Addresses) or reserved addresses instead of ULA (Unique Local Unicast Addresses) within Qubes
  • GUA might have a higher risk for leaks?
  • We should avoid depending on reserved addresses because their status could be changed in the future (while we aren't keeping tracking of this anymore) and we'd run into unexpected behavior or leakage.
  • At least ULAs designed to do what we want them to do and will remain as such.
  • Solution? Keep using ULA but use one of the workaround from above ticket?
• Use IPv4 mapped IPv6 addresses?
  • /etc/network/interfaces

iface eth0 inet6 static
    address ::FFFF:192.168.0.1
    netmask 96

• Non-Qubes-Whonix
  • Whonix-Gateway: https://github.com/Whonix/whonix-gw-network-conf/blob/master/etc/network/interfaces.d/30_non-qubes-whonix
  • Whonix-Workstation: https://github.com/Whonix/whonix-ws-network-conf/blob/master/etc/network/interfaces.d/30_non-qubes-whonix
• Qubes-Whonix
  • temporarily during development in dom0: qvm-features sys-whonix ipv6 1
  • Send a pull request to Qubes salt to no longer run command qvm-features sys-whonix ipv6 "" or maybe qvm-features sys-whonix ipv6 0.

Tor IPv6 Configuration

sudo nano /etc/tor/torrc

SocksPort [::1]:9050

sudo systemctl restart tor

• How to listen on both localhost, IPv4 and IPv6 at the same time with 1 configuration line?
• document how to listen on localhost on both, IPv4 and IPv6 at the same time using SocksPort *:Port

Note: If localhost on the system (inside the VM) does not have IPv6 support, Tor will fail to start.

[warn] Could not bind to ::1:9050: Cannot assign requested address
[warn] Failed to parse/validate config: Failed to bind one of the listener ports.
[err] Reading config failed--see warnings above.

Functional

Definitions:

• broken ISP IPv6: Your ISP does not provide IPv6. Visiting IPv6 pages are broken.

Overview:

• broken ISP IPv6 + Debian + Tor IPv6 Configuration (see above) + curl --ipv6 + IPv6 localhost
  • using IP (without DNS)
    • curl --ipv6 --proxy socks5h://[::1]:9050 --resolve v6.ipv6test.app:443:[2600:9000:21f3:1800:18:3c03:3680:93a1] https://v6.ipv6test.app/
  • using DNS
    • curl --ipv6 --proxy socks5h://[::1]:9050 https://v6.ipv6test.app/
  • example output: 2a0b:f4c2:1::1
    • an IP address of a Tor IPv6 exit relay. Can be verified using ExoneraTor (example).
• broken ISP IPv6 + Debian + Tor Browser + IPv6-only test page
• broken ISP IPv6 + Whonix-Workstation + Tor Browser + IPv6-only test page

Notes:

• Tor SocksPort configuration option IPv6Traffic is optional, not required.
• Find out the IP address of an IPv6 test server. Requires functional IPv6 connectivity somewhere.
  • nslookup v6.ipv6test.app
    • 2600:9000:21f3:1800:18:3c03:3680:93a1

TODO Test

• functional ISP IPv6 + Debian + curl --ipv6 + IPv6 via IP only (without DNS)
  • useful for testing if IP connectivity is functional while exluding potential DNS related issues
  • curl --ipv6 --resolve v6.ipv6test.app:443:[2600:9000:21f3:1800:18:3c03:3680:93a1] https://v6.ipv6test.app/

IPv6-only test pages

These are only reachable over IPv6. Not over IPv4 at all. This makes these test pages ideal for testing.

• https://v6.ipv6test.app/

Test Scenario

After full IPv6 support has been added to Whonix, the following test might be ideal to test if IPv6 is fully functional.

IPv6 only ISP simulation:

• Disable IPv4 either:
  • A) on the router or,
  • B) alternatively, in case of Non-Qubes-Whonix alternatively on the host operating system.
  • C) alternatively, in case of Qubes-Whonix use a VM sys-ipv4-breaker (A ProxyVM that disables IPv4 using sysctl)

Discussion

• add IPv6 support
• add IPv6 support to Qubes-Whonix

Whonix The most watertight privacy operating system in the world.

Dark mode

Follow us on social media

Supported by Power Up Privacy

Whonix is proudly supported until 2025 by Power Up Privacy, a privacy advocacy group that seeks to supercharge privacy projects with resources so they can complete their mission of making our world a better place. (Strictly subject to our sponsorship policy.)

At Whonix we value freedom and trust, supporting Open Source and Freedom Software

By using this website, you acknowledge you have read, understood, and agree to be bound by these agreements: Terms of Service, Privacy Policy, Cookie Policy, E-Sign Consent, DMCA, Imprint 2012- 2024 ENCRYPTED SUPPORT LP

Your support makes
all the difference!

We believe security software like Whonix needs to remain open source and independent. Would you help sustain and grow the project? Learn more about our 12 year success story and maybe DONATE!