{"id":66138,"date":"2022-08-01T09:00:42","date_gmt":"2022-08-01T09:00:42","guid":{"rendered":"https:\/\/www.cryptocabaret.com\/?p=66138"},"modified":"2022-08-01T09:00:42","modified_gmt":"2022-08-01T09:00:42","slug":"how-i-disabled-ipv6-on-linux","status":"publish","type":"post","link":"https:\/\/www.cryptocabaret.com\/?p=66138","title":{"rendered":"How I disabled IPv6 on Linux"},"content":{"rendered":"

How I disabled IPv6 on Linux<\/span>
\nDavid Both<\/a><\/span>
\nMon, 08\/01\/2022 – 03:00<\/span><\/p>\n

\n
Register<\/a> or Login<\/a> to like<\/div>\n
Register<\/a> or Login<\/a> to like<\/div>\n<\/div>\n
\n

IPv6 is a good thing for the Internet in general, but I find it unnecessarily complex for use in most home and small- to medium-size businesses. Like many others, I continue to use private IPv4 address ranges for my own internal networks and those for which I have some level of responsibility. My ISP only provides IPv4 addresses anyway, so it makes no sense to use IPv6 internally when all external packets are IPv4. Besides, IPv4 is much simpler, and one of my Linux Philosophy tenets is “Find the Simplicity.”<\/p>\n

As a result, I disabled IPv6 on all my hosts. It seemed easy\u2014at first. Here is how I did it.<\/p>\n<\/p>\n

\n
More Linux resources<\/div>\n
\n
Linux commands cheat sheet<\/a><\/div>\n
Advanced Linux commands cheat sheet<\/a><\/div>\n
Free online course: RHEL technical overview<\/a><\/div>\n
Linux networking cheat sheet<\/a><\/div>\n
SELinux cheat sheet<\/a><\/div>\n
Linux common commands cheat sheet<\/a><\/div>\n
What are Linux containers?<\/a><\/div>\n
Our latest Linux articles<\/a><\/div>\n<\/p><\/div>\n<\/p><\/div>\n

Testing for IPv6<\/h2>\n

My hosts run the Fedora 36 Xfce spin<\/a> along with many packages and configuration changes I perform after the initial default installation. All of my hosts have the most recent updates installed. One of those hosts is my firewall\/router, which is the first host on which I disabled IPv6.<\/p>\n

You can check to see whether IPv6 is currently active on your Linux host. The nmcli<\/code> command results below are from my router\/firewall host. All the active NICs have both IPv4 and IPv6 addresses.<\/p>\n

\n
# nmcli<\/span>
\nenp4s0: connected to enp4s0
\n\u00a0 \u00a0 \u00a0 \u00a0 \"Realtek RTL8111\/8168\/8411\"<\/span>
\n\u00a0 \u00a0 \u00a0 \u00a0 ethernet (<\/span>r8169)<\/span>, 84<\/span>:16<\/span>:F9:04:44<\/span>:03, hw, mtu 1500<\/span>
\n\u00a0 \u00a0 \u00a0 \u00a0 ip4 default
\n\u00a0 \u00a0 \u00a0 \u00a0 inet4 45.20.209.41\/<\/span>29<\/span>
\n\u00a0 \u00a0 \u00a0 \u00a0 route4 45.20.209.40\/<\/span>29<\/span> metric 102<\/span>
\n\u00a0 \u00a0 \u00a0 \u00a0 route4 default via 45.20.209.46 metric 102<\/span>
\n\u00a0 \u00a0 \u00a0 \u00a0 inet6 2600<\/span>:1700<\/span>:7c0:860<\/span>:8616<\/span>:f9ff:fe04:4403<\/span>\/<\/span>64<\/span>
\n\u00a0 \u00a0 \u00a0 \u00a0 inet6 fe80::8616<\/span>:f9ff:fe04:4403<\/span>\/<\/span>64<\/span>
\n\u00a0 \u00a0 \u00a0 \u00a0 route6 fe80::\/<\/span>64<\/span> metric 256<\/span>
\n\u00a0 \u00a0 \u00a0 \u00a0 route6 default via fe80::a698:13ff:fee5:fa10 metric 1024<\/span>
\n\u00a0 \u00a0 \u00a0 \u00a0 route6 2600<\/span>:1700<\/span>:7c0:860<\/span>::\/<\/span>64<\/span> metric 256<\/span>

\nenp1s0: connected to enp1s0
\n\u00a0 \u00a0 \u00a0 \u00a0 \"Realtek RTL8111\/8168\/8411\"<\/span>
\n\u00a0 \u00a0 \u00a0 \u00a0 ethernet (<\/span>r8169)<\/span>, 84<\/span>:16<\/span>:F9:03:E9:89<\/span>, hw, mtu 1500<\/span>
\n\u00a0 \u00a0 \u00a0 \u00a0 inet4 192.168.10.1\/<\/span>24<\/span>
\n\u00a0 \u00a0 \u00a0 \u00a0 route4 192.168.10.0\/<\/span>24<\/span> metric 101<\/span>
\n\u00a0 \u00a0 \u00a0 \u00a0 inet6 fe80::8616<\/span>:f9ff:fe03:e989\/<\/span>64<\/span>
\n\u00a0 \u00a0 \u00a0 \u00a0 route6 fe80::\/<\/span>64<\/span> metric 256<\/span>

\nenp2s0: connected to enp2s0
\n\u00a0 \u00a0 \u00a0 \u00a0 \"Realtek RTL8111\/8168\/8411\"<\/span>
\n\u00a0 \u00a0 \u00a0 \u00a0 ethernet (<\/span>r8169)<\/span>, 84<\/span>:16<\/span>:F9:03:FD:85<\/span>, hw, mtu 1500<\/span>
\n\u00a0 \u00a0 \u00a0 \u00a0 inet4 192.168.0.254\/<\/span>24<\/span>
\n\u00a0 \u00a0 \u00a0 \u00a0 route4 192.168.0.0\/<\/span>24<\/span> metric 100<\/span>
\n\u00a0 \u00a0 \u00a0 \u00a0 inet6 fe80::8616<\/span>:f9ff:fe03:fd85\/<\/span>64<\/span>
\n\u00a0 \u00a0 \u00a0 \u00a0 route6 fe80::\/<\/span>64<\/span> metric 256<\/span>

\nlo: unmanaged
\n\u00a0 \u00a0 \u00a0 \u00a0 \"lo\"<\/span>
\n\u00a0 \u00a0 \u00a0 \u00a0 loopback (<\/span>unknown)<\/span>, 00:00:00:00:00:00, sw, mtu 65536<\/span>

\nDNS configuration:
\n\u00a0 \u00a0 \u00a0 \u00a0 servers: 192.168.0.52 8.8.8.8 8.8.4.4
\n\u00a0 \u00a0 \u00a0 \u00a0 interface: enp4s0

\n\u00a0 \u00a0 \u00a0 \u00a0 servers: 192.168.0.52 8.8.8.8
\n\u00a0 \u00a0 \u00a0 \u00a0 interface: enp2s0

\n\u00a0 \u00a0 \u00a0 \u00a0 servers: 192.168.0.52 8.8.8.8
\n\u00a0 \u00a0 \u00a0 \u00a0 interface: enp1s0<\/div><\/div><\/pre>\n
Use GRUB to configure the kernel<\/h2>\n
GRUB\u2013the Grand Unified Bootloader\u2013loads the kernel into memory and sets many kernel parameters during the Linux boot process. The current bootloader is actually GRUB2, the second major version of GRUB, but it is easier just to call it GRUB.<\/p>\n
The GRUB configuration file \/boot\/grub2\/grub.cfg<\/code> provides the startup configuration for the kernel, but you should not modify it directly. The location of the UEFI GRUB configuration file may vary depending on your distribution. However, its location is irrelevant for this purpose. Linux startup kernel configuration can be easily modified using the \/etc\/default\/grub<\/code> configuration file, which configures the kernel properly regardless of whether it boots using UEFI.<\/p>\n
There are two command line arguments to add to the \/etc\/default\/grub<\/code> file to configure the Linux kernel to disable IPv6. The first, GRUB_CMDLINE_LINUX=”ipv6.disable=1″<\/strong> adds “ipv6.disable=1”<\/strong> to the kernel command line.<\/p>\n
The second, GRUB_CMDLINE_LINUX_DEFAULT=”ipv6.disable=1 quiet splash”<\/strong> is a little more complicated. When you set GRUB_DISABLE_RECOVERY<\/strong> to true<\/strong>, one menu entry will be generated for each Linux kernel. When set to false<\/strong>, two menu entries are created for each kernel: One default entry and one entry for recovery mode. This option lists command-line arguments to be added only to the default menu entry, after those listed in GRUB_CMDLINE_LINUX<\/strong>.<\/p>\n
The other two arguments define how the kernel startup looks on the display. The “quiet”<\/strong> argument disables most of the informational messages emitted by the kernel during its startup and self-configuration. The “splash”<\/strong> argument causes the splash screen to be displayed during kernel startup. The splash screen can be a graphic such as a logo or an animation.<\/p>\n
My \/etc\/default\/grub<\/code> file looks like this after making those additions:<\/p>\n
\n
GRUB_TIMEOUT=5
\nGRUB_DISTRIBUTOR=\"$(sed 's, release .*$,,g' \/etc\/system-release)\"
\nGRUB_DEFAULT=saved
\nGRUB_DISABLE_SUBMENU=true
\nGRUB_TERMINAL_OUTPUT=\"console\"
\nGRUB_CMDLINE_LINUX=\"rhgb quiet\"
\nGRUB_DISABLE_RECOVERY=\"true\"
\nGRUB_ENABLE_BLSCFG=true
\nGRUB_CMDLINE_LINUX_DEFAULT=\"ipv6.disable=1 quiet splash\"
\nGRUB_CMDLINE_LINUX=\"ipv6.disable=1\"<\/div><\/div><\/pre>\n
After making these (or any) additions to the \/etc\/default\/grub<\/code> file, run the grub2-mkconfig<\/code> command, which adds these arguments to the kernel command line in the grub.cfg<\/code> configuration file for each installed kernel. These changes do not take effect immediately. You must reboot the hosts for IPv6 to be disabled.<\/p>\n
Automate this solution<\/h2>\n
Automating these tasks using Ansible is straightforward. Just create a playbook with the following settings and run it against the list of hosts that need this change. The first two tasks in this playbook append the desired configuration:<\/p>\n
\n
- name<\/span>: <\/span>Play 1 - Modify \/etc\/default\/grub to configure kernel boot parameters.
\n\u00a0 hosts<\/span>: <\/span>f36vm

\n\u00a0 tasks<\/span>:
\n\u00a0 \u00a0 - name<\/span>: <\/span>Append GRUB_CMDLINE_LINUX_DEFAULT variable to \/etc\/default\/grub
\n\u00a0 \u00a0 \u00a0 lineinfile<\/span>:
\n\u00a0 \u00a0 \u00a0 \u00a0 path<\/span>: <\/span>\/etc\/default\/grub
\n\u00a0 \u00a0 \u00a0 \u00a0 insertafter<\/span>: <\/span>EOF
\n\u00a0 \u00a0 \u00a0 \u00a0 line<\/span>: <\/span>'GRUB_CMDLINE_LINUX_DEFAULT=\"ipv6.disable=1 quiet splash\"<\/span>'

\n\u00a0 \u00a0 - name<\/span>: <\/span>Append GRUB_CMDLINE_LINUX variable to \/etc\/default\/grub
\n\u00a0 \u00a0 \u00a0 lineinfile<\/span>:
\n\u00a0 \u00a0 \u00a0 \u00a0 path<\/span>: <\/span>\/etc\/default\/grub
\n\u00a0 \u00a0 \u00a0 \u00a0 insertafter<\/span>: <\/span>EOF
\n\u00a0 \u00a0 \u00a0 \u00a0 line<\/span>: <\/span>'GRUB_CMDLINE_LINUX=\"ipv6.disable=1\"<\/span>'

\n\u00a0 \u00a0 - name<\/span>: <\/span>Run grub2-mkconfig to update \/boot\/grub\/grub.cfg
\n\u00a0 \u00a0 \u00a0 command<\/span>:
\n\u00a0 \u00a0 \u00a0 \u00a0 cmd<\/span>: <\/span>grub2-mkconfig<\/div><\/div><\/pre>\n
Once again, you must reboot the hosts for IPv6 to be disabled. You can add the reboot to the playbook so that the changes take effect immediately, or wait until the next time the hosts need to be rebooted for other reasons.<\/p>\n
The other solution<\/h2>\n
I created another solution; it is just not the best and most elegant option. However, I want to show my thought process because there is some information here that might be useful.<\/p>\n
Add a local file to sysctl.d<\/h3>\n
You can use the \/etc\/sysctl<\/code> file to add the configuration settings necessary, but it is much better to add a local file to the \/etc\/sysctl.d<\/code> directory so that it won’t be overwritten during updates or upgrades. Note that there is already a file named 99-sysctl.conf<\/code>. You can use that file to set the configuration, but I created a file named 99-local-network.conf<\/code> with the following content for this purpose. That way, if the 99-sysctl.conf<\/code> changes with future updates or upgrades, my file will remain untouched. This is not an executable file; it is a configuration file.<\/p>\n
\n
################################################################################
\n# Local NetworkManager settings - Specifically to disable IPV6 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 #
\n################################################################################
\n#
\nnet.ipv6.conf.all.disable_ipv6 = 1
\nnet.ipv6.conf.default.disable_ipv6 = 1<\/div><\/div><\/pre>\n
Note<\/strong>: Like many configuration files in configuration directories like this one, the files contained in the directory are read in natural sorted order. That means the value for a variable declared in a file with a later sort order will override an earlier declaration for the same variable.<\/p>\n
A reboot is usually used to cause these changes to take effect, but I later learned how to do so without a reboot. I rebooted my system and reran the nmcli<\/code> command with the following results:<\/p>\n
\n
[<\/span>root@<\/span>wally ~]<\/span># nmcli<\/span>
\nenp4s0: connected to enp4s0
\n\u00a0 \u00a0 \u00a0 \u00a0 \"Realtek RTL8111\/8168\/8411\"<\/span>
\n\u00a0 \u00a0 \u00a0 \u00a0 ethernet (<\/span>r8169)<\/span>, 84<\/span>:16<\/span>:F9:04:44<\/span>:03, hw, mtu 1500<\/span>
\n\u00a0 \u00a0 \u00a0 \u00a0 ip4 default
\n\u00a0 \u00a0 \u00a0 \u00a0 inet4 45.20.209.41\/<\/span>29<\/span>
\n\u00a0 \u00a0 \u00a0 \u00a0 route4 45.20.209.40\/<\/span>29<\/span> metric 101<\/span>
\n\u00a0 \u00a0 \u00a0 \u00a0 route4 default via 45.20.209.46 metric 101<\/span>

\nenp1s0: connected to enp1s0
\n\u00a0 \u00a0 \u00a0 \u00a0 \"Realtek RTL8111\/8168\/8411\"<\/span>
\n\u00a0 \u00a0 \u00a0 \u00a0 ethernet (<\/span>r8169)<\/span>, 84<\/span>:16<\/span>:F9:03:E9:89<\/span>, hw, mtu 1500<\/span>
\n\u00a0 \u00a0 \u00a0 \u00a0 inet4 192.168.10.1\/<\/span>24<\/span>
\n\u00a0 \u00a0 \u00a0 \u00a0 route4 192.168.10.0\/<\/span>24<\/span> metric 102<\/span>

\nenp2s0: connected to enp2s0
\n\u00a0 \u00a0 \u00a0 \u00a0 \"Realtek RTL8111\/8168\/8411\"<\/span>
\n\u00a0 \u00a0 \u00a0 \u00a0 ethernet (<\/span>r8169)<\/span>, 84<\/span>:16<\/span>:F9:03:FD:85<\/span>, hw, mtu 1500<\/span>
\n\u00a0 \u00a0 \u00a0 \u00a0 inet4 192.168.0.254\/<\/span>24<\/span>
\n\u00a0 \u00a0 \u00a0 \u00a0 route4 192.168.0.0\/<\/span>24<\/span> metric 100<\/span>

\nlo: unmanaged
\n\u00a0 \u00a0 \u00a0 \u00a0 \"lo\"<\/span>
\n\u00a0 \u00a0 \u00a0 \u00a0 loopback (<\/span>unknown)<\/span>, 00:00:00:00:00:00, sw, mtu 65536<\/span>

\nDNS configuration:
\n\u00a0 \u00a0 \u00a0 \u00a0 servers: 192.168.0.52 8.8.8.8 8.8.4.4
\n\u00a0 \u00a0 \u00a0 \u00a0 interface: enp4s0

\n\u00a0 \u00a0 \u00a0 \u00a0 servers: 192.168.0.52 8.8.8.8
\n\u00a0 \u00a0 \u00a0 \u00a0 interface: enp2s0

\n\u00a0 \u00a0 \u00a0 \u00a0 servers: 192.168.0.52 8.8.8.8
\n\u00a0 \u00a0 \u00a0 \u00a0 interface: enp1s0<\/div><\/div><\/pre>\n
This shows that my simple fix worked.<\/p>\n
Except…<\/h3>\n
Except that solution only works on one of my twelve Linux computers. After writing the above part of this article, I started installing this fix on all of my other hosts. I had only done one system when I realized that this approach did not always work. I then tried it on one of my VMs and it also failed there. As best I can tell, it only works on one host\u2014the one I use as my firewall and router.<\/p>\n
After some additional research on a VM, I discovered that these settings could also be issued as commands using sysctl<\/code> so that the system would not need a reboot. I could enter those commands from the command line to deactivate IPv6. Here’s an example:<\/p>\n
\n
[<\/span>root@<\/span>f36vm ~]<\/span># sysctl -w net.ipv6.conf.all.disable_ipv6=1<\/span>
\nnet.ipv6.conf.all.disable_ipv6 = 1<\/span>
[<\/span>root@<\/span>f36vm ~]<\/span># sysctl -w net.ipv6.conf.default.disable_ipv6=1<\/span>
\nnet.ipv6.conf.default.disable_ipv6 = 1<\/span>
[<\/span>root@<\/span>f36vm ~]<\/span># nmcli<\/span>
\nenp0s3: connected to Wired connection 1<\/span>
\n\u00a0 \u00a0 \u00a0 \u00a0 \"Intel 82540EM\"<\/span>
\n\u00a0 \u00a0 \u00a0 \u00a0 ethernet (<\/span>e1000)<\/span>, 08:00:27<\/span>:07:CD:FE, hw, mtu 1500<\/span>
\n\u00a0 \u00a0 \u00a0 \u00a0 ip4 default
\n\u00a0 \u00a0 \u00a0 \u00a0 inet4 192.168.0.136\/<\/span>24<\/span>
\n\u00a0 \u00a0 \u00a0 \u00a0 route4 192.168.0.0\/<\/span>24<\/span> metric 100<\/span>
\n\u00a0 \u00a0 \u00a0 \u00a0 route4 default via 192.168.0.254 metric 100<\/span>

\nlo: unmanaged
SNIP><\/span><\/span><\/div><\/div><\/pre>\n
It took some time to research this and determine that the file I created was not being read\u2013or at least not processed\u2013by sysctl<\/code> during the Linux startup. Or, if it was, it was being ignored or the settings were being overwritten later by the same variables with different values. After this, I knew that there was no deeper problem preventing it.<\/p>\n
About sysctl<\/h3>\n
At this point, I looked into the sysctl<\/code> command in more detail. The purpose of the sysctl<\/code> command is to set kernel parameters in the \/proc<\/code> directory. The root user can use it to set individual parameters from the command line. In addition\u2013and this is the key to my solution\u2013you can use it to view and set all of the kernel parameters stored in several locations, including \/etc\/sysctl.conf<\/code> and in files located in \/etc\/sysctl.d<\/code>. The sysctl<\/code> command is used during Linux startup to set the kernel parameters.<\/p>\n
I repeat: The system and the sysadmin can use the sysctl<\/code> command to view and set kernel variables while the system is up and running and without a reboot. This command and the power it offers the Linux sysadmin is one of the most significant differences between Linux and other operating systems. It gives us a tool to do things impossible on other OSs.<\/p>\n
I tested this by rebooting the VM and running the following command to set the variables in all locations listed on the sysctl<\/code> man page:<\/p>\n
\n
[<\/span>root@<\/span>f36vm ~]<\/span># sysctl --system<\/span>
*<\/span> Applying \/<\/span>usr\/<\/span>lib\/<\/span>sysctl.d\/<\/span>10<\/span>-default-yama-scope.conf ...
\nkernel.yama.ptrace_scope = 0<\/span>
*<\/span> Applying \/<\/span>usr\/<\/span>lib\/<\/span>sysctl.d\/<\/span>50<\/span>-coredump.conf ...
\nkernel.core_pattern = |\/<\/span>usr\/<\/span>lib\/<\/span>systemd\/<\/span>systemd-coredump %<\/span>P %<\/span>u %<\/span>g %<\/span>s %<\/span>t %<\/span>c %<\/span>h
\nkernel.core_pipe_limit = 16<\/span>
\nfs.suid_dumpable = 2<\/span>
*<\/span> Applying \/<\/span>usr\/<\/span>lib\/<\/span>sysctl.d\/<\/span>50<\/span>-default.conf ...
\nkernel.sysrq = 16<\/span>
\nkernel.core_uses_pid = 1<\/span>
\nnet.ipv4.conf.default.rp_filter = 2<\/span>
\nsysctl: setting key \"net.ipv4.conf.all.rp_filter\"<\/span>: Invalid argument
\nnet.ipv4.conf.default.accept_source_route = 0<\/span>
\nsysctl: setting key \"net.ipv4.conf.all.accept_source_route\"<\/span>: Invalid argument
\nnet.ipv4.conf.default.promote_secondaries = 1<\/span>
\nsysctl: setting key \"net.ipv4.conf.all.promote_secondaries\"<\/span>: Invalid argument
\nnet.ipv4.ping_group_range = 0<\/span> 2147483647<\/span>
\nnet.core.default_qdisc = fq_codel
\nfs.protected_hardlinks = 1<\/span>
\nfs.protected_symlinks = 1<\/span>
\nfs.protected_regular = 1<\/span>
\nfs.protected_fifos = 1<\/span>
*<\/span> Applying \/<\/span>usr\/<\/span>lib\/<\/span>sysctl.d\/<\/span>50<\/span>-libkcapi-optmem_max.conf ...
\nnet.core.optmem_max = 81920<\/span>
*<\/span> Applying \/<\/span>usr\/<\/span>lib\/<\/span>sysctl.d\/<\/span>50<\/span>-libreswan.conf ...
\nnet.ipv6.conf.default.accept_redirects = 0<\/span>
\nnet.ipv6.conf.all.accept_redirects = 0<\/span>
\nnet.ipv4.conf.default.send_redirects = 0<\/span>
\nnet.ipv4.conf.default.accept_redirects = 0<\/span>
\nnet.ipv4.conf.all.send_redirects = 0<\/span>
\nnet.ipv4.conf.all.accept_redirects = 0<\/span>
*<\/span> Applying \/<\/span>usr\/<\/span>lib\/<\/span>sysctl.d\/<\/span>50<\/span>-pid-max.conf ...
\nkernel.pid_max = 4194304<\/span>
*<\/span> Applying \/<\/span>etc\/<\/span>sysctl.d\/<\/span>99<\/span>-local-network.conf ...
\nnet.ipv6.conf.all.disable_ipv6 = 1<\/span>
\nnet.ipv6.conf.default.disable_ipv6 = 1<\/span>
*<\/span> Applying \/<\/span>etc\/<\/span>sysctl.d\/<\/span>99<\/span>-sysctl.conf ...
*<\/span> Applying \/<\/span>etc\/<\/span>sysctl.conf ...

[<\/span>root@<\/span>f36vm ~]<\/span>#<\/span><\/div><\/div><\/pre>\n
Checking the status of the NIC with the nmcli<\/code> command showed that IPv6 had been disabled and that IPv4 was still up and running. Yes, I do see the other errors in that data stream, but I am ignoring them for now. Be sure to read the man page for the sysctl<\/code> command as it is quite interesting. It provides a method for processing all sysctl<\/code> configuration files with the --service<\/code> option.<\/p>\n
The solution<\/h3>\n
Now that I understood the true nature of the problem, I could create a real solution\u2013even if it might be only a temporary circumvention. I was able to do so in a way that is in keeping with the original intent of the Linux startup sequence and the sysctl.d<\/code> method for configuring the kernel.<\/p>\n
I left my new configuration file in place in \/etc\/sysctl.d<\/code>. I created the simple Bash script shown below to run the sysctl --system<\/code> command and stored it in \/usr\/local\/bin<\/code>.<\/p>\n
\n
#!\/bin\/bash<\/span>
SNIP \u2013 discarded a bunch of comments to save space><\/span>
\nsysctl --system<\/span><\/span><\/div><\/div><\/pre>\n
I tested this script multiple times before proceeding to ensure that it worked. If you do this, be sure to test it multiple times, both with and without rebooting, to return to the original kernel configuration.<\/p>\n
Create the service<\/h3>\n
The real key to this solution was to create a new systemd<\/code> service that would work similarly to the old rc.local<\/code> SystemV script. In this case, I called it the MyStartup.service<\/code>, and I renamed the script I created above and called it MyStartup.sh<\/code>. To create the service itself, I created a new systemd<\/code> unit file in the \/usr\/local\/lib\/systemd\/system<\/code> directory, which I also had to make. This service will run once at startup. I named this new file MyStartup.service<\/code> and added the following content:<\/p>\n
\n

\n[Unit]
\nDescription=Runs \/usr\/local\/bin\/MyStartup.sh

\n[Service]
\nExecStart=\/usr\/local\/bin\/MyStartup.sh

\n[Install]
\nWantedBy=multi-user.target<\/snip><\/div><\/div><\/pre>\n
Note that systemd<\/code> unit files like this one don’t need to be executable. It is owned by root.root with 664 permissions. It’s pretty simple to create this service, and I can use it for so many local startup tasks that I plan to keep it even when there is a permanent fix to the extant problem.<\/p>\n
The command below enables the new service. Note that the systemctl<\/code> command searches the new directory by default without any options, arguments, or prodding from me to locate the new unit file.<\/p>\n
\n
[<\/span>root@<\/span>f36vm ~]<\/span># systemctl enable MyStartup.service<\/span>
\nCreated symlink \/<\/span>etc\/<\/span>systemd\/<\/span>system\/<\/span>multi-user.target.wants\/<\/span>MyStartup.service \u2192 \/<\/span>usr\/<\/span>local\/<\/span>lib\/<\/span>systemd\/<\/span>system\/<\/span>MyStartup.service.<\/div><\/div><\/pre>\n
Enabling the service does not run the MyStartup.sh<\/code> script. This service will run the script at every reboot.<\/p>\n
Testing<\/h3>\n
As soon as the VM rebooted, I logged in as root and ran the following command to check the status of IPv6, but it was still active. After more testing, I determined that the service was running the commands too soon, so I added a command to the MyStartup.sh<\/code> script to sleep for 25 seconds before running the commands. Here is the edited script:<\/p>\n
\n
#!\/bin\/bash

\n# Wait a bit for things to start up and settle. It doesn't work without this.
\nsleep 25
\n# Run the sysctl command.
\nsysctl --system<\/snip><\/div><\/div><\/pre>\n
I rebooted again and verified the status as soon as I could log in, with the result that the service was still sleeping.<\/p>\n
\n
[<\/span>root@<\/span>f36vm ~]<\/span># systemctl status MyStartup.service<\/span>
\n\u25cf MyStartup.service - Runs \/<\/span>usr\/<\/span>local\/<\/span>bin\/<\/span>MyStartup.sh
\n\u00a0 \u00a0 \u00a0Loaded: loaded (<\/span>\/<\/span>usr\/<\/span>local\/<\/span>lib\/<\/span>systemd\/<\/span>system\/<\/span>MyStartup.service; enabled; vendor preset: disabled)<\/span>
\n\u00a0 \u00a0 \u00a0Active: active (<\/span>running)<\/span> since Fri 2022<\/span>-07-01 13<\/span>:24<\/span>:22<\/span> EDT; 14s ago
\n\u00a0 \u00a0Main PID: 667<\/span> (<\/span>MyStartup.sh)<\/span>
\n\u00a0 \u00a0 \u00a0 Tasks: 2<\/span> (<\/span>limit: 14129<\/span>)<\/span>
\n\u00a0 \u00a0 \u00a0Memory: 592.0K
\n\u00a0 \u00a0 \u00a0 \u00a0 CPU: 1ms
\n\u00a0 \u00a0 \u00a0CGroup: \/<\/span>system.slice\/<\/span>MyStartup.service
\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0\u251c\u2500 667<\/span> \/<\/span>bin\/<\/span>bash<\/span> \/<\/span>usr\/<\/span>local\/<\/span>bin\/<\/span>MyStartup.sh
\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0\u2514\u2500 669<\/span> sleep<\/span> 25<\/span><\/div><\/div><\/pre>\n
After waiting some additional time, I checked again, and the service had completed successfully, with the results clearly shown in the last few journal entries. Further testing showed that a delay of three seconds works reliably, while a delay of only one second always fails.<\/p>\n
\n
Jul 01 13<\/span>:24<\/span>:22<\/span> f36vm.both.org systemd[<\/span>1<\/span>]<\/span>: Started MyStartup.service - Runs \/<\/span>usr\/<\/span>local\/<\/span>bin\/<\/span>MyStartup.sh.

[<\/span>root@<\/span>f36vm ~]<\/span># systemctl status MyStartup.service<\/span>
\n\u25cb MyStartup.service - Runs \/<\/span>usr\/<\/span>local\/<\/span>bin\/<\/span>MyStartup.sh
\n\u00a0 \u00a0 \u00a0Loaded: loaded (<\/span>\/<\/span>usr\/<\/span>local\/<\/span>lib\/<\/span>systemd\/<\/span>system\/<\/span>MyStartup.service; enabled; vendor preset: disabled)<\/span>
\n\u00a0 \u00a0 \u00a0Active: inactive (<\/span>dead)<\/span> since Fri 2022<\/span>-07-01 13<\/span>:24<\/span>:47<\/span> EDT; 358ms ago
\n\u00a0 \u00a0 Process: 667<\/span> ExecStart<\/span>=\/<\/span>usr\/<\/span>local\/<\/span>bin\/<\/span>MyStartup.sh (<\/span>code<\/span>=exited, status<\/span>=0<\/span>\/<\/span>SUCCESS)<\/span>
\n\u00a0 \u00a0Main PID: 667<\/span> (<\/span>code<\/span>=exited, status<\/span>=0<\/span>\/<\/span>SUCCESS)<\/span>
\n\u00a0 \u00a0 \u00a0 \u00a0 CPU: 9ms

\nJul 01 13<\/span>:24<\/span>:47<\/span> f36vm.both.org MyStartup.sh[<\/span>1020<\/span>]<\/span>: net.ipv4.conf.all.send_redirects = 0<\/span>
\nJul 01 13<\/span>:24<\/span>:47<\/span> f36vm.both.org MyStartup.sh[<\/span>1020<\/span>]<\/span>: net.ipv4.conf.all.accept_redirects = 0<\/span>
\nJul 01 13<\/span>:24<\/span>:47<\/span> f36vm.both.org MyStartup.sh[<\/span>1020<\/span>]<\/span>: *<\/span> Applying \/<\/span>usr\/<\/span>lib\/<\/span>sysctl.d\/<\/span>50<\/span>-pid-max.conf ...
\nJul 01 13<\/span>:24<\/span>:47<\/span> f36vm.both.org MyStartup.sh[<\/span>1020<\/span>]<\/span>: kernel.pid_max = 4194304<\/span>
\nJul 01 13<\/span>:24<\/span>:47<\/span> f36vm.both.org MyStartup.sh[<\/span>1020<\/span>]<\/span>: *<\/span> Applying \/<\/span>etc\/<\/span>sysctl.d\/<\/span>99<\/span>-local-network.conf ...
\nJul 01 13<\/span>:24<\/span>:47<\/span> f36vm.both.org MyStartup.sh[<\/span>1020<\/span>]<\/span>: net.ipv6.conf.all.disable_ipv6 = 1<\/span>
\nJul 01 13<\/span>:24<\/span>:47<\/span> f36vm.both.org MyStartup.sh[<\/span>1020<\/span>]<\/span>: net.ipv6.conf.default.disable_ipv6 = 1<\/span>
\nJul 01 13<\/span>:24<\/span>:47<\/span> f36vm.both.org MyStartup.sh[<\/span>1020<\/span>]<\/span>: *<\/span> Applying \/<\/span>etc\/<\/span>sysctl.d\/<\/span>99<\/span>-sysctl.conf ...
\nJul 01 13<\/span>:24<\/span>:47<\/span> f36vm.both.org MyStartup.sh[<\/span>1020<\/span>]<\/span>: *<\/span> Applying \/<\/span>etc\/<\/span>sysctl.conf ...
\nJul 01 13<\/span>:24<\/span>:47<\/span> f36vm.both.org systemd[<\/span>1<\/span>]<\/span>: MyStartup.service: Deactivated successfully.

[<\/span>root@<\/span>f36vm ~]<\/span>#<\/span><\/div><\/div><\/pre>\n
You can see in the data output above that the configuration statements in the 99-sysctl.conf<\/code> file were applied. I also used the nmcli<\/code> command to verify that IPv6 has been disabled.<\/p>\n
Automate it<\/h3>\n
After figuring out how to consistently accomplish this solution, I added a set of tasks to do this to the Ansible playbook I use to distribute new and updated configuration files. That makes it easy for me to manage my 12 current hosts. I also added it to the playbook I use immediately after performing a basic installation on new hosts or ones that need a reinstallation for some reason. I added the following tasks to those playbooks.<\/p>\n
This first set of tasks is for my solution to add a new service:<\/p>\n
\n
 \u00a0 \u00a0- name<\/span>: <\/span>Install 99-local-network.conf file to disable IPV6
\n\u00a0 \u00a0 \u00a0 copy<\/span>:
\n\u00a0 \u00a0 \u00a0 \u00a0 src<\/span>: <\/span>\/root\/ansible\/system-scripts\/files\/99-local-network.conf
\n\u00a0 \u00a0 \u00a0 \u00a0 dest<\/span>: <\/span>\/etc\/sysctl.d
\n\u00a0 \u00a0 \u00a0 \u00a0 mode<\/span>: <\/span>0644
\n\u00a0 \u00a0 \u00a0 \u00a0 owner<\/span>: <\/span>root
\n\u00a0 \u00a0 \u00a0 \u00a0 group<\/span>: <\/span>root

\n\u00a0 \u00a0 - name<\/span>: <\/span>Install MyStartup.sh
\n\u00a0 \u00a0 \u00a0 copy<\/span>:
\n\u00a0 \u00a0 \u00a0 \u00a0 src<\/span>: <\/span>\/root\/ansible\/system-scripts\/files\/MyStartup.sh
\n\u00a0 \u00a0 \u00a0 \u00a0 dest<\/span>: <\/span>\/usr\/local\/bin
\n\u00a0 \u00a0 \u00a0 \u00a0 mode<\/span>: <\/span>0754
\n\u00a0 \u00a0 \u00a0 \u00a0 owner<\/span>: <\/span>root
\n\u00a0 \u00a0 \u00a0 \u00a0 group<\/span>: <\/span>root

\n\u00a0 \u00a0 - name<\/span>: <\/span>create \/root\/ansible\/system-scripts\/files\/ directory
\n\u00a0 \u00a0 \u00a0 file<\/span>:
\n\u00a0 \u00a0 \u00a0 \u00a0 path<\/span>: <\/span>\/root\/ansible\/system-scripts\/files\/
\n\u00a0 \u00a0 \u00a0 \u00a0 state<\/span>: <\/span>directory
\n\u00a0 \u00a0 \u00a0 \u00a0 mode<\/span>: <\/span>0755
\n\u00a0 \u00a0 \u00a0 \u00a0 owner<\/span>: <\/span>root
\n\u00a0 \u00a0 \u00a0 \u00a0 group<\/span>: <\/span>root \u00a0
\n\u00a0 \u00a0 \u00a0 
\n\u00a0 \u00a0 - name<\/span>: <\/span>Install MyStartup.service
\n\u00a0 \u00a0 \u00a0 copy<\/span>:
\n\u00a0 \u00a0 \u00a0 \u00a0 src<\/span>: <\/span>\/root\/ansible\/system-scripts\/files\/MyStartup.service
\n\u00a0 \u00a0 \u00a0 \u00a0 dest<\/span>: <\/span>\/usr\/local\/lib\/systemd\/system\/
\n\u00a0 \u00a0 \u00a0 \u00a0 mode<\/span>: <\/span>0664
\n\u00a0 \u00a0 \u00a0 \u00a0 owner<\/span>: <\/span>root
\n\u00a0 \u00a0 \u00a0 \u00a0 group<\/span>: <\/span>root

\n\u00a0 \u00a0 - name<\/span>: <\/span>Enable the MyStartup.service
\n\u00a0 \u00a0 \u00a0 systemd<\/span>:
\n\u00a0 \u00a0 \u00a0 \u00a0 name<\/span>: <\/span>MyStartup.service
\n\u00a0 \u00a0 \u00a0 \u00a0 state<\/span>: <\/span>stopped
\n\u00a0 \u00a0 \u00a0 \u00a0 enabled<\/span>: <\/span>yes<\/span>

\n\u00a0 \u00a0 - name<\/span>: <\/span>Run the raw command to disable IPV4 so a reboot is not required at this time
\n\u00a0 \u00a0 \u00a0 command<\/span>:
\n\u00a0 \u00a0 \u00a0 \u00a0 cmd<\/span>: <\/span>sysctl --system<\/div><\/div><\/pre>\n
The advantage of this more complex solution of adding the configuration file to the sysctl.d<\/code> directory and then running a playbook with this series of tasks is it disables IPv6 without requiring a reboot.<\/p>\n<\/p>\n
\n
More for sysadmins<\/div>\n
\n
Enable Sysadmin blog<\/a><\/div>\n
The Automated Enterprise: A guide to managing IT with automation<\/a><\/div>\n
eBook: Ansible automation for Sysadmins<\/a><\/div>\n
Tales from the field: A system administrator’s guide to IT automation<\/a><\/div>\n
eBook: A guide to Kubernetes for SREs and sysadmins<\/a><\/div>\n
Latest sysadmin articles<\/a><\/div>\n<\/p><\/div>\n<\/p><\/div>\n
Final thoughts<\/h2>\n
Although just installing the file with the correct kernel parameters and rebooting worked fine on one of my hosts, it failed on all of the others I tried. I looked for differences that might explain why it failed on the others while working on my router\/firewall but found nothing that provided a clue as to why this is so. I discovered this problem exists on hosts with newly installed Fedora 36 without any of the changes and post-installation configuration that I always perform and on those with my usual changes. I do plan to keep investigating. I intend to submit a bug report to Red Hat so that there might be an actual fix to this instead of either of these circumventions.<\/p>\n
Neither circumvention depends upon the existence of any NIC configuration files\u2014either the old-style interface configuration files that used to be located in \/etc\/sysconfig\/network-scripts<\/code> or the newer NetworkManager interface connection files located in the \/etc\/NetworkManager\/system-connections<\/code> directory. It works with or without those files. The result is global for all network interfaces on the host.<\/p>\n
My own solution is a somewhat general approach that you can use in lieu of the old rc.local<\/code> script of the old SystemV startup days.<\/p>\n
Resources<\/h3>\n
The following resources are kept as current as possible but may not be completely accurate at any given time.<\/p>\n