Disable IPv6 from DNS

markdudov

@johnpoz Yes, I know, but is there any way where I can disable it?

johnpoz

I don't see that on mine, but I am not running 24.03 as of yet.. It doesn't make any difference.. Your listening on loopback 127.0.0.1 that is the IPv6 version of it..

fireodo

@markdudov said in Disable IPv6 from DNS:

Yes, I know, but is there any way where I can disable it?

~~If you use ISC DHCP~~ In unbound settings in "Custom options" set

do-ip6: no

IMHO

johnpoz

@fireodo you mean unbound - what would dhcpd have to do with anything? Maybe that is why I don't see it, I have in my unbound settings

fireodo

@johnpoz said in Disable IPv6 from DNS:

you mean unbound

Yeah, sorry!

johnpoz

@fireodo still must have something to do with 24.03 started showing that. I removed my do-ipv6 setting, and even changed listen interfaces to all vs the specifics I had set and still only see 127.0.0.1 and not the IPv6 version.

Maybe that setting in 24.03 will remove it?

I won't know until I finish my office remodel in the next few weeks. When I move everything into my new rack is when I will install the ssd into my pfsense and upgrade it to 24.03.. Be able to play with it then - but I still don't see the reason to worry about it listing that..

markdudov

@johnpoz @fireodo

Is this the correct location?
Services -> DNS Resolver-> General Settings -> Custom options

Text inside: do-ip6: no

Or I'm wrong about the place, because the ipv6 loopback address doesn't disappear

johnpoz

@markdudov you will need a server: line above it I would think.. like this

But I am not even sure if that setting will have any effect it... To be honest it shouldn't

fireodo

@markdudov said in Disable IPv6 from DNS:

Is this the correct location?
Services -> DNS Resolver-> General Settings -> Custom options

Text inside: do-ip6: no

Yes! I have here 2.7.2 CE but I dont think unbound is so much different in 24.03 ... Maybe you need a "server" line above as johnpoz has written ...

johnpoz

@fireodo so your saying on your 2.7.2 you see that ::1 in your dns servers like he does if you remove the do-ipv6 setting?

My 2.7.2 lab VM doesn't show that.. I currently don't have IPv6 enabled on it - but you can't really turn off the IPv6 loopback or link-local addresses anyway.

markdudov

@fireodo
Tested it that way too but that didn't make it go away either

fireodo

@johnpoz said in Disable IPv6 from DNS:

so your saying on your 2.7.2 you see that ::1 in your dns servers like he does if you remove the do-ipv6 setting?

I have to check that - I have that doip6:no for very long time ...

Edit: Indeed the 2.7.2 dont show the ip6 even if the line in custom settings is removed ... :-(

johnpoz

@markdudov you can not really get rid of that.. even if doesn't show in your dns.. Loopback is still going to be there

Other than bothering your clearly OCD tendencies it makes no difference.

edit: ok I had updated my pfsense+ lab vm to 24.03 and I see it there.

24.03.jpg

let me see if I can get it to go away ;)

edit2: ok get that ocd monkey off your back you can do this. Set your dns to 127.0.0.1 manually, and any other dns you want.. Not sure why.. to be honest resolving is the way to go imho.

then set pfsense to ignore local and only use remote - which you set to 127.0.0.1 which is your ipv4 loopback

Personally I wouldn't worry about the ::1, especially if your going to set other dns in there.. because your forwarding for your clients. I am not sure how messing with that setup might effect pfsense resolving its own local resources? If you tell it to ignore local and only use remote which you have setup in your dns settings, and you put in multiples with some being say 8.8.8.8 - I am not sure if at some point pfsense my try and resolve its own name for example from 8.8.8.8?

loopback being either 127.0.0.1 or ::1 is just pfsense talking to itself really - what does it matter if it used the ipv4 or ipv6 to do that?

While it does seem you can make the ::1 entry go away, I am not 100% on what sort of side effect that could bring in the future? Your better off just fighting off the ocd monkey, maybe you need to take off your hammer protection gloves to do that? ;)

mvikman

Or just hide the DNS-part in the System widget... :)

johnpoz

@mvikman hahaha

ocd monkey gone with simple click ;)

JonathanLee

You can set it to solve only A records also
unbound resolver custom options like this

server:
do-ip4: yes
prefer-ip4: yes
do-ip6: no
prefer-ip6: no
private-address: ::/0
dns64-ignore-aaaa: *.*
do-not-query-address: ::
do-not-query-address: ::1
do-not-query-address: ::/0