Hide IPv4 WAN address while using Hurricane Electric IPv6 tunnel
-
Hi
I have my pfsense router set up with a tunnel to HE via Squid, which is working just fine. When testing test-ip6.com for instance, I see that it also shows my IPv4 address, which I don't want to.
I have tried setting the X-Forwarded Header Mode to both off and delete to no avail in the squid configuration.
Any idea where to "disable" my IPv4 wan address so it doesn't show the websites I am browsing through the HE tunnel?
Help is much appreciated, thanks :)
-
I don't think you really understand what you're asking for. I doubt you want to block IPv4. Those test sites show your IPv4 address because, as part of the test, they trigger some activity to their servers via IPv4. It has nothing to do with the tunnel or firewall. There is nothing, in IPv4 or IPv6, that just announces or advertises your address. So, that site is getting it from some activity that they caused and nothing else.
-
I believe the question is how to ensure that users using squid is only able to browse IPv6 ressources…
On a standalone squid proxy it would be quite easy to achieve just by only assigning IPv6 addresses, in which case the above would be achieved. But since the pfsense box in question is also connected to the IPv4 internet and hence squid will also access IPv4 ressources.
-
sup3rior is right on the money! :)
-
I believe the question is how to ensure that users using squid is only able to browse IPv6 ressources…
On a standalone squid proxy it would be quite easy to achieve just by only assigning IPv6 addresses, in which case the above would be achieved. But since the pfsense box in question is also connected to the IPv4 internet and hence squid will also access IPv4 ressources.
I guess some rule(s) to block user IPv4 traffic is required. If there is to be no IPv4 traffic from the LAN, that shouldn't be too hard.
-
Normal ipv4 traffic from lan->wan is still needed.
Any idea on the rules you are talking about?
-
If you need IPv4 from the LAN, then I don't know any way to stop the test site from seeing the IPv4 address, as they trigger the activity that causes it. There's really no way of blocking that, without blocking blocking all IPv4, unless you just block whatever address they use. I can understand using a proxy, but what is it you're trying to accomplish in not having the test site show an IPv4 address, when IPv4 is supposed to be available to users?
-
If the client conneting to squid is only running IPv6, then the IPv4 from LAN -> WAN issue would be resolved.
The only question remaining would be to block the squid process on the pfSense box from accessing IPv4 ressources. Don't know if it is possible to single out a process like that, am not that familiar with the inner workings of pf…
-
"Normal ipv4 traffic from lan->wan is still needed."
When where are you trying to block IPv4 traffic too exactly?
-
All I want is my pfsense router to not tell sites that are being browsed through my HE tunnel over ipv6, what my ipv4 wan address is. That's it :)
-
^^^^
It's not doing that. As I said earlier, those test sites cause your computer to generate traffic to their servers. There is no other way for them to determine what your IPv4 address is. -
^^^^
Just to verify what I said above, I decided to see what happens at that site. In my browser, I run an add-on called "ShowIP", which displays the IP address of a web site, whether IPv4 or IPv6. For example, if I go to google or wikipedia, I see an IPv6 address. Some other sites, which are IPv4 only, show an IPv4 address. Well, when I went to test-ipv6.com, I got an IPv4 address 216.218.228.125. I also used the host command to see what addresses were available. If a site has both IPv4 and IPv6 addresses, it will show that. I tried it with test-ipv6.com and got the following:$ host test-ipv6.com
test-ipv6.com has address 216.218.228.125
test-ipv6.com has address 216.218.228.119
test-ipv6.com mail is handled by 10 lists.gigo.com.As you can see, there are IPv4 addresses, but not IPv6. So, whenever you try that test, you connect via IPv4 and that is how they find out what your IPv4 address is. It has nothing to do with pfSense or he.net.
After you start the test, it will also cause your browser to generate IPv6 traffic to their site, which is how they determine your IPv6 address.
BTW, here's what the host command shows for a site with both IPv4 and IPv6 addresses:
$ host google.com
google.com has address 172.217.0.46
google.com has IPv6 address 2607:f8b0:4006:807::200e
google.com mail is handled by 10 aspmx.l.google.com.
google.com mail is handled by 40 alt3.aspmx.l.google.com.
google.com mail is handled by 50 alt4.aspmx.l.google.com.
google.com mail is handled by 30 alt2.aspmx.l.google.com.
google.com mail is handled by 20 alt1.aspmx.l.google.com. -
Hey
Thanks for updating :)
I just tested with setting up a local proxy server on a debian machine on my lan. This has been configured to only have ipv6 networking and using that as proxy to test-ipv6.com, then the sites reports that I have no ipv4 as wanted.
I wanted to have my pfsense box as a proxy server, but it looks like it's not possible, just going to have to run a dedicated proxy machine it seems :)
-
For what possible reason does it matter that this ipv6 test site does not see your ipv4?? Other than some odd tinfoil hat your wearing that must have screwed on with maximum torque??
How exactly are you getting to that site via IPv6 only?? I don't show it with an ipv6 address??
; <<>> DiG 9.10.4-P3 <<>> www.test-ipv6.com AAAA
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 54251
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;www.test-ipv6.com. IN AAAA;; AUTHORITY SECTION:
test-ipv6.com. 281 IN SOA ns1.test-ipv6.com. jfesler.test-ipv6.com. 2016030401 10800 3600 604800 86400;; Query time: 63 msec
;; SERVER: 192.168.9.253#53(192.168.9.253)
;; WHEN: Sat Oct 15 07:42:54 Central Daylight Time 2016
;; MSG SIZE rcvd: 94 -
I would rather keep the "why" to myself. I merely came here to see if it was possible to do, using my pfsense setup.
As you can see:
-
Well if all you want to do is block their test.. That is simple firewall rule to block access to the IPv4 address they do their tests with.. You can see from the tests they do they try and go to an IPv4 site and lookup a A record. And then they try and go to directed IPv4 address - if you block them, then their test shows no IPv4..
I show that they are using ipv4.vm1 and ipv4.vm2 depending - so I blocked both of those IPs and as you can see they do not detect my IPv4 address.
If that is all your worried about took 2 seconds to block once you figure out what they are actually doing to detect your addresses.. Which you can see from their test tech info page.
-
Thanks for the update, however I am not talking about blocking a single site. I was talking about not sharing my ipv4 information in general.
-
You just stated before you need ipv4 access to wan, which I assume means to the internet???
If you don't want your machines to use ipv4, ok you can use a proxy that is only using ipv6. You could also just block them from access ipv4 on pfsense to the internet. You do understand this is going to break the vast majority of the internet for you.. While ipv6 has come a long way in last few years. There is a shit ton of stuff that is only ipv4. So if your using ipv6 only proxy there is no way for you to access that ipv4 only stuff.
If what your wanting to accomplish is just hiding true ipv4, then get a vpn and tunnel your traffic through that - then sites you access via ipv4 would see your vpn IPv4 address an not your real ipv4 address.
You do understand if your trying to "hide" from the guys in black and their helicopters ;) Its pretty freaking simple for them to track your ipv6 address from HE…
-
You just stated before you need ipv4 access to wan, which I assume means to the internet???
If you don't want your machines to use ipv4, ok you can use a proxy that is only using ipv6. You could also just block them from access ipv4 on pfsense to the internet. You do understand this is going to break the vast majority of the internet for you.. While ipv6 has come a long way in last few years. There is a shit ton of stuff that is only ipv4. So if your using ipv6 only proxy there is no way for you to access that ipv4 only stuff.
If what your wanting to accomplish is just hiding true ipv4, then get a vpn and tunnel your traffic through that - then sites you access via ipv4 would see your vpn IPv4 address an not your real ipv4 address.
You do understand if your trying to "hide" from the guys in black and their helicopters ;) Its pretty freaking simple for them to track your ipv6 address from HE…
I was just going to suggest the same thing WRT using a VPN. I use mullvad. It supports both ipv4 and ipv6, although ipv6 is somewhat flakey. Like other better vpn providers, they don't do any logging and you can even pay with bitcoins.
-
This has been configured to only have ipv6 networking and using that as proxy to test-ipv6.com, then the sites reports that I have no ipv4 as wanted.
How'd you manage to reach an IPv4 only address, with only IPv6 available?
