Hide IPv4 WAN address while using Hurricane Electric IPv6 tunnel

JKnott

^^^^
Just to verify what I said above, I decided to see what happens at that site. In my browser, I run an add-on called "ShowIP", which displays the IP address of a web site, whether IPv4 or IPv6. For example, if I go to google or wikipedia, I see an IPv6 address. Some other sites, which are IPv4 only, show an IPv4 address. Well, when I went to test-ipv6.com, I got an IPv4 address 216.218.228.125. I also used the host command to see what addresses were available. If a site has both IPv4 and IPv6 addresses, it will show that. I tried it with test-ipv6.com and got the following:

$ host test-ipv6.com
test-ipv6.com has address 216.218.228.125
test-ipv6.com has address 216.218.228.119
test-ipv6.com mail is handled by 10 lists.gigo.com.

As you can see, there are IPv4 addresses, but not IPv6. So, whenever you try that test, you connect via IPv4 and that is how they find out what your IPv4 address is. It has nothing to do with pfSense or he.net.

After you start the test, it will also cause your browser to generate IPv6 traffic to their site, which is how they determine your IPv6 address.

BTW, here's what the host command shows for a site with both IPv4 and IPv6 addresses:

$ host google.com
google.com has address 172.217.0.46
google.com has IPv6 address 2607:f8b0:4006:807::200e
google.com mail is handled by 10 aspmx.l.google.com.
google.com mail is handled by 40 alt3.aspmx.l.google.com.
google.com mail is handled by 50 alt4.aspmx.l.google.com.
google.com mail is handled by 30 alt2.aspmx.l.google.com.
google.com mail is handled by 20 alt1.aspmx.l.google.com.

da9el84

Hey

Thanks for updating :)

I just tested with setting up a local proxy server on a debian machine on my lan. This has been configured to only have ipv6 networking and using that as proxy to test-ipv6.com, then the sites reports that I have no ipv4 as wanted.

I wanted to have my pfsense box as a proxy server, but it looks like it's not possible, just going to have to run a dedicated proxy machine it seems :)

johnpoz

For what possible reason does it matter that this ipv6 test site does not see your ipv4?? Other than some odd tinfoil hat your wearing that must have screwed on with maximum torque??

How exactly are you getting to that site via IPv6 only?? I don't show it with an ipv6 address??

; <<>> DiG 9.10.4-P3 <<>> www.test-ipv6.com AAAA
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 54251
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;www.test-ipv6.com. IN AAAA

;; AUTHORITY SECTION:
test-ipv6.com. 281 IN SOA ns1.test-ipv6.com. jfesler.test-ipv6.com. 2016030401 10800 3600 604800 86400

;; Query time: 63 msec
;; SERVER: 192.168.9.253#53(192.168.9.253)
;; WHEN: Sat Oct 15 07:42:54 Central Daylight Time 2016
;; MSG SIZE rcvd: 94

da9el84

I would rather keep the "why" to myself. I merely came here to see if it was possible to do, using my pfsense setup.

As you can see:

johnpoz

Well if all you want to do is block their test.. That is simple firewall rule to block access to the IPv4 address they do their tests with.. You can see from the tests they do they try and go to an IPv4 site and lookup a A record. And then they try and go to directed IPv4 address - if you block them, then their test shows no IPv4..

I show that they are using ipv4.vm1 and ipv4.vm2 depending - so I blocked both of those IPs and as you can see they do not detect my IPv4 address.

If that is all your worried about took 2 seconds to block once you figure out what they are actually doing to detect your addresses.. Which you can see from their test tech info page.

theirtests.jpg_thumb

blocktheirtest.jpg_thumb

da9el84

Thanks for the update, however I am not talking about blocking a single site. I was talking about not sharing my ipv4 information in general.

johnpoz

You just stated before you need ipv4 access to wan, which I assume means to the internet???

If you don't want your machines to use ipv4, ok you can use a proxy that is only using ipv6. You could also just block them from access ipv4 on pfsense to the internet. You do understand this is going to break the vast majority of the internet for you.. While ipv6 has come a long way in last few years. There is a shit ton of stuff that is only ipv4. So if your using ipv6 only proxy there is no way for you to access that ipv4 only stuff.

If what your wanting to accomplish is just hiding true ipv4, then get a vpn and tunnel your traffic through that - then sites you access via ipv4 would see your vpn IPv4 address an not your real ipv4 address.

You do understand if your trying to "hide" from the guys in black and their helicopters ;) Its pretty freaking simple for them to track your ipv6 address from HE…

bimmerdriver

@johnpoz:

You just stated before you need ipv4 access to wan, which I assume means to the internet???

If you don't want your machines to use ipv4, ok you can use a proxy that is only using ipv6. You could also just block them from access ipv4 on pfsense to the internet. You do understand this is going to break the vast majority of the internet for you.. While ipv6 has come a long way in last few years. There is a shit ton of stuff that is only ipv4. So if your using ipv6 only proxy there is no way for you to access that ipv4 only stuff.

If what your wanting to accomplish is just hiding true ipv4, then get a vpn and tunnel your traffic through that - then sites you access via ipv4 would see your vpn IPv4 address an not your real ipv4 address.

You do understand if your trying to "hide" from the guys in black and their helicopters ;) Its pretty freaking simple for them to track your ipv6 address from HE…

I was just going to suggest the same thing WRT using a VPN. I use mullvad. It supports both ipv4 and ipv6, although ipv6 is somewhat flakey. Like other better vpn providers, they don't do any logging and you can even pay with bitcoins.

JKnott

This has been configured to only have ipv6 networking and using that as proxy to test-ipv6.com, then the sites reports that I have no ipv4 as wanted.

How'd you manage to reach an IPv4 only address, with only IPv6 available?

johnpoz

^ not sure he did.. Can tell you for sure if I disable ipv4 on my box, and point to HE ipv6 for dns to just take my unbound cache and ipv4 connectivity out of the question for dns, etc.

I can not get to that site.. I only show test-ipv6.com with IPv4 records.. Be it you query from ipv4 or ipv6 dns..

I disable ipv4 on my machine and only use IPv6 I can not get to that site..

JKnott

^^^^
That's what I'd expect too. Something just doesn't add up here.

johnpoz

That site as I showed you will show you don't have ipv4 if you just block access to those 2 ipv4 IPs.. You can see exactly how the site tests for ipv4.. Which is kind of lame if it only listens on ipv4 kind of obvious that you must of accessed it via ipv4 ;)

So I tested again.. And even when you query only from ipv6 I can not find an IPv6 address for that site.. So loading it must of come up via ipv4..

So while I show NS having ipv6 for that domain

;; QUESTION SECTION:
;test-ipv6.com. IN NS

;; ANSWER SECTION:
test-ipv6.com. 300 IN NS ns1.test-ipv6.com.
test-ipv6.com. 300 IN NS ns2.test-ipv6.com.

;; ADDITIONAL SECTION:
ns1.test-ipv6.com. 300 IN A 216.218.228.118
ns1.test-ipv6.com. 300 IN AAAA 2001:470:1:18::118
ns2.test-ipv6.com. 300 IN A 209.128.193.197
ns2.test-ipv6.com. 300 IN AAAA 2607:f0db:5001:8000::2

If you query the IPv6 NS address you don't get a AAAA response for test-ipv6.com or www.test-ipv6.com

JKnott

I just tried connecting to ns2.test-ipv6.com. I get an unable to connect error.

johnpoz

Not having any problems connecting to them.. But they don't have any AAAA records..

dig @2607:f0db:5001:8000::2 test-ipv6.com AAAA

; <<>> DiG 9.10.4-P3 <<>> @2607:f0db:5001:8000::2 test-ipv6.com AAAA
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 57326
;; flags: qr aa rd; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0
;; WARNING: recursion requested but not available

;; QUESTION SECTION:
;test-ipv6.com. IN AAAA

;; AUTHORITY SECTION:
test-ipv6.com. 300 IN SOA ns1.test-ipv6.com. jfesler.test-ipv6.com. 2016030401 10800 3600 604800 86400

;; Query time: 64 msec
;; SERVER: 2607:f0db:5001:8000::2#53(2607:f0db:5001:8000::2)
;; WHEN: Sun Oct 16 09:51:34 Central Daylight Time 2016
;; MSG SIZE rcvd: 79