Setting properly IPv6 when DHCP is held by router

[fulgeru]

Expected Behaviour:

To filter using IPv6 without using Pi-hole as DHCP, but my router

Actual Behaviour:

under IPv4 was working, but since IPv6 was activated, it doesn't anymore

Debug Token:

https://tricorder.pi-hole.net/6x2d2qh32y

Hello guys,

Please bear with me as I am pretty noob with Linux commands and etc;
I wanted to use the indicated snippet here:

IPV6_ADDRESS=$(ip -6 a | grep '<fc|<fd' | awk -F " " '{gsub("/[0-9]*",""); print $2}')
echo ${IPV6_ADDRESS}
sed -i.setupVars.bak "/IPV6_ADDRESS/d;" "/etc/pihole/setupVars.conf"
echo "IPV6_ADDRESS=${IPV6_ADDRESS}" >> "/etc/pihole/setupVars.conf"
pihole -g

but did not know how to insert it into the /etc/pihole/setupVars.conf path;
anyway, I tried to match the IPv6 manually, but that did not work.

I am highlighting the following information about my scenario:

-I have Win10 so I operate from Putty SSH (beginner knowledge)
-Asus router where for IPv4 I managed to add my Pi-hole IP to the DNS server in the router; this setting was working for about 1 year and today I got my Asus + activated my IPv6
-my internet provider is assigning dynamic IPs with every reboot of my router, so I assume I need to set something in setupVars so it can read the dynamic IP everytime.

Thank you in advance!

[DanSchaper]

Is there a need for IPv6?

The IPv6 address provided in the debug log is currently an open resolver. And the admin page is open to the internet.

[fulgeru]

Not necessary. So you're suggesting I can have IPv6 enabled but I should let the filtering through IPv4 like it was before?
If it works as good as it should, I do not oppose. However, at this point, it does not filter any ads.

[yubiuser]

@fulgeru

If it works as good as it should, I do not oppose. However, at this point, it does not filter any ads.

I can't access your debug log, but no-filtering after IPv6 activation might be due to clients bypass pihole via IPv6 asking your ISP's DNS server directely.

@fulgeru

So you're suggesting

He suggest to turn off IPv6 in your router - and because

@DanSchaper

currently an open resolver. And the admin page is open to the internet.

to do it quickly. Everyone can access your pihole's admin page at the moment from the internet and your pihole does answer DNS queries from everyone out there.

[fulgeru]

thank you for your replies, guys!

So, I don't want to hassle anyone helping/setting my Pi-hole filtering through IPv6 if IPv4 filtering is enough.
But I want to keep my IPv6 enabled at the router level; is there a way to make Pi-hole work again?

[yubiuser]

@fulgeru

But I want to keep my IPv6 enabled at the router level; is there a way to make Pi-hole work again?

Which router model do you have? It might be possible to have IPv6 on your router's WAN but not distributing IPv6 addresses to clients on LAN.

[fulgeru]

some potent Asus and a gigabit connection; I want it fast and that is why I would keep my IPv6 on

I will paste below from its IPv6 log:

IPv6 Connection Type: Native with DHCP-PD
WAN IPv6 Address: 2a02:2f08:ebff:ffff::XXXXXX
WAN IPv6 Link-Local Address: fe80::4f77:176/10
WAN IPv6 Gateway: fe80::1
LAN IPv6 Address: 2a02:2f08:eb0a:100XXXXXX
LAN IPv6 Link-Local Address: fe80::aa5e:45ff:feaXXXXXX
DHCP-PD: Enabled
LAN IPv6 Prefix: 2a02:2f08:eb0a:10XXXX
DNS Servers: 2a02:2f0c:8000:3::1 2a02:2f0c:8000:8::1

IPv6 LAN Devices List

Hostname MAC Address IPv6 Address

OnePlus7T c0:XXXXXXXX:7f 2a02:2f08:eb0a:1000:219c:7a5b:18XXXXXX
Google-Home e4:XXXXXXX:0c 2a02:2f08:eb0a:1000:f543:4dc4:aXXXXXX
MASTERQUADII 78:XXXXXXX:74 2a02:2f08:eb0a:1000:7820:2de8:2aXXXXXX, 2a02:2f08:eb0a:1000:40bf:cd7b:7XXXXXX

MASTERQUADII is my wired PC, and Raspberry is not seen on this list.
My Asus is RT-AX88U

[fulgeru]

and this is how it is set

[yubiuser]

Remove the last digits of the IPv6 from the logs shown above! I'm able to ping your LAN devices.

@fulgeru

I want it fast and that is why I would keep my IPv6 on

IPv6 is not faster than Ipv4!

In this screenshot above I don't see an option to disable IPv6 for LAN only.
I would highly recommend you to disable IPv6 at the moment, get more knowledge about IPv6 and then decide if you really need it (and not just want).

---

As you see in the logs

DNS Servers: 2a02:2f0c:8000:3::1 2a02:2f0c:8000:8::1

Your clients use this DNS server via IPv6 and probably bypassing pihole.

[DanSchaper]

First thing is either disable IPv6 at the router or call your ISP and ask for a new /56 prefix as you've just broadcast to the world what yours is and posted the MACs and addresses of some of your devices. Editing the post was good but this site is crawled and indexed so there's a good chance your information is already in a few search engines.

Next, IPv6 is not any faster than IPv4, and as demonstrated, it's a lot less secure by default. There is zero need for GUA space on a LAN, if you need IPv6 the you can use a ULA prefix, if you don't know the difference between ULA and GUA then you don't need IPv6.