Review IPv6 disabled policy and implement proper firewall rules

[lawrab]

Current Configuration

# configuration.nix:27
networking.enableIPv6 = false;

Comment states: "Disable IPv6 to prevent VPN leaks"

Problem

Disabling IPv6 entirely can cause issues with:

• Modern applications that expect IPv6 support
• Some network services and containers
• Future compatibility as more services move to IPv6-only

Recommended Alternative

Instead of disabling IPv6, use proper firewall rules to prevent leaks:

networking.enableIPv6 = true;

# Prevent IPv6 leaks when VPN is not active
networking.firewall.extraCommands = ''
  # Drop all IPv6 output by default
  ${pkgs.iptables}/bin/ip6tables -P OUTPUT DROP
  
  # Allow IPv6 through VPN tunnel
  ${pkgs.iptables}/bin/ip6tables -A OUTPUT -o tun+ -j ACCEPT
  
  # Allow loopback
  ${pkgs.iptables}/bin/ip6tables -A OUTPUT -o lo -j ACCEPT
  
  # Optionally allow local network
  # ${pkgs.iptables}/bin/ip6tables -A OUTPUT -d fe80::/10 -j ACCEPT
'';

Alternative Solution

If VPN leak prevention is not the primary concern, consider enabling IPv6 with standard firewall rules.

Files to Update

• configuration.nix (networking section)

Testing

After changes, test:

1. IPv6 connectivity: curl -6 ifconfig.co
2. VPN leak test: curl -6 ifconfig.co with VPN disconnected (should fail/timeout)
3. VPN leak test: curl -6 ifconfig.co with VPN connected (should show VPN IP)

Priority

Medium - Current setup works but may cause future compatibility issues

Decision Needed

Do you need strict IPv6 leak prevention, or can IPv6 be enabled with standard firewall rules?