Disable IPv6

[Helmut72]

Hi,

I want to disable IPv6 on Debian 9:

helmut@3CX:~$ netstat -an | grep LISTEN | grep -E ':50..'
tcp        0      0 0.0.0.0:5060            0.0.0.0:*               LISTEN
tcp        0      0 0.0.0.0:5000            0.0.0.0:*               LISTEN
tcp        0      0 0.0.0.0:5001            0.0.0.0:*               LISTEN
tcp6       0      0 :::5090                 :::*                    LISTEN
tcp6       0      0 :::5060                 :::*                    LISTEN
tcp6       0      0 :::5000                 :::*                    LISTEN
tcp6       0      0 :::5001                 :::*                    LISTEN

And after reboot:

helmut@3CX:~$ netstat -an | grep LISTEN | grep -E ':50..'
tcp        0      0 0.0.0.0:5060            0.0.0.0:*               LISTEN
tcp        0      0 0.0.0.0:5000            0.0.0.0:*               LISTEN
tcp        0      0 0.0.0.0:5001            0.0.0.0:*               LISTEN
tcp6       0      0 :::5090                 :::*                    LISTEN
tcp6       0      0 :::5000                 :::*                    LISTEN
tcp6       0      0 :::5001                 :::*                    LISTEN
helmut@3CX:~$

When I now disable IPv6 on the OS and reboot the Management Console does not come up:

helmut@3CX:~$ netstat -an | grep LISTEN | grep -E ':50..'
tcp        0      0 0.0.0.0:5090            0.0.0.0:*               LISTEN
tcp        0      0 0.0.0.0:5060            0.0.0.0:*               LISTEN
helmut@3CX:~$

The reason is nginx:

Jun 04 14:36:49 3CX nginx[1509]: nginx: [emerg] socket() [::]:5001 failed (97: Address family not supported by protocol)
Jun 04 14:40:48 3CX nginx[1688]: nginx: [emerg] socket() [::]:5000 failed (97: Address family not supported by protocol)

as /var/lib/3cxpbx/Bin/nginx/conf/nginx.conf still contains:

listen [::]:5001 ssl http2;
listen [::]:5000;

Commenting those lines solves the issue:

helmut@3CX:~$ sudo /etc/init.d/nginx start
Starting nginx (via systemctl): nginx.service.
helmut@3CX:~$ sudo /etc/init.d/nginx status
_ nginx.service - A high performance web server and a reverse proxy server
   Loaded: loaded (/lib/systemd/system/nginx.service; enabled; vendor preset: enabled)
   Active: active (running) since Thu 2020-06-04 14:42:28 CEST; 36s ago
     Docs: man:nginx(8)
[...]

 

[Saqqara]

You have already been told not to mess around with Debian and disabling IPv6 thru the management console.

https://www.3cx.com/community/threads/too-many-incorrect-login-attempts.73795/#post-331501

 

[StefanW]

it works as intended, as the sip server will not use anymore 5060 on IPv6 which would maybe be used to connect to a VoipProvider. The other IPv6 service listed as inbound Ports (tunnel and web). You may close them from your NAT but even then I would leave them to give every client the best option to connect to your service.

 

[Helmut72]

You have already been told not to mess around with Debian and disabling IPv6 thru the management console.

https://www.3cx.com/community/threads/too-many-incorrect-login-attempts.73795/#post-331501

That does not disable IPv6 but only stops SIP from using IPv6. That's a huge difference. In my case I get a dynamic IPv6 from my ISP so I cannot restrict access to the web console properly. That's a security issue. And yes, I can do workarounds like firewalling, reverse proxying and so on but it remains an issue.

 

[Helmut72]

it works as intended, as the sip server will not use anymore 5060 on IPv6 which would maybe be used to connect to a VoipProvider. The other IPv6 service listed as inbound Ports (tunnel and web). You may close them from your NAT but even then I would leave them to give every client the best option to connect to your service.

Unfortunatley IPv6 does not do NATting so I can't. And with a dynamic IPv6 I do not have an option to restrict the webconsole from the internet which is the only thing that concerns me.

To illustrate:



Private IPv4, no problem, RFC1918 address. With a dynamic IPv6 (internally, at home!):



Issue, I cannot restrict web console access. so as soon as I activate "Allow Access from specific IP Address" I lock myself out. See my other topic.

 

[cobaltit]

Leave it alone and either put a firewall between the internet and 3CX or use a host based firewall like iptables or something. Or just leave it and trust 3CX to do it's job.

 

[Helmut72]

Leave it alone and either put a firewall between the internet and 3CX or use a host based firewall like iptables or something. Or just leave it and trust 3CX to do it's job.

Puppet does the job, np.