Ignore IPv6 router announcements

Why it matters

On an IPv6 network, routers announce themselves with router advertisements, and your computer believes them. A malicious device on the same network can send its own and become your default gateway, placing itself between you and the internet. Ignoring the announcements closes that route.

How it works

Sets net.ipv6.conf.all.accept_ra and net.ipv6.conf.default.accept_ra to 0, so the kernel ignores router advertisements. Without them it cannot configure IPv6 addresses and routes automatically.

Who should use it

Only for networks where you set IPv6 by hand, or where you do not use IPv6. On normal home and office networks, which hand out addresses this way, leave it off.

What you may notice

IPv6 stops working: ip -6 addr shows only a link-local address, and sites that need IPv6 can be unreachable. IPv4 usually keeps working.

Check it on your computer

Read the current value:

sysctl net.ipv6.conf.all.accept_ra
sysctl net.ipv6.conf.default.accept_ra

Apply it by hand

Set it now (until the next restart):

sudo sysctl -w net.ipv6.conf.all.accept_ra=0
sudo sysctl -w net.ipv6.conf.default.accept_ra=0

Keep it after restarts, in a file you own:

sudo tee /etc/sysctl.d/90-net-ipv6-router-adverts.conf <<'EOF'
net.ipv6.conf.all.accept_ra = 0
net.ipv6.conf.default.accept_ra = 0
EOF
sudo sysctl --system

Undo it

Remove the file and restart, or set the old value back with sysctl -w.

Related settings

• Ignore and never send ICMP redirects

Sources

Linux Hardening Guide (madaidans)

2.2.2