Enable IPv6 by default in sys-whonix

[ArrayBolt3]

How to file a helpful issue

The problem you're addressing (if any)

Whonix 18 is intended to have full support for IPv6, including the ability to connect to the Tor network via IPv6 in the event IPv4 is unavailable. However, Qubes OS does not enable IPv6 connectivity in qubes by default, so users will probably have to manually enable it if IPv4 doesn't work for them.

Related:

• [R4.2] sys-whonix setup-ip fails if "qvm-feature ipv6" is set to 1 #8169
• Add support for IPv6 Virtual DNS (#462) qubes-core-agent-linux#592

The solution you'd like

Enable IPv6 by default for Whonix-Gateway qubes, by setting the ipv6 feature on those qubes to 1.

Note that while Whonix-Workstation should be able to talk to Whonix-Gateway via IPv6, this is not considered an essential feature, so enabling IPv6 by default on Whonix-Workstation is probably not necessary.

Despite the fact that Qubes OS doesn't have support for IPv6 virtual DNS (yet), this should still allow Whonix to operate on IPv6-only networks, since Whonix-Gateway by default doesn't have (or need) system-wide DNS, and Tor provides DNS to Whonix-Workstation without relying on Qubes OS's virtual DNS support.

The value to a user and who that user might be

Users who find themselves on an IPv6-only network will have connectivity working out of the box in Whonix qubes.

Completion criteria checklist

(This section is for developer use only. Please do not modify it.)

[marmarek]

This doesn't work this way. For sys-whonix to be able to reach internet via IPv6, the ipv6 feature needs to be enabled on the netvm (likely sys-net) to which it is (indirectly) connected. Enabling it only on sys-whonix means sys-whonix can provide IPv6 access to its downstream qubes (like anon-whonix), not that it can talk IPv6 to the upstream qubes. See https://doc.qubes-os.org/en/latest/developer/system/networking.html#ipv6

So, for sys-whonix to access the internet via IPv6, you'd need to enable it on sys-net, and if you'd like only sys-whonix to have IPv6, then you need to explicitly disable it on all other qube connected to sys-net (or sys-firewall).

Enabling ipv6 feature on sys-net by default is blocked by the DNS support (the PR you linked). But also, while I may be okay with granting feature-freeze exception for this PR (if it actually gets completed), it's only because IPv6 is disabled by default. Enabling IPv6 by default is too risky at this point of release. At this point, we can make this setting more discoverable (add to qube settings? or to global config?).

[ArrayBolt3]

Ah, fair enough, I forgot that all upstream VMs needed to have iPv6 enabled for this to work...

Agreed that we're too close to release to try to enable IPv6 everywhere. And I guess once IPv6 is enabled everywhere, this won't be needed at all...

[ArrayBolt3]

Enabling ipv6 feature on sys-net by default is blocked by the DNS support (the PR you linked).

For what it's worth, I have this on my task list. Since it's too late to get it enabled by default in R4.3, I'll probably have to wait until after Whonix 18 is released to work on that since that's time-critical, but I should end up getting to it at some point hopefully before the next major release of Qubes.