<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
</head>
<body><p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;">Hi Erez, </p>
<p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;"><br />You should be able to disable DHCP on the router, and pass all logic to a secondary DHCP server. </p>
<p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;"><br />You can prepend your DNS server as first among DNS servers on each client (also make sure that your DNS server can answer for AAAA), you can add one line in <span style="font-family:monospace;"><span style="background-color:#ffffff;"><span style="color:#000000;">/etc/dhcp/dhclient.conf (for dhcp clients)</span></span><br /><br />You should not trust NAT as a security mechanism, specifically when you have a foreign device inside your network . </p>
<br /><p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;">You should be able on your router to pass only ULA and not the public prefix you get.</span></p>
<br /><p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;">It is EXTREMELY important to separate your ISP router and your own one, it is better to run your own pfsense / openwrt with full control than to trust a third party device. </p>
<p> <p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;">You can disable ipv6 on client level via /etc/sysctl.d/XX_disable_ipv6.conf (just add one line <span style="font-family:Hack;">net.ipv6.conf.all.disable_ipv6 = 1 it will disable ipv6 on all interfaces )- this is a VERY bad approach, but it is what you are asking for.</span></p>
<p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;"><br />You should enable per client router, do you really trust provider router not to attack your pc ? <br /><br />On Sunday, 7 November 2021 10:27:03 IST Erez D wrote:</p>
<p style="margin-top:12;margin-bottom:0;margin-left:40;margin-right:40;">Hello</p>
<p> <p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;">I've swapped isp (hot/hotnet) and now i have ipv6 support which i can't turn off.<br />I have a few issues with ipv6:</p>
<p> </p>
<p style="margin-top:0;margin-bottom:0;margin-left:40;margin-right:40;">1. no NAT so all my devices are accessible from outside</p>
<p> </p>
<p style="margin-top:0;margin-bottom:0;margin-left:40;margin-right:40;">2. can't redirect DNS traffic to my DNS server</p>
<p> <p> </p>
<p style="margin-top:0;margin-bottom:0;margin-left:40;margin-right:40;">I thought about adding a firewall, but this way i need a small fast-enough HW for this which is expensive, as well as disable HOT's router wifi so i actually need a wifi router ...</p>
<p> <p> </p>
<p style="margin-top:0;margin-bottom:0;margin-left:40;margin-right:40;">can't i just install a dhcpv6 server on an RPi, which will hijack the default route and DNS servers, and so actually disable ipv6 ?</p>
<p style="margin-top:0;margin-bottom:0;margin-left:40;margin-right:40;"><br /></p>
<p style="margin-top:0;margin-bottom:0;margin-left:40;margin-right:40;">Thanks,</p>
<p style="margin-top:0;margin-bottom:0;margin-left:40;margin-right:40;">Erez.</p>
<p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;"><br /></p>
</body>
</html>