IPv6 privacy extension failure check and restart network

This script checks that the IPv6 privacy extension are working properly and if there is a problem with getting a new IPv6 address this script restarts the network. I saw once in a while that the IPv6 privacy extension failed to get a new IPv6 address from the router and stopped working. Use this script in a schedule to check for working IPv6 privacy extension.

Update: 2024-12-24. New and improved script to check and restart IPv6 privacy address generation

Save the new file as /etc/cron.hourly/IPv6-privacy-check and chmod 0755 for permission. Change the name of interface ens18 to the name of your server's interface.

/etc/cron.hourly/IPv6-privacy-check

#!/bin/bash

IPv6privacycheck=$(/sbin/ip -6 addr | grep inet6 | grep -v "::1" | grep -v "inet6 fe80" | grep -v "inet6 fd" | grep "scope global temporary dynamic")

if [ -z "$IPv6privacycheck" ]
then

for i in $(/sbin/ip -6 addr | grep 'temporary' | sed -e 's/^.*inet6 \([^ ]*\)\/.*$/\1/;t;d');
do
	ip -6 addr del ${i}/64 dev ens18
done

logger -p warning "IPv6 privacy extension failed, restarting"
sysctl -w net.ipv6.conf.ens18.use_tempaddr=0
sleep 15
sysctl -w net.ipv6.conf.ens18.use_tempaddr=2
fi

exit 0

Old method that I do not use anymore

Bash script using IPv6 grep

IPv6-privacy-check

#!/bin/bash

IPv6privacycheck=$(/sbin/ip -6 addr | grep inet6 | grep -v "::1" | grep -v "inet6 fe80" | grep -v "inet6 fd" | grep "scope global temporary dynamic")

if [ -z "$IPv6privacycheck" ]
then
systemctl restart networking
sleep 60
logger " IPv6 privacy extension failed, restarting network"
fi

exit 0

Bash script using IPv6 route command with token. If the IPv6 privacy extension stops working Linux start using the token for outgoing connection, this script checks if a token is being used for outbound connection and if it is then it restarts the network interface.

IPv6-privacy-check-route

#!/bin/bash

SUFFIX="::71c6:b34f:8e2a:54f5"

__rfc5952_expand () {
    read addr mask < <(IFS=/; echo $1)
    quads=$(grep -oE "[a-fA-F0-9]{1,4}" <<< ${addr/\/*} | wc -l)
    grep -qs ":$" <<< $addr && { addr="${addr}0000"; (( quads++ )); }
    grep -qs "^:" <<< $addr && { addr="0000${addr}"; (( quads++ )); }
    [ $quads -lt 8 ] && addr=${addr/::/:$(for (( i=1; i<=$(( 8 - quads )) ; i++ )); do printf "0000:"; done)}
    addr=$(for quad in $(IFS=:; echo ${addr}); do printf "${delim}%04x" "0x${quad}"; delim=":"; done)
    [ ! -z $mask ] && echo $addr/$mask || echo $addr
}

SUFFIX="$(__rfc5952_expand $SUFFIX)"
SUFFIX=${SUFFIX: -19}

OutboundIPv6=$(ip route get 2000:: | awk '{print $11}')
#OutboundIPv6=$(ip route get 2000:: | grep -Po -- 'src \K\S*')
OutboundIPv6="$(__rfc5952_expand $OutboundIPv6)"
OutboundIPv6=${OutboundIPv6: -19}

if [ $OutboundIPv6 == $SUFFIX ]; then
systemctl restart networking
sleep 60
logger " IPv6 token detected in outbound connection"
fi

exit 0

Let me know if you have any comments or if there is any error in this guide.

## Disclaimer

The software provided in this repository is for educational and informational purposes only. Under no circumstances shall the author or contributors be liable for any direct, indirect, incidental, special, exemplary, or consequential damages arising out of the use or inability to use this software. The author will not be liable for any special, incidental, consequential or indirect damages due to loss of data or any other reason.