From 8a8ee283aa7a4b409a9dafc082a6c65b5539308b Mon Sep 17 00:00:00 2001 From: Gert Doering Date: Fri, 25 Dec 2020 17:42:14 +0100 Subject: [PATCH] Clarify --block-ipv6 intent and direction. --block-ipv6 is a fairly special-purpose option, and only blocks packet in the client->server direction. This is implied by not ever mentioning the other direction in the existing documentation, but not written down. Make this explicit, avoid confusion. Also, point why this option exist (avoid IPv6 leakage from dual-stacked clients around IPv4-only VPN offerings). Trac: #1351 Signed-off-by: Gert Doering Acked-by: Richard Bonhomme Message-Id: <20201225164214.22771-1-gert@greenie.muc.de> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg21407.html Signed-off-by: Gert Doering --- doc/man-sections/vpn-network-options.rst | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/doc/man-sections/vpn-network-options.rst b/doc/man-sections/vpn-network-options.rst index 266827894..029834aa4 100644 --- a/doc/man-sections/vpn-network-options.rst +++ b/doc/man-sections/vpn-network-options.rst @@ -21,7 +21,8 @@ routing. For this option to make sense you actually have to route traffic to the tun interface. The following example config block would send all IPv6 traffic to OpenVPN and answer all requests with no route to host, - effectively blocking IPv6. + effectively blocking IPv6 (to avoid IPv6 connections from dual-stacked + clients leaking around IPv4-only VPN services). **Client config** :: @@ -38,6 +39,12 @@ routing. --push "redirect-gateway ipv6" --block-ipv6 + Note: this option does not influence traffic sent from the server + towards the client (neither on the server nor on the client side). + This is not seen as necessary, as such traffic can be most easily + avoided by not configuring IPv6 on the server tun, or setting up a + server-side firewall rule. + --dev device TUN/TAP virtual network device which can be :code:`tunX`, :code:`tapX`, :code:`null` or an arbitrary name string (:code:`X` can be omitted for -- 2.47.2