Skip to main content

IPv6 Source Address Selection on Linux

May 11, 2009 by davidc

Sometimes it is desirable to have the outgoing IPv6 address on an interface selected deterministically. All else being equal, Linux will default to using the latest address added to the interface as the source address. This is generally not what you would expect or want. This article describes how to influence the source address selection under Linux.

Selection algorithm

Linux implements RFC 3484, "Default Address Selection for Internet Protocol version 6 (IPv6). Briefly, the algorithm involves building a candidate list of potential source addresses, then following these rules in order:

  1. Prefer same address. (i.e. destination is local machine)
  2. Prefer appropriate scope. (i.e. smallest scope shared with the destination)
  3. Avoid deprecated addresses.
  4. Prefer home addresses.
  5. Prefer outgoing interface. (i.e. prefer an address on the interface we're sending out of)
  6. Prefer matching label.
  7. Prefer public addresses.
  8. Use longest matching prefix.

"If the eight rules fail to choose a single address, some unspecified tie-breaker should be used." Linux chooses to use the latest address added.

Influencing the algorithm

It is necessary therefore to break any tie by influencing one of these rules. The solution is to mark unwanted source addresses as "deprecated", causing them to fail rule 3.

The method to implement this under Linux is to set preferred_lft to 0, thus causing the address to be marked as deprecated. Note that deprecation doesn't make the address invalid, so you can still receive packets destined for that address, but it just won't be used as source adddres.

Changing an existing address

For an address already added to the interface, use ip addr change. See the example below.

root@netman1:~# ip -6 addr show dev eth0
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qlen 1000
    inet6 2a01:550:8000::11/128 scope global
       valid_lft forever preferred_lft forever
    inet6 2a01:550:8000:10a::1/64 scope global
       valid_lft forever preferred_lft forever
    inet6 fe80::221:5aff:fe45:9956/64 scope link
       valid_lft forever preferred_lft forever
root@netman1:~# lynx -dump 'http://www.ipv6.org/' | grep "You are using"
                  You are using IPv6 from 2a01:550:8000::11
root@netman1:~# ip -6 addr change 2a01:550:8000::11/128 dev eth0 preferred_lft 0
root@netman1:~# ip -6 addr show dev eth0
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qlen 1000
    inet6 2a01:550:8000::11/128 scope global deprecated
       valid_lft forever preferred_lft forever
    inet6 2a01:550:8000:10a::1/64 scope global
       valid_lft forever preferred_lft forever
    inet6 fe80::221:5aff:fe45:9956/64 scope link
       valid_lft forever preferred_lft forever
root@netman1:~# lynx -dump 'http://www.ipv6.org/' | grep "You are using"
                You are using IPv6 from 2a01:550:8000:10a::1
root@netman1:~#

Adding a new address

Simply set preferred_lft when adding your address, e.g.:

ip addr add 2a01:550:8000::11 dev eth0 preferred_lft 0

Example use in Debian interfaces file:

iface eth0 inet6 static
        address 2a01:550:8000:10a::1
        netmask 64
        gateway 2a01:550:8000:10a::ff
        up ip addr add 2a01:550:8000::11 dev eth0 preferred_lft 0

Example in Gentoo configuration file:

 config_eth0=(
       "10.1.1.1/24" "2001:0db8::1/64"
       "10.1.1.2/24" "2001:0db8::2/64 preferred 0"
 )

Credit

This page is based on a mailing list post by Chris Caputo to ipv6-ops: