02-20-2025, 02:47 PM
Updated my mobian trixie installation to block IPv6 when wifi wlan0 is up with some exceptions. In order to receive, send or download MMS messages mobile data is needed. My carrier is an MVNO on the USA T-Mobile network. I found that enabling IPv6 to the T-Mobile defined ISP IPv6 internet space solved the problem. This enables DNS and interactions with the T-Mobile services that support MMS.
My setup adds firewall rules allowing IPv6 OUTPUT to T-Mobil(2607:7700::/32) and blocks all other IPv6 on wwu1i4. If wifi is not up then the rule is removed to enable data via IPv6 over mobile data.
Bash script added to:
Hoping this will prevent mobile IPv6 usage when the phone is connected via wifi that is IPv4 only. Application IPv6 connections should fail falling back to IPv4 while MMS messages should continue to work.
If T-Mobile starts hosting debian repo on there IPv6 space then then I'll have a problem. Or will have to be more specific with the allowed IPv6 ranges.
My setup adds firewall rules allowing IPv6 OUTPUT to T-Mobil(2607:7700::/32) and blocks all other IPv6 on wwu1i4. If wifi is not up then the rule is removed to enable data via IPv6 over mobile data.
Bash script added to:
Quote:/etc/NetworkManager/dispatcher.d/99-manage-ipv6-rules.sh
Code:
#!/bin/bash
INTERFACE="$1"
STATUS="$2"
if [ "$INTERFACE" == "wlan0" ]; then
if [ "$STATUS" == "up" ]; then
# wlan0 is up, apply the ip6tables rules
if ! ip6tables -C OUTPUT -o wwu1i4 -j DROP 2>/dev/null; then
# Rule not present, add the rule
ip6tables -A OUTPUT -p udp --dport 53 -j ACCEPT
ip6tables -A OUTPUT -p tcp --dport 53 -j ACCEPT
ip6tables -A OUTPUT -d 2607:7700::/32 -j ACCEPT
ip6tables -A OUTPUT -o wwu1i4 -j DROP
fi
else
if [ "$STATUS" == "down" ]; then
# wlan0 is down, remove the ip6tables rules
if ip6tables -C OUTPUT -o wwu1i4 -j DROP 2>/dev/null; then
# Rule present, remove the rule
ip6tables -D OUTPUT -o wwu1i4 -j DROP
ip6tables -D OUTPUT -d 2607:7700::/32 -j ACCEPT
ip6tables -D OUTPUT -p tcp --dport 53 -j ACCEPT
ip6tables -D OUTPUT -p udp --dport 53 -j ACCEPT
fi
fi
fi
fi
Hoping this will prevent mobile IPv6 usage when the phone is connected via wifi that is IPv4 only. Application IPv6 connections should fail falling back to IPv4 while MMS messages should continue to work.
If T-Mobile starts hosting debian repo on there IPv6 space then then I'll have a problem. Or will have to be more specific with the allowed IPv6 ranges.