From Newsgroup: alt.comp.os.windows-11

Brian Gregory wrote:

No global IPv6 on the client means no IPv6 leak.
A bridge guarantees exactly that.

What's philosophically brilliant is that even with a fully intact IPv6
stack, and even with a modern router acting as a wireless bridge, the same >> privacy advantage still holds.

A Wi-Fi bridge???
This isn't one of that idiot Rob Braxman's brain farts is it?

If you don't have a global IPv6 YOU ARE NOT USING IPv6 TO ACCESS THE INTERNET. You have disabled IPv6.
THERE IS NO BRIDGE - whatever you think that is!?

You are right. I am wrong. Sorry I didn't realize it sooner.
Thank you for correcting my mistakes. I appreciate it.

I only want to help others, and to learn what to do (and what not to do).

I never disagree with anyone stating a logically defensible viewpoint, and
I won't disagree with Brian Gregory in his statement because he's right
that a bridge actually does not confer IPv6 protection on a computer.

I was wrong about that.
I set up the bridge repeater to get Wi-Fi back (via Ethernet between
the PC and the spare router) so that I could get back onto the Internet.

The bridge is simply my workaround to having destroyed network Wi-Fi.

I found out, belatedly, that what actually killed my Wi-Fi network
permanently was the *combination* of 0xFF and pnputil /force such that the only way to recover is to rebuild Windows (which I haven't done yet).

Looking back at my copypasta ad hoc logs, this is what killed me such
that I will never be able to use Wi-Fi or VPN again without rebuilding.
a. Because I have no network icon in the taskbar notification area, and,
b. ms-settings:network Network & Internet crashes within seconds every time.

So that others don't repeat my disaster, this is what *not* to do.

1. Wipe out IPv6 (I should have used either 0x20 or 0x01 but not FF).
reg add HKLM\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters /v DisabledComponents /t REG_DWORD /d 0xFF /f
2. Enumerate the Wi-Fi device
pnputil /enum-drivers
Qualcomm Atheros 802.11 a|b|g|n Dualband Wireless Network Module
Driver Name: netathrx.inf
Instance ID:
PCI\VEN_168C&DEV_002A&SUBSYS_1000168C&REV_01\4&1a388ce3&0&0038
3. Remove the Wi-Fi device (this, I never should have done!)
pnputil /remove-device "PCI\VEN_168C&DEV_002A&SUBSYS_1000168C&REV_01\4&1a388ce3&0&0038"
4. Uninstall the driver package (the force is what did all the damage!)
pnputil /delete-driver netathrx.inf /uninstall /force
5. IPv6 stack destruction (I should have used hex 20 or 01 instead!)
reg add HKLM\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters /v DisabledComponents /d 0xFF
6. Resetting both IPv4 and IPv6 stacks
netsh int ip reset
netsh int ipv6 reset
7. Rebooting with missing routing & missing Wi-Fi driver metadata
That combination forced Windows to purge dependent networking components,
including:
a. NetworkUX
b. OOBENetwork packages
c. NetworkConnectionFlow
d. immersivecontrolpanel dependencies
e. ShellExperienceHost networking hooks
f. Edge legacy system package
g. CBS servicing metadata
h. RPC endpoint mapper entries
Because a dir of dir C:\Windows\SystemApps\Microsoft.Wind*
now shows multiple SystemApps folders vanished, not just NetworkUX.

Luckily, Ethernet still works, so a router connected to the PC RJ45
allows bridging to the SOHO router access point, so I'm on the net.

But ms-settings:network crashes within seconds every time it's run.
The fatal combined steps are documented so that others learn from my mistake. --
Sometimes you learn what not to do only after having already done it.
--- Synchronet 3.22a-Linux NewsLink 1.2

From Newsgroup: alt.comp.os.windows-11

Maria Sophia wrote:

I never disagree with anyone stating a logically defensible viewpoint, and
I won't disagree with Brian Gregory in his statement because he's right
that a bridge actually does not confer IPv6 protection on a computer.

I was wrong about that.
I set up the bridge repeater to get Wi-Fi back (via Ethernet between
the PC and the spare router) so that I could get back onto the Internet.

While I was wrong, I'm on the path to enlightenment, in terms of IPv6...

To reaffirm that Brian Gregory is right, I looked it up and found out that
it was a false negative that I *thought* the wireless bridge conferred protection from IPv6 leaks. As Brian stated emphatically, it does not!

I accidentally inferred that it did because my IPv6 does not exist.
But, it turns out, my IPv6 likely has never existed on my current router).

Below are some IPv6 leak tests I think everyone should run at least once.

We're all working together as I'll wager many of us on these ngs were as unaware as I was that IPv6 is, by design, a privacy hole par excellence.

Reaffirming that this whole IPv6 privacy thing is new to me and that it
floored me when I found out how different it is from IPv4, to test if the Windows or Linux or Android methods are working, these commands may help.

1. Test external visibility
start firefox https://test-ipv6.com (Windows)
firefox https://test-ipv6.com (Linux)
xdg-open https://test-ipv6.com (Android Termux)
2. Check external reachability
ping -6 google.com
3. Identify the local interface configuration
a. ipconfig (Windows)
b. ifconfig / ip a (Linux)
c. Termux > pkg install iproute2 > ip a (Android)
d. Termux > pkg install net-tools > ifconfig (Android
4. Test DNS resolution
nslookup -type=AAAA google.com (Windows)
dig AAAA google.com (Linux, Android Termux)
5. Test IPv6 routing table
route print -6 (Windows)
ip -6 route (Linux/Android Termux)
6. Test IPv6 WebRTC leaks
firefox https://browserleaks.com/webrtc
firefox https://ipleak.net
7. Test IPv6 prefix delegation
dhclient -6 -v (Linux/Android Termux)
8. Test for VPN leaks
firefox https://ipleak.net
firefox https://browserleaks.com/ip
9. Router setup
Netgear > Advanced > Advanced Setup > IPv6 > Internet Connection Type
Disabled (IPv6 is completely off)
Auto Detect (Router tries to detect IPv6 from your ISP)
6to4 Tunnel (Legacy IPv6-over-IPv4 tunneling)
Pass Through (Router passes IPv6 directly to LAN devices)
Fixed (Manual IPv6 configuration)
DHCP (Used when the ISP hands out IPv6 via DHCPv6)
PPPoE (Used by DSL providers)
Auto Config (Router uses SLAAC (stateless autoconfiguration)
6rd Tunnel (An IPv6-over-IPv4 method used by some ISPs)
Dual-Stack Lite (Used by ISPs that provide IPv6 but tunnel IPv4.\)
v6plus (Japan-specific IPv6 service)

For example
a. No IPv6 addresses were detected by https://test-ipv6.com
b. ping -6 google.com fails
c. My Windows host only has link-local IPv6 (fe80::...)
d. I have no global IPv6 (2000::/3)
e. I have no IPv6 default gateway
f. I have no IPv6 DNS
g. All IPv6-only sites timed out

Specifically for https://test-ipv6.com my IPv6 Firefox score was 0/10
Test with IPv4 DNS record = ok (2.421s) using ipv4
Test with IPv6 DNS record = timeout (5.611s)
Test with Dual Stack DNS record = ok (2.821s) using ipv4
Test for Dual Stack DNS and large packet = ok (1.230s) using ipv4
Test IPv6 large packet = bad (3.898s)
Test if your ISP's DNS server uses IPv6 = ok (1.293) using ipv4
Find IPv4 Service Provider = ok (2.300s) using ipv4
Find IPv6 Service Provider = bad (3.815s)

So, it turns out, I never had an IPv6 leak in the first place.
Because, if IPv6 doesn't exist past the router, it can't leak.

May I ask others out there what your IPv6 results were with Firefox?
--
What we can learn from everyone is more than we can learn ourselves.
--- Synchronet 3.22a-Linux NewsLink 1.2

From Newsgroup: alt.comp.os.windows-11

Note that there is a directive for configs that blocks IPv6 altogether.
block-ipv6 ; block IPv6 traffic to prevent IPv6 leaks
We have to worry about DNS leaks, but there are directives for that too.
block-outside-dns ; force DNS queries to stay inside the VPN TAP interface Unfortunately, specifically stating the DNS server in the tunnel failed.
; dhcp-option DNS 1.1.1.1 ; set primary DNS to Cloudflare inside the tunnel
; dhcp-option DNS 9.9.9.9 ; set secondary DNS to Quad9 for secure fallback The volunteer VPN servers I use don't seem to accept those DNS directives.

But those directives should work on more professional OpenVPN servers.
I only use the thousands of free openvpn servers from around the world.

These are the commands I add to every one of hundreds of free config files. Notice the DNS-related commands are brand new, to keep DNS inside the tunnel.

auth-nocache ; prevent caching of auth credentials in memory
auth-retry nointeract ; retry silently using stored username/password
auth-user-pass C:\\data\\vpn\\userpass.txt ; login file path
block-ipv6 ; block IPv6 traffic to prevent IPv6 leaks
block-outside-dns ; force DNS queries to stay inside the VPN TAP interface
; NB block-outside-dns breaks OS DNS if the VPN's DNS server is dead
; dhcp-option DNS 1.1.1.1 ; set primary DNS to Cloudflare inside the tunnel
; dhcp-option DNS 9.9.9.9 ; set secondary DNS to Quad9 for secure fallback
connect-retry-max 20 ; increase max reconnect attempts (default=8)
connect-retry 5 ; shorten delay between reconnect attempts
connect-timeout 30 ; time before initial connect attempt times out
data-ciphers AES-256-GCM:AES-128-GCM:AES-128-CBC ; required by vpngate.net
explicit-exit-notify 2 ; send disconnect notice to UDP servers
float ; accept server IP changes during session
hand-window 180 ; extend TLS handshake window (default=60)
inactive 3600 ; allow long idle periods before timeout (default=off)
ip-win32 adaptive ; choose best Windows IP/DNS routing method
keepalive 10 60 ; ping every 10s, restart after 60s silence
mssfix 1400 ; adjust TCP MSS to reduce fragmentation
tun-mtu 1400 ; set tunnel MTU to avoid packet fragmentation
; pull-filter ignore "redirect-gateway" ; prevent server from setting gateway
pull-filter accept "redirect-gateway" ; accept the vpn server routing changes
pull ; accept configuration pushed by the VPN server
replay-window 128 ; enlarge replay protection packet window
route-delay 10 ; delay route setup to avoid race conditions
server-poll-timeout 120 ; wait longer for server PUSH reply (default=2)
tls-timeout 180 ; extend TLS negotiation timeout (default=60)
verb 4 ; moderate verbosity, show key events without packet spam

During testing, on Windows, I made use of the old curlit shortcut:
Win+R > curlit
Which calls curlit.exe which is defined only in the Windows Registry
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\curlit.exe
Default=C:\path-to\curlit.lnk
Where the TARGET of that curlit.lnk shortcut does the IP check.
Target=%comspec% /k echo "C:\data\sys\pgm\lnk\curlit.lnk $MYIP" & %Windir%\System32\curl.exe icanhazip.com
NB: There is no command called "curlit.exe"; that's a unique reg keyword.

I tried to make it fancier with curlvpn but that errored out on Windows:
TARGET=%comspec% /k echo "curlvpn: forcing curl through VPN TAP adapter" & %Windir%\System32\curl.exe --interface Ethernet --dns-servers 1.1.1.1,9.9.9.9 icanhazip.com
I'm sure that curl syntax would work if curl were compiled differently.
"curlvpn: forcing curl through VPN TAP adapter"
curl: option --dns-servers: the installed libcurl version does not support this
curl: try 'curl --help' for more information

But I like my commands to work universally so I changed it to
Win+R > curldns
Which calls curldns.exe which is defined only in the Windows Registry
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\curldns.exe
Default=C:\path-to\curldns.lnk
Where the TARGET of that curldns.lnk shortcut does the IP check.
%comspec% /k echo "C:\data\sys\pgm\lnk\curldns.lnk $MYIP" & echo curldns & nslookup icanhazip.com & powershell -Command "Resolve-DnsName icanhazip.com" & curl icanhazip.com
NB: There is no command called "curldns.exe"; that's just a reg keyword.

I post it here so that others, at least on Windows, can instantly replicate this shortcut efficiency to make sure their VPN DNS remains in the tunnel.
--
I strive to add technical value, if possible, with every post to Usenet.
--- Synchronet 3.22a-Linux NewsLink 1.2

From Newsgroup: alt.comp.os.windows-11

Maria Sophia wrote:

These are the commands I add to every one of hundreds of free config files. Notice the DNS-related commands are brand new, to keep DNS inside the tunnel.

Here's a script that others can use that deletes the existing directives.

:: vpnclean.bat
:: Cleans OpenVPN config files of all directives located after </key>.
:: ---------------------------------------------------------------------
:: v1p0 20260725
:: ---------------------------------------------------------------------
@echo off
:: Point to the folder containing any number of openvpn config files
set "folder=C:\data\vpn\config"
:: Remove all directives after </key> in every openvpn config file found
for %%F in ("%folder%\*.ovpn") do (
powershell -NoLogo -NoProfile -Command ^
"$content = Get-Content '%%F';" ^
"$idx = ($content | Select-String '</key>').LineNumber;" ^
"if ($idx) { $new = $content[0..($idx-1)]; Set-Content -Path '%%F' -Value $new -Encoding UTF8; Write-Host 'Cleaned: %%~nxF' } else { Write-Host 'Skipped (no </key>): %%~nxF' }"
)
echo Done.
:: end of vpnclean.bat

And then another script that adds the new directives to the existing files.

:: vpnappend.bat
:: -----------------------------------------------------------------
:: v1p0 20260725
:: Appends OpenVPN config directies to any number of openvpn files.
:: -----------------------------------------------------------------
:: Point to the folder containing any number of openvpn config files
@echo off
set "folder=C:\data\vpn\config"
:: Point to the file containing the verbatim openvpn directives
set "block=C:\data\vpn\config\added_options.txt"
:: Append the file above to every openvpn config file in the folder above
for %%F in ("%folder%\*.ovpn") do (
powershell -NoLogo -NoProfile -Command ^
"Add-Content -Path '%%F' -Value \"`r`n# --- Standard Options ---`r`n\";" ^
"Add-Content -Path '%%F' -Value (Get-Content '%block%');" ^
"Write-Host 'Appended options to: %%~nxF'"
)
echo Done.
:: end of vpnappend.bat
--
It takes intelligence & effort to get what people pay for, for free.
--- Synchronet 3.22a-Linux NewsLink 1.2