From 09259eb6ccc59b7ff521846436d1520988891a96 Mon Sep 17 00:00:00 2001 From: Andreas Wrede Date: Mon, 13 Jul 2026 12:06:33 -0400 Subject: [PATCH] sysctl: force use_tempaddr=0 to beat Ubuntu's 55-ipv6-privacy.conf default Root cause of the flow-selective IPv6 heartbeat loss investigated 2026-07-12/13: Ubuntu ships /usr/lib/sysctl.d/55-ipv6-privacy.conf with use_tempaddr=2 system-wide. Nothing on wlan0 overrode it before this morning's netplan fix, so the interface carried a rotating privacy address alongside the stable one. hbc's long-lived flow eventually straddled a temp-address deprecation event mid-flight, which looked exactly like random upstream packet loss (in-transit, IPv6-only, flow-selective) and cost a day of packet captures before the cause turned out to be this default fighting the WAN config instead. The netplan/NM ipv6.ip6-privacy=false fix already forces this per connection, but that's a timing-dependent override racing a package default. This makes it explicit and permanent: 99- loads after (and wins over) 55- the next time sysctl --system runs. Co-Authored-By: Claude Sonnet 5 --- ap/99-van-router.conf | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/ap/99-van-router.conf b/ap/99-van-router.conf index 119d730..5737226 100644 --- a/ap/99-van-router.conf +++ b/ap/99-van-router.conf @@ -1 +1,12 @@ net.ipv4.ip_forward=1 + +# Ubuntu ships /usr/lib/sysctl.d/55-ipv6-privacy.conf with use_tempaddr=2 +# (prefer rotating privacy addresses) system-wide. That default fought the +# WAN uplinks' need for one stable IPv6 source address per interface (hbc, +# DNS, van-failover all key off it) — a long-lived flow using a source +# address that later got deprecated mid-flight looked like random upstream +# packet loss and cost a day of packet-capture debugging (2026-07-12/13) +# before the cause turned out to be this file loading before ours. 99- beats +# 55- lexically so this wins the second `sysctl --system` re-reads it. +net.ipv6.conf.all.use_tempaddr=0 +net.ipv6.conf.default.use_tempaddr=0