Disabling IPv6 on Rocky Linux

Introduction

IPv6 is enabled by default and fully supported on all current Rocky Linux releases. It is very stable, and in most environments there is no reason to turn it off. There are unique and uncommon scenarios where disabling it is necessary, such as satisfying a security-scan finding or a compliance requirement, or working around an application that misbehaves with IPv6 present. This article covers how to disable it, starting with the least invasive method, and the caveats of a full system-wide disable. It applies to Rocky Linux 8, 9, and 10.

Problem

A requirement, often a security scanner, calls for IPv6 to be disabled. Turning it off per interface with a sysctl such as net.ipv6.conf.<interface>.disable_ipv6=1 disables IPv6 on those interfaces but leaves the IPv6 stack loaded and the ::1 loopback present. A scanner that checks whether the IPv6 stack is loaded at all will still flag the host, which is the usual reason a per-interface change "doesn't work."

Resolution

⚠️ WARNING Leave IPv6 enabled unless you have a specific, confirmed reason to disable it, and prefer the least invasive method that satisfies that reason. A full system-wide disable removes the ::1 loopback address; applications that bind to ::1, and some services that expect IPv6 to be available even when they do not use it, can fail, and you may see new SELinux denials. Test critical services before rolling a full disable out fleet-wide.

Option 1: Disable IPv6 on specific connections

If you only need IPv6 off on particular interfaces, disable it per connection with NetworkManager. This is the least invasive option and is persistent across reboots:

sudo nmcli connection modify <connection> ipv6.method disabled
sudo nmcli connection up <connection>

List connection names with nmcli connection show. This leaves the IPv6 stack loaded and ::1 in place, so it may not satisfy a scan that requires the stack to be fully disabled. If that is your situation, use Option 2.

Option 2: Disable IPv6 system-wide

To turn the IPv6 stack off entirely, add the ipv6.disable=1 kernel parameter to every installed kernel and reboot:

sudo grubby --update-kernel=ALL --args="ipv6.disable=1"
sudo reboot

grubby --update-kernel=ALL writes the argument into the boot entry of every installed kernel, and the ALL keyword also updates GRUB_CMDLINE_LINUX in /etc/default/grub so kernels installed later inherit it. This is the change that fully removes the IPv6 stack, including ::1, which is why it satisfies scanners that a per-interface change does not (see the Warning above for the trade-off).

Verify

After the reboot, confirm the parameter is active and no IPv6 addresses remain:

grep -o 'ipv6.disable=1' /proc/cmdline
ls /proc/net/if_inet6

The first command echoes ipv6.disable=1. When the IPv6 stack is disabled the kernel does not create /proc/net/if_inet6, so ls reports No such file or directory.

Revert

To re-enable IPv6, remove the parameter and reboot:

sudo grubby --update-kernel=ALL --remove-args="ipv6.disable=1"
sudo reboot

Notes

• The per-interface sysctl approach (net.ipv6.conf.all.disable_ipv6=1 and net.ipv6.conf.default.disable_ipv6=1) disables IPv6 addressing but leaves the stack loaded. Use it when you want IPv6 addresses gone but do not need the stack removed; use the kernel parameter when a scan or policy requires the stack itself to be off.
• This procedure was developed on AMD x86_64 hardware.
• Before a full disable, check that localhost-dependent services still work with only the IPv4 127.0.0.1 loopback. Some software is configured to reach localhost over ::1.

References & related articles

nm-settings(5) man page
grubby(8) man page