Disable ipv6 completely and remove related code

Co-Authored-By: Claude.ai

1 files changed, 0 insertions, 65 deletions

diff --git a/roles/gateway/README.md b/roles/gateway/README.md
index 5340cc25..eda1b087 100644
--- a/roles/gateway/README.md
+++ b/roles/gateway/README.md
@@ -17,29 +17,6 @@ gateway_local_ipv4_subnet: "192.168.1.0/24"
 gateway_router_interface: "end0"
 ```
 
-### IPv6 Support (Optional)
-
-IPv6 gateway is enabled by setting `gateway_local_ipv6_subnet` to the ULA prefix advertised by radvd:
-
-```yaml
-gateway_local_ipv6_subnet: "fd00:xxxx:xxxx:xxxx::/64"  # ULA prefix (stable, router-independent)
-```
-
-When set, this role:
-- Enables `net.ipv6.conf.all.forwarding=1` and `accept_ra=2` on `gateway_router_interface`
-- Deploys radvd advertising the ULA prefix with `AdvDefaultPreference high` — Pi wins as IPv6 default router
-- Adds ip6tables MASQUERADE/FORWARD rules so all client IPv6 traffic is forwarded through Pi
-- Drops outbound ICMPv6 Redirect messages — prevents Pi from redirecting clients to bypass the gateway
-
-**ICMPv6 Redirect suppression is critical.** Pi, the ISP router (FritzBox), and LAN clients share the same L2
-segment. When Pi forwards a packet to an external destination and the kernel determines the ISP router is a
-"better" next-hop on the same link, it sends an ICMPv6 Redirect to the client. The client then sends
-subsequent connections directly to the ISP router — bypassing Pi's masquerade and content filtering entirely.
-The first connection attempt fails (Pi forwarded nothing, just redirected), giving the symptom of "first
-request fails every ~30-60s." Dropping Redirect messages in ip6tables OUTPUT fixes this.
-
-To disable IPv6, leave `gateway_local_ipv6_subnet: ""` (default). The role skips all ip6tables rules and disables radvd.
-
 ## Network Architecture
 
 ```txt
@@ -65,40 +42,10 @@ Client Devices (192.168.1.0/24)
 
 - All traffic NAT'd through `wg+` interfaces
 - Pi and client traffic both use VPN exit IP
-- Most VPN providers handle IPv4/IPv6 protocol routing automatically
 
 **Direct Mode Characteristics:**
 
 - IPv4 traffic NAT'd through router interface (`end0`)
-- IPv6 traffic masqueraded through router interface — clients appear as Pi's GUA to the ISP router,
-  preventing ISP-router-level content filtering from applying per-device rules
-- ICMPv6 Redirects suppressed so clients always route through Pi
-
-## IPv6 Architecture Notes
-
-### Why masquerade IPv6 in direct mode?
-
-Clients have globally routable GUA addresses (assigned by ISP router SLAAC). Without masquerade, the ISP
-router sees each client's real GUA and can apply per-device content filtering. With masquerade, all client
-traffic appears to originate from Pi's GUA — bypassing per-device filtering consistently.
-
-### Why suppress ICMPv6 Redirects?
-
-When Pi, the ISP router, and clients share the same L2 segment (single broadcast domain), the Linux kernel
-sends ICMPv6 Redirect messages when it detects a "better" next-hop for a destination on the same link. For
-external GUA destinations reachable via the ISP router directly, Linux redirects clients from Pi to the ISP
-router. This causes:
-1. First SYN from client arrives at Pi — Pi sends Redirect, does NOT forward the packet
-2. Client receives Redirect, caches ISP router as next-hop for that destination
-3. Subsequent connections go directly to ISP router — masquerade and filtering bypassed
-
-Dropping `icmpv6-type redirect` in ip6tables OUTPUT prevents this entirely.
-
-### Why radvd with `AdvDefaultPreference high`?
-
-The ISP router (FritzBox) also sends RAs with default preference `medium` (or `low` if configured).
-Pi's radvd sends `AdvDefaultPreference high`, so clients prefer Pi as their IPv6 default router.
-Without this, clients split or prefer the ISP router depending on RA timing.
 
 ## Requirements
 
@@ -135,18 +82,6 @@ journalctl -u gateway-direct-mode.service -f
 sudo iptables -L -n -v
 sudo iptables -t nat -L -n -v
 
-# Verify ip6tables rules (redirect DROP must be first in OUTPUT)
-sudo ip6tables -L OUTPUT -n -v --line-numbers
-sudo ip6tables -t nat -L -n -v
-
-# Confirm no ICMPv6 Redirects being sent
-sudo tcpdump -i end0 -n 'icmp6 and ip6[40] == 137'
-
-# Verify clients route through Pi (not ISP router)
-# On client: ip -6 route show default
-# On Pi: sudo tcpdump -i end0 -n -e ip6 and host <client-GUA>
-
 # Test traffic routing
 curl -4 ifconfig.co  # Should show VPN IP when VPN active
-curl -6 ifconfig.co  # Should show Pi's GUA in direct mode, VPN IPv6 in VPN mode
 ```