Disable ipv6 completely and remove related code

Co-Authored-By: Claude.ai

22 files changed, 10 insertions, 265 deletions

diff --git a/roles/gateway/README.md b/roles/gateway/README.md
index 5340cc25..eda1b087 100644
--- a/roles/gateway/README.md
+++ b/roles/gateway/README.md
@@ -17,29 +17,6 @@ gateway_local_ipv4_subnet: "192.168.1.0/24"
 gateway_router_interface: "end0"
 ```
 
-### IPv6 Support (Optional)
-
-IPv6 gateway is enabled by setting `gateway_local_ipv6_subnet` to the ULA prefix advertised by radvd:
-
-```yaml
-gateway_local_ipv6_subnet: "fd00:xxxx:xxxx:xxxx::/64"  # ULA prefix (stable, router-independent)
-```
-
-When set, this role:
-- Enables `net.ipv6.conf.all.forwarding=1` and `accept_ra=2` on `gateway_router_interface`
-- Deploys radvd advertising the ULA prefix with `AdvDefaultPreference high` — Pi wins as IPv6 default router
-- Adds ip6tables MASQUERADE/FORWARD rules so all client IPv6 traffic is forwarded through Pi
-- Drops outbound ICMPv6 Redirect messages — prevents Pi from redirecting clients to bypass the gateway
-
-**ICMPv6 Redirect suppression is critical.** Pi, the ISP router (FritzBox), and LAN clients share the same L2
-segment. When Pi forwards a packet to an external destination and the kernel determines the ISP router is a
-"better" next-hop on the same link, it sends an ICMPv6 Redirect to the client. The client then sends
-subsequent connections directly to the ISP router — bypassing Pi's masquerade and content filtering entirely.
-The first connection attempt fails (Pi forwarded nothing, just redirected), giving the symptom of "first
-request fails every ~30-60s." Dropping Redirect messages in ip6tables OUTPUT fixes this.
-
-To disable IPv6, leave `gateway_local_ipv6_subnet: ""` (default). The role skips all ip6tables rules and disables radvd.
-
 ## Network Architecture
 
 ```txt
@@ -65,40 +42,10 @@ Client Devices (192.168.1.0/24)
 
 - All traffic NAT'd through `wg+` interfaces
 - Pi and client traffic both use VPN exit IP
-- Most VPN providers handle IPv4/IPv6 protocol routing automatically
 
 **Direct Mode Characteristics:**
 
 - IPv4 traffic NAT'd through router interface (`end0`)
-- IPv6 traffic masqueraded through router interface — clients appear as Pi's GUA to the ISP router,
-  preventing ISP-router-level content filtering from applying per-device rules
-- ICMPv6 Redirects suppressed so clients always route through Pi
-
-## IPv6 Architecture Notes
-
-### Why masquerade IPv6 in direct mode?
-
-Clients have globally routable GUA addresses (assigned by ISP router SLAAC). Without masquerade, the ISP
-router sees each client's real GUA and can apply per-device content filtering. With masquerade, all client
-traffic appears to originate from Pi's GUA — bypassing per-device filtering consistently.
-
-### Why suppress ICMPv6 Redirects?
-
-When Pi, the ISP router, and clients share the same L2 segment (single broadcast domain), the Linux kernel
-sends ICMPv6 Redirect messages when it detects a "better" next-hop for a destination on the same link. For
-external GUA destinations reachable via the ISP router directly, Linux redirects clients from Pi to the ISP
-router. This causes:
-1. First SYN from client arrives at Pi — Pi sends Redirect, does NOT forward the packet
-2. Client receives Redirect, caches ISP router as next-hop for that destination
-3. Subsequent connections go directly to ISP router — masquerade and filtering bypassed
-
-Dropping `icmpv6-type redirect` in ip6tables OUTPUT prevents this entirely.
-
-### Why radvd with `AdvDefaultPreference high`?
-
-The ISP router (FritzBox) also sends RAs with default preference `medium` (or `low` if configured).
-Pi's radvd sends `AdvDefaultPreference high`, so clients prefer Pi as their IPv6 default router.
-Without this, clients split or prefer the ISP router depending on RA timing.
 
 ## Requirements
 
@@ -135,18 +82,6 @@ journalctl -u gateway-direct-mode.service -f
 sudo iptables -L -n -v
 sudo iptables -t nat -L -n -v
 
-# Verify ip6tables rules (redirect DROP must be first in OUTPUT)
-sudo ip6tables -L OUTPUT -n -v --line-numbers
-sudo ip6tables -t nat -L -n -v
-
-# Confirm no ICMPv6 Redirects being sent
-sudo tcpdump -i end0 -n 'icmp6 and ip6[40] == 137'
-
-# Verify clients route through Pi (not ISP router)
-# On client: ip -6 route show default
-# On Pi: sudo tcpdump -i end0 -n -e ip6 and host <client-GUA>
-
 # Test traffic routing
 curl -4 ifconfig.co  # Should show VPN IP when VPN active
-curl -6 ifconfig.co  # Should show Pi's GUA in direct mode, VPN IPv6 in VPN mode
 ```
diff --git a/roles/gateway/defaults/main.yml b/roles/gateway/defaults/main.yml
index dad64685..ebe33a12 100644
--- a/roles/gateway/defaults/main.yml
+++ b/roles/gateway/defaults/main.yml
@@ -1,4 +1,3 @@
 ---
 gateway_enabled: false
 gateway_router_interface: "eth0"
-gateway_local_ipv6_subnet: ""
diff --git a/roles/gateway/handlers/main.yml b/roles/gateway/handlers/main.yml
index 19088c82..12f901c0 100644
--- a/roles/gateway/handlers/main.yml
+++ b/roles/gateway/handlers/main.yml
@@ -15,9 +15,3 @@
   ansible.builtin.command:
     cmd: "udevadm control --reload-rules"
   changed_when: false
-
-- name: "Restart radvd"
-  become: true
-  ansible.builtin.systemd_service:
-    name: "radvd.service"
-    state: "restarted"
diff --git a/roles/gateway/meta/argument_specs.yml b/roles/gateway/meta/argument_specs.yml
index b8efa0b3..d24251e3 100644
--- a/roles/gateway/meta/argument_specs.yml
+++ b/roles/gateway/meta/argument_specs.yml
@@ -11,11 +11,6 @@ argument_specs:
         description: "Local subnet CIDR for NAT and routing rules (e.g., '192.168.178.0/24')"
         type: "str"
         required: true
-      gateway_local_ipv6_subnet:
-        description: "Local IPv6 subnet CIDR for NAT and routing rules (e.g., '2a02:3102:4ced:ec00::/64')"
-        type: "str"
-        required: false
-        default: ""
       gateway_router_interface:
         description: "Default route interface for direct routing mode"
         type: "str"
diff --git a/roles/gateway/tasks/main.yml b/roles/gateway/tasks/main.yml
index 71484725..661630f7 100644
--- a/roles/gateway/tasks/main.yml
+++ b/roles/gateway/tasks/main.yml
@@ -6,7 +6,6 @@
       - "iptables"
       - "iproute2"
       - "udev"
-      - "radvd"
     state: "present"
 
 - name: "Configure IP forwarding"
@@ -68,39 +67,3 @@
     name: "gateway-init.service"
     enabled: "{{ gateway_enabled }}"
     daemon_reload: true
-
-- name: "Configure radvd for IPv6 RA"
-  become: true
-  when: gateway_enabled and gateway_local_ipv6_subnet != ""
-  block:
-    - name: "Deploy radvd config"
-      ansible.builtin.template:
-        src: "radvd.conf.j2"
-        dest: "/etc/radvd.conf"
-        owner: "root"
-        group: "root"
-        mode: "0644"
-      notify: "Restart radvd"
-
-    - name: "Enable radvd service"
-      ansible.builtin.systemd_service:
-        name: "radvd.service"
-        enabled: true
-        state: "started"
-        daemon_reload: true
-
-- name: "Disable radvd when no IPv6 subnet configured"
-  become: true
-  when: not gateway_enabled or gateway_local_ipv6_subnet == ""
-  block:
-    - name: "Stop and disable radvd"
-      ansible.builtin.systemd_service:
-        name: "radvd.service"
-        enabled: false
-        state: "stopped"
-      failed_when: false
-
-    - name: "Remove radvd config"
-      ansible.builtin.file:
-        path: "/etc/radvd.conf"
-        state: "absent"
diff --git a/roles/gateway/templates/99-gateway.conf.j2 b/roles/gateway/templates/99-gateway.conf.j2
index b0f99dd4..6f8a3fbd 100644
--- a/roles/gateway/templates/99-gateway.conf.j2
+++ b/roles/gateway/templates/99-gateway.conf.j2
@@ -1,8 +1,5 @@
 {% if gateway_enabled %}
 net.ipv4.ip_forward=1
-net.ipv6.conf.all.forwarding=1
-net.ipv6.conf.{{ gateway_router_interface }}.accept_ra=2
 {% else %}
 net.ipv4.ip_forward=0
-net.ipv6.conf.all.forwarding=0
 {% endif %}
diff --git a/roles/gateway/templates/gateway-apply-rules.sh.j2 b/roles/gateway/templates/gateway-apply-rules.sh.j2
index 59a960cf..785d595b 100644
--- a/roles/gateway/templates/gateway-apply-rules.sh.j2
+++ b/roles/gateway/templates/gateway-apply-rules.sh.j2
@@ -7,7 +7,6 @@ LOG_FACILITY="local0.info"
 
 # Ansible template variables - configured at deployment time
 GATEWAY_SUBNET_V4="{{ gateway_local_ipv4_subnet }}"
-GATEWAY_SUBNET_V6="{{ gateway_local_ipv6_subnet }}"
 GATEWAY_INTERFACE="{{ gateway_router_interface }}"
 log_message() {
     echo "[$SCRIPT_NAME] $1" | logger -t "$SCRIPT_NAME" -p "$LOG_FACILITY"
@@ -25,11 +24,6 @@ clear_rules() {
     iptables -t nat -D POSTROUTING -s "$GATEWAY_SUBNET_V4" -o "$GATEWAY_INTERFACE" -j MASQUERADE 2>/dev/null || true
     iptables -D OUTPUT -o wg+ -j ACCEPT 2>/dev/null || true
     iptables -D OUTPUT -o "$GATEWAY_INTERFACE" -j ACCEPT 2>/dev/null || true
-    if [ -n "$GATEWAY_SUBNET_V6" ]; then
-        ip6tables -F FORWARD 2>/dev/null || true
-        ip6tables -F OUTPUT 2>/dev/null || true
-        ip6tables -t nat -F POSTROUTING 2>/dev/null || true
-    fi
 }
 
 apply_vpn_mode() {
@@ -39,13 +33,6 @@ apply_vpn_mode() {
     iptables -A OUTPUT -o wg+ -j ACCEPT
     iptables -A FORWARD -s "$GATEWAY_SUBNET_V4" -o wg+ -j ACCEPT
     iptables -A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-    if [ -n "$GATEWAY_SUBNET_V6" ]; then
-        ip6tables -t nat -A POSTROUTING -o wg+ -j MASQUERADE
-        ip6tables -I OUTPUT 1 -p ipv6-icmp --icmpv6-type redirect -j DROP
-        ip6tables -A OUTPUT -o wg+ -j ACCEPT
-        ip6tables -A FORWARD -i "$GATEWAY_INTERFACE" -o wg+ -j ACCEPT
-        ip6tables -A FORWARD -i wg+ -o "$GATEWAY_INTERFACE" -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-    fi
     log_message "VPN mode rules applied - traffic routed through VPN"
 }
 
@@ -55,13 +42,6 @@ apply_direct_rules() {
     iptables -A OUTPUT -o "$GATEWAY_INTERFACE" -j ACCEPT
     iptables -A FORWARD -s "$GATEWAY_SUBNET_V4" -o "$GATEWAY_INTERFACE" -j ACCEPT
     iptables -A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-    if [ -n "$GATEWAY_SUBNET_V6" ]; then
-        ip6tables -t nat -A POSTROUTING -o "$GATEWAY_INTERFACE" -j MASQUERADE
-        ip6tables -I OUTPUT 1 -p ipv6-icmp --icmpv6-type redirect -j DROP
-        ip6tables -A OUTPUT -o "$GATEWAY_INTERFACE" -j ACCEPT
-        ip6tables -A FORWARD -s "$GATEWAY_SUBNET_V6" -i "$GATEWAY_INTERFACE" -o "$GATEWAY_INTERFACE" -j ACCEPT
-        ip6tables -A FORWARD -i "$GATEWAY_INTERFACE" -o "$GATEWAY_INTERFACE" -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-    fi
     log_message "Direct mode rules applied - normal routing active"
 }
 
diff --git a/roles/gateway/templates/radvd.conf.j2 b/roles/gateway/templates/radvd.conf.j2
deleted file mode 100644
index 49b3047d..00000000
--- a/roles/gateway/templates/radvd.conf.j2
+++ /dev/null
@@ -1,12 +0,0 @@
-interface {{ gateway_router_interface }} {
-    AdvSendAdvert on;
-    AdvManagedFlag off;
-    AdvOtherConfigFlag on;
-    AdvDefaultPreference high;
-
-    prefix {{ gateway_local_ipv6_subnet }} {
-        AdvOnLink on;
-        AdvAutonomous on;
-        AdvRouterAddr on;
-    };
-};
diff --git a/roles/hostname/tasks/main.yml b/roles/hostname/tasks/main.yml
index b6dc2cc1..5b502ec0 100644
--- a/roles/hostname/tasks/main.yml
+++ b/roles/hostname/tasks/main.yml
@@ -16,7 +16,4 @@
     content: |
       127.0.0.1   localhost
       127.0.1.1   {{ hostname }}
-      ::1         localhost ip6-localhost ip6-loopback
-      ff02::1     ip6-allnodes
-      ff02::2     ip6-allrouters
   when: hostname is defined
diff --git a/roles/network/defaults/main.yml b/roles/network/defaults/main.yml
index 20776341..5e1076a7 100644
--- a/roles/network/defaults/main.yml
+++ b/roles/network/defaults/main.yml
@@ -1,5 +1,3 @@
 ---
 network_wifi_ssid: ""
 network_wifi_pass: ""
-network_prefer_ipv4: false
-network_ipv6_disabled: false
diff --git a/roles/network/meta/argument_specs.yml b/roles/network/meta/argument_specs.yml
index b6c521fe..5f74b45c 100644
--- a/roles/network/meta/argument_specs.yml
+++ b/roles/network/meta/argument_specs.yml
@@ -21,20 +21,6 @@ argument_specs:
       network_ipv4_dns:
         type: "str"
         description: "The network IP(4) gateway to configure when provided"
-      network_ipv6_gateway:
-        type: "str"
-        description: "Static IPv6 default route via router link-local — set when router RA is disabled"
-        required: false
-      network_prefer_ipv4:
-        type: "bool"
-        description: "Prefer IPv4 over IPv6 for address resolution"
-        required: false
-        default: false
-      network_ipv6_disabled:
-        type: "bool"
-        description: "Disable IPv6 on all network connections"
-        required: false
-        default: false
       network_bridge_interface:
         type: "str"
         description: "Physical NIC to enslave as vmbr0 bridge port"
diff --git a/roles/network/templates/NetworkManager.conf.j2 b/roles/network/templates/NetworkManager.conf.j2
index a67d2e27..43baa2f6 100644
--- a/roles/network/templates/NetworkManager.conf.j2
+++ b/roles/network/templates/NetworkManager.conf.j2
@@ -16,8 +16,6 @@ ethernet.cloned-mac-address=random
 wifi.cloned-mac-address=stable
 
 [connection]
-ipv6.ip6-privacy=2
-ipv6.dhcp-duid=stable-uuid
 wifi.powersave=2
 connection.mdns=2
 
diff --git a/roles/network/templates/bridge.nmconnection.j2 b/roles/network/templates/bridge.nmconnection.j2
index 47f723d8..8ac4c6fe 100644
--- a/roles/network/templates/bridge.nmconnection.j2
+++ b/roles/network/templates/bridge.nmconnection.j2
@@ -16,8 +16,4 @@ dns={{ network_ipv4_dns }}
 {% endif %}
 
 [ipv6]
-addr-gen-mode=default
-method=auto
-{% if network_ipv6_gateway is defined %}
-routes=::/0,{{ network_ipv6_gateway }},100
-{% endif %}
+method=disabled
diff --git a/roles/network/templates/eth0-connection.nmconnection.j2 b/roles/network/templates/eth0-connection.nmconnection.j2
index 032b18a3..f5856bce 100644
--- a/roles/network/templates/eth0-connection.nmconnection.j2
+++ b/roles/network/templates/eth0-connection.nmconnection.j2
@@ -27,14 +27,6 @@ method=auto
 {% endif %}
 
 [ipv6]
-addr-gen-mode=default
-{% if network_bridge_interface is defined or network_ipv6_disabled %}
 method=disabled
-{% elif network_ipv6_gateway is defined %}
-method=auto
-routes=::/0,{{ network_ipv6_gateway }},100
-{% else %}
-method=auto
-{% endif %}
 
 [proxy]
diff --git a/roles/network/templates/gai.conf.j2 b/roles/network/templates/gai.conf.j2
index 21c17332..8f8e29c2 100644
--- a/roles/network/templates/gai.conf.j2
+++ b/roles/network/templates/gai.conf.j2
@@ -1,10 +1,2 @@
 # Managed by Ansible — controls getaddrinfo address family preference
-{% if network_prefer_ipv4 %}
 precedence ::ffff:0:0/96  100
-{% else %}
-precedence ::1/128         50
-precedence ::/0            40
-precedence 2002::/16       30
-precedence ::/96           20
-precedence ::ffff:0:0/96   10
-{% endif %}
diff --git a/roles/network/templates/resolved.conf.j2 b/roles/network/templates/resolved.conf.j2
index 0354feeb..58336756 100644
--- a/roles/network/templates/resolved.conf.j2
+++ b/roles/network/templates/resolved.conf.j2
@@ -1,6 +1,6 @@
 [Resolve]
-DNS={{ network_ipv4_dns | default('1.1.1.1 2606:4700:4700::1111') }}
-FallbackDNS=8.8.8.8 2001:4860:4860::8888
+DNS={{ network_ipv4_dns | default('1.1.1.1') }}
+FallbackDNS=8.8.8.8
 DNSOverTLS={{ 'no' if network_ipv4_dns is defined else 'yes' }}
 DNSSEC={{ 'no' if network_ipv4_dns is defined else 'yes' }}
 # use interface-specific DNS when available but fall back to global (required for VPN DNS to work)
diff --git a/roles/network/templates/wifi-connection.nmconnection.j2 b/roles/network/templates/wifi-connection.nmconnection.j2
index 01dff2eb..b5280a30 100644
--- a/roles/network/templates/wifi-connection.nmconnection.j2
+++ b/roles/network/templates/wifi-connection.nmconnection.j2
@@ -26,14 +26,6 @@ method=auto
 {% endif %}
 
 [ipv6]
-addr-gen-mode=default
-{% if network_ipv6_disabled %}
 method=disabled
-{% elif network_ipv6_gateway is defined %}
-method=auto
-routes=::/0,{{ network_ipv6_gateway }},100
-{% else %}
-method=auto
-{% endif %}
 
 [proxy]
diff --git a/roles/pihole/README.md b/roles/pihole/README.md
index e7e0bb20..2f2383ab 100644
--- a/roles/pihole/README.md
+++ b/roles/pihole/README.md
@@ -37,54 +37,8 @@ This role configure the [pihole](https://github.com/pi-hole/pi-hole) DNS Sinkhol
 
 - Internet > Account Information > DNS Server > DNSv4 Server > Use Other DNSv4 Servers > {{ pihole_ipv4 }}
 
-#### No IPv6 Support (default)
-
 - Home Network > Network > Network Settings > Change Advanced Network Settings > IPv6 >
   - Router advertisement enable in the LAN > ❌
   - DNSv6 Server in the Home Network > Also announce DNSv6 server via router advertisement (RFC5006) > ❌
 
 - Internet > Account Information > IPv6 > IPv6 Support > ❌
-
-#### With IPv6 Support
-
-Setup is a two-step process: first enable FritzBox RA to get the Pi's stable ULA address,
-then disable FritzBox RA so Pi becomes the sole IPv6 default router.
-
-**Step 1 — Enable FritzBox RA temporarily to get Pi's ULA address:**
-
-- Internet > Account Information >
-  - IPv6 > IPv6 Support > ✅
-  - IPv6 > IPv6 Connectivity > Native IPv4 connection > Use IPv6 via landline connection or Mobile network > ✅
-  - IPv6 > Connection Settings > Use DHCPv6 Rapid Commit > ❌
-  - IPv6 > Connection Settings > Require certain length of the LAN prefix > ❌
-
-- Home Network > Network > Network Settings > Change Advanced Network Settings > IPv6 >
-  - Router advertisement enable in the LAN > ✅
-    - Always assign ULA addresses > ✅
-    - Set ULA prefix > https://www.unique-local-ipv6.com/ example: `fd00:1234:5678::` > ✅
-    - This FRITZ!Box provides the standard internet connection > Low
-  - DNSv6 Server in the Home Network >
-    - Also announce DNSv6 server via router advertisement (RFC5006) > ✅
-    - Local DNSv6 Server > {{ pihole_ipv6 `ip address | grep "inet6 fd"`}}
-  - DHCPv6 Server in the home network >
-    - Disable DHCPv6 server in the FRITZ!Box for the home network > ✅
-      - There are no other DHCPv6 servers in the home network. > ✅
-
-- Internet > Account Information > Internet DNS Server > DNSv6 Server > Use Other DNSv6 Servers > {{ pihole_ipv6 }}
-
-On the Pi, get the ULA address and the FritzBox link-local default route:
-```bash
-ip address | grep "inet6 fd"         # use the mngtmpaddr address as pihole_ipv6
-ip -6 route show default | grep ra   # use the nexthop as network_ipv6_gateway in rpi5 host_vars
-```
-
-Set `network_ipv6_gateway` in `host_vars/rpi5.local.yml` and run the playbook to deploy the static IPv6 route on Pi.
-
-**Step 2 — Disable FritzBox RA so Pi becomes sole IPv6 default router:**
-
-- Home Network > Network > Network Settings > Change Advanced Network Settings > IPv6 >
-  - Router advertisement enable in the LAN > ❌
-
-NOTE: Pi's radvd (deployed by the `gateway` role) takes over sending RAs with `AdvDefaultPreference high`.
-All LAN devices use Pi as their IPv6 default router → traffic routes VPN or direct mode.
-Pi keeps IPv6 connectivity via the static route to FritzBox set in Step 1.
diff --git a/roles/pihole/defaults/main.yml b/roles/pihole/defaults/main.yml
index d980c67c..e9d72266 100644
--- a/roles/pihole/defaults/main.yml
+++ b/roles/pihole/defaults/main.yml
@@ -2,12 +2,8 @@
 pihole_password: "{{ ('changeme' | hash('sha256') | hash('sha256'))[:64] }}"
 pihole_totp_secret: "CHANGEME"
 pihole_dns:
-  # Cloudflare
-  - "1.1.1.1"
-  - "2606:4700:4700::1111"
-  # Google
-  - "8.8.8.8"
-  - "2001:4860:4860:0:0:0:0:8888"
+  - "1.1.1.1" # Cloudflare
+  - "8.8.8.8" # Google
 pihole_interface: "eth0"
 pihole_dns_blocking_enabled: true
 pihole_dhcp_enabled: false
diff --git a/roles/pihole/meta/argument_specs.yml b/roles/pihole/meta/argument_specs.yml
index 40662436..c86fd5a0 100644
--- a/roles/pihole/meta/argument_specs.yml
+++ b/roles/pihole/meta/argument_specs.yml
@@ -15,12 +15,8 @@ argument_specs:
         description: "The list of DNS servers to use as upstreams"
         elements: "str"
         default:
-          # Cloudflare
-          - "1.1.1.1"
-          - "2606:4700:4700::1111"
-          # Google
-          - "8.8.8.8"
-          - "2001:4860:4860:0:0:0:0:8888"
+          - "1.1.1.1" # Cloudflare
+          - "8.8.8.8" # Google
       pihole_interface:
         type: "str"
         description: "The interface to bind the pi-hole on"
diff --git a/roles/pihole/tasks/main.yml b/roles/pihole/tasks/main.yml
index ccd4bd9f..63e034d8 100644
--- a/roles/pihole/tasks/main.yml
+++ b/roles/pihole/tasks/main.yml
@@ -1,8 +1,8 @@
 ---
-- name: "Validate network_ipv*_dns params"
+- name: "Validate network_ipv4_dns param"
   ansible.builtin.fail:
-    msg: "Pihole role cannot work when network_ipv4_dns or network_ipv6_dns are defined"
-  when: network_ipv4_dns is defined or network_ipv6_dns is defined
+    msg: "Pihole role cannot work when network_ipv4_dns is defined"
+  when: network_ipv4_dns is defined
 
 - name: "Validate pihole_dhcp_* params"
   ansible.builtin.assert:
diff --git a/roles/pve/templates/hosts.j2 b/roles/pve/templates/hosts.j2
index 5cebad3c..b5ef4bc3 100644
--- a/roles/pve/templates/hosts.j2
+++ b/roles/pve/templates/hosts.j2
@@ -1,5 +1,2 @@
 127.0.0.1   localhost
 {{ network_ipv4_address }}  {{ ansible_facts['hostname'] }}
-::1         localhost ip6-localhost ip6-loopback
-ff02::1     ip6-allnodes
-ff02::2     ip6-allrouters