This is solved by two extensions to IPv6:
- RFC 4941 aka "Privacy Addressing" lets outbound connections use temporary, randomly generated addresses (which are rotated every few hours).
- RFC 7217 allows the primary, static address to be generated from an opaque hash which does not reveal any information.
At least one but increasingly both methods are supported by popular operating systems.
Note that these features are orthogonal. You can use both at the same time, if you want to.
Stable private addresses
In some operating systems, the MAC (EUI-48) address is simply no longer used for interface identifiers. Instead a random or hash-based identifier is used, generally according to RFC 7217.
Windows uses a custom scheme by default beginning with Windows Vista.
To check if the feature is active, run a PowerShell command:
Get-NetIPv6Protocol | fl RandomizeIdentifiers
To enable/disable the feature:
Set-NetIPv6Protocol -RandomizeIdentifiers Enabled
Set-NetIPv6Protocol -RandomizeIdentifiers Disabled
Linux (NetworkManager) supports RFC 7217 as of NetworkManager v1.2.0, using the connection profile's UUID as part of the seed. This feature is active by default in recent NM versions.
To enable or disable this feature:
nmcli con modify "<profilename>" ipv6.addr-gen-mode stable-privacy
nmcli con modify "<profilename>" ipv6.addr-gen-mode eui64
Linux (kernel SLAAC) supports RFC 7217 as of kernel v4.1.0; however, it must be manually activated by storing the secret seed via sysctl.
The secret key is a 128-bit hexadecimal string (shaped like an IPv6 address), that must be stored in the
net.ipv6.conf.default.stable_secret sysctl. To make it persistent, it could be put in
/etc/sysctl.d/50-rfc7217.conf or similar:
net.ipv6.conf.default.stable_secret = 84a0:d5aa:52b0:4d35:k567:3aa6:7af5:474c
Setting the secret automatically activates this mode for all network interfaces. To check whether the feature is active, look for "addrgenmode stable_secret" in
ip -d link, or the value "2" in
Temporary private addresses
As defined in RFC 4941, temporary privacy addresses are generated randomly and rotated every few hours.
Windows supports temporary addresses as of Windows XP SP2.
To enable/disable this feature:
netsh interface ipv6 set privacy state=enabled
netsh interface ipv6 set privacy state=disabled
Note that Windows no longer uses MAC-address-based primary addresses starting with Windows Vista.
Linux (NetworkManager): Recent versions of NetworkManager handle RA on their own, although the two values below have identical meanings to sysctl (2 = prefer privacy address, 1 = prefer main address):
nmcli con modify <name> ipv6.ip6-privacy 2
Also, as of 1.2.0 a better mode became available, which changes the main address to no longer be MAC-based but instead unique for every network (RFC 7217):
(Note that privacy addressing is orthogonal to addr-gen-mode; it's possible to use both.)
Side note: As of 1.4.0, NM allows randomizing the MAC address itself, too. Set
stable to have a different MAC for every network (recommended), or
random to randomize it for every connection (may cause problems).
In all cases,
<name> must be the connection name, e.g. WiFi SSID or
"Wired Connection 1". Use
nmcli con to list all.
To make this the default for new connections, as of 1.2.0 you can change
Linux (kernel SLAAC) supports temporary addresses, but does not use them by default. They can be activated through sysctls.
To enable temporary addresses and make them preferred for outgoing connections:
To enable temporary address generation, but keep the static SLAAC address as preferred:
default part can be replaced with a specific interface name; e.g.
ip link set eth0 down && ip link set eth0 up to force an address assignment, but you can also run
rdisc6 eth0 or just wait a few minutes for the next periodic Router Advertisement.)
Mac OS X – enabled by default since OS X 10.7 Lion:
sysctl -w net.inet6.ip6.use_tempaddr=1
Temporary addresses, if enabled, will be preferred.
sysctl -w net.inet6.ip6.use_tempaddr=1
Temporary addresses preference? I have no idea. The autoconf address seems to be preferred.
ifconfig doesn't appear to list any address properties.
OpenBSD – support added in 5.2; enabled and preferred by default in 5.3.
ifconfig em0 autoconfprivacy
ifconfig shows "autoconfprivacy" next to temporary addresses.
Notes on configuration:
On Linux, OS X, and all BSDs, edit
/etc/sysctl.conf to make the setting permanent.
On Windows, the changes will persist automatically. (You can append
store=active to the
netsh command if you want it to only last until reboot.)
Partially based on IPv6 Operating Systems at IPv6INT.net. See also General IPv6 Notes
If the hardware address is used in the IPv6 address, it usually means your network uses IPv6 Stateless Autoconfiguration. In such case, you can simply pick your own address suffix and configure IPv6 manually.
However, even though the manually added address will not have your hardware info, it will still be static (unlike with Privacy Addressing, which changes addresses every so often). Also, static addresses can be a pain in a network larger than 2-3 devices.