Everything works perfectly until my IPv6 address changes

[JustinH]

I'm running Jellyfin on Debian, not using docker.
My ISP uses CGNAT so I'm using IPv6 only(having IPv4 and IPv6 enabled caused the local discovery address to show as 127.0.0.1) and have a DNS name redirecting to it.
I'm using caddy for HTTPS and the DNS automatically updates.

Everything works perfectly except my IPv6 address changes every 24hrs and while my DNS name updates correctly (I can remote in using it from local and external), Jellyfin stops working(both locally and externally). If I restart the Jellyfin service, it starts working again.

I don't know if it's possible or advisable to set a static IPv6 address(I still don't fully understand them), but it seems like Jellyfin should be able to deal with a changing IP address, so that seems like a bit of a band aid solution if it's even an option.
I'm vaguely aware of something to do with Jellyfin binding to an ip address, so I've been kind of looking in that area but I'm a bit lost.

[TheDreadPirate]

How are you handling IPv6? Is your ISP giving you a /64 prefix that is static, but the suffix is changing every 24 hours on the server?

[JustinH]

That's exactly it. I have the subdomain website managing the IP addresses I think. I don't know what device decides the lease time, but it seems that even with a longer lease time the same thing would happen. I have a Google wifi router so I'm fairly limited with settings I can pay with in that.

[TheDreadPirate]

Non-server versions of Windows and Linux will rotate IPv6 addresses. As will Android and iOS. This is a privacy related function to make it harder for advertisers to track you.

On server versions of Windows and Linux this is disabled. But you should be able to disable it in Debian desktop variants with these steps.

Run this command.

Code:

sudo /sbin/sysctl -a | grep use_tempaddr

The output will look something like this.

Code:

net.ipv6.conf.all.use_tempaddr = 2
net.ipv6.conf.default.use_tempaddr = 2
net.ipv6.conf.docker0.use_tempaddr = 2
net.ipv6.conf.eth0.use_tempaddr = 0
net.ipv6.conf.lo.use_tempaddr = -1
net.ipv6.conf.wg0.use_tempaddr = -1

We only care about the line for the actual interface connected to the Internet (eth0 in my case). This is from one of my servers, but if it were 1 or 2 we would edit /etc/sysctl.conf and add a line setting it to zero.

Code:

sudo vim /etc/sysctl.conf  # or whichever text editor you like

Add this to the bottom of the file. Substitute "eth0" with your interface name, if it is different.

Code:

net.ipv6.conf.eth0.use_tempaddr = 0

To apply these changes without rebooting, run this command.

Code:

sysctl --system

[JustinH]

Thank you for your response.
I had added "net.ipv6.conf.all.use_tempaddr = 0" to sysctl.conf yesterday before making this post but I have to wait until about 6pm for the IP to change to see if it made a difference, the IP still changed unfortunately.
I would imagine that should encompass my specific adapter as well, but I have now removed that line and put in "net.ipv6.conf.enp1s0.use_tempaddr = 0" and will see if that works tomorrow.

I was just looking at this page https://jellyfin.org/docs/general/networking/ and was reading the section about reverse proxies. Should I have something in the "Known Proxies" section? I've basically done nothing in the network settings of Jellyfin except disable ipv4 and enable ipv6, everything else on that page is just blank or whatever the default settings are.

[JustinH]

So, I had to restart the server and I just ran "sudo /sbin/sysctl -a | grep use_tempaddr" and this is the output:

Code:

net.ipv6.conf.all.use_tempaddr = 0
net.ipv6.conf.default.use_tempaddr = 0
net.ipv6.conf.enp1s0.use_tempaddr = 2
net.ipv6.conf.lo.use_tempaddr = -1
net.ipv6.conf.wlp2s0.use_tempaddr = 0

I double checked sysctl.conf and it definitely has "net.ipv6.conf.enp1s0.use_tempaddr = 0" in it, everything else in the file is commented out.
A new ip was assigned at reboot, so I guess I'll have to wait another 24hrs now to see what happens.

[gnattu]

kestrel cannot rebind to a new address easily. Use a reverse proxy and bind that reverse proxy to [::] instead.

[JustinH]

I did have my caddyfile set as subdomain.domain.com to subdomain.domain.com:8096 but have just changed that to localhost:8096. I'm not sure if that would effect jellyfin or not, is there a setting in jellyfin that I should change? I did read that perhaps I need to add a line to BindtoAddress to network.xml, but as I have a 24hr turn around, I didn't want to try more than one thing at a time unless someone knew the likely resolution.

[TheDreadPirate]

When you run "sudo nmcli", what is the output? Based on this post it looks like if Network Manager is managing your interfaces it will override the sysctl file we edited.

https://serverfault.com/questions/113575...s-for-ipv6

The second comment.

After some more grepping around, it seems I had edited the wrong interface with nmcli which was indeed the source of interference with sysctl. Editing ipv6.ip6-privacy for the right interface actually worked. –
sereizam
CommentedJul 5, 2023 at 13:42