Fix NetworkManager privacy settings

root/etc/NetworkManager/conf.d/ipv6-privacy.conf

@@ -1,39 +1,51 @@
-# IPv6 address generation and privacy defaults.
+[connection]
+
+# Generate the stable SLAAC IPv6 address using RFC7217 ("stable privacy").
 #
-# Most IPv6 networks use SLAAC (Stateless Address Autoconfiguration),
-# where the host generates its own IPv6 addresses based on the network
-# prefix advertised by the router.
+# Normally IPv6 SLAAC can derive the interface identifier directly from
+# the device MAC address using the legacy EUI-64 scheme. This exposes the
+# hardware MAC inside the IPv6 address and allows long-term tracking.
 #
-# Two mechanisms influence how these addresses appear:
+# The "stable-privacy" mode instead derives the address from a secret
+# kernel seed and the network prefix. This produces a deterministic
+# address that stays stable within the same network but does not reveal
+# the device MAC address.
+ipv6.addr-gen-mode=stable-privacy
+
+
+# Enable RFC4941 temporary IPv6 addresses and prefer them for outbound
+# connections.
 #
-#   ipv6.addr-gen-mode
-#       Controls how the *stable* SLAAC address is generated.
+# These temporary addresses rotate periodically and are used for outgoing
+# traffic to reduce the ability of remote servers to track the device
+# across connections.
 #
-#       stable-privacy:
-#           Generate a deterministic pseudorandom address derived from
-#           a kernel secret and the network prefix. This prevents the
-#           legacy EUI-64 mechanism from exposing the device's MAC
-#           address in the IPv6 address.
+# The interface will still retain a stable address (generated above) for
+# inbound connections, but outgoing traffic will prefer the temporary
+# ones.
 #
-#   ipv6.ip6-privacy
-#       Enables RFC 4941 temporary IPv6 addresses. These are additional
-#       short-lived addresses that rotate periodically and are preferred
-#       for outbound connections to prevent remote tracking.
-#
-# With these settings a network interface will typically have:
-#
-#   - one stable pseudorandom IPv6 address
-#   - one or more temporary rotating addresses used for outbound traffic
-#
-# Note that temporary addresses do NOT replace the stable address. The
-# interface will still have one stable address used for inbound connections,
-# it will just use the temporary ones for outbound ones.
-#
-# Values for ipv6.ip6-privacy:
+# Values:
 #   0 = disable temporary addresses
 #   1 = enable but prefer the stable address
 #   2 = enable and prefer temporary addresses
-
-[connection]
-ipv6.addr-gen-mode=stable-privacy
 ipv6.ip6-privacy=2
+
+
+# Use a per-connection DHCPv6 client identifier.
+#
+# When a network uses DHCPv6, the client must identify itself with a
+# DHCP Unique Identifier (DUID). By default NetworkManager generates a
+# single identifier derived from the system machine-id, meaning every
+# network sees the same persistent identifier.
+#
+# The "stable-uuid" mode instead generates a different identifier per
+# connection using the connection's stable-id and a host-specific secret.
+# Each network therefore sees a different DHCPv6 identity while still
+# receiving a stable identifier across reconnects.
+#
+# This prevents cross-network tracking while maintaining normal DHCPv6
+# lease behavior.
+#
+# Note: many IPv6 networks rely only on SLAAC and do not use DHCPv6, in
+# which case this setting has no effect.
+ipv6.dhcp-duid=stable-uuid