Question
IPv6 Firewall Options Visibility in YaST on OpenSUSE Leap 15.6
Rin Nova
0 reputation · 13 Mar 2025, 06:47 UTC
47.1K views
Loading…
0 reputation · 13 Mar 2025, 06:47 UTC
In OpenSUSE Leap 15.6 the YaST firewall module (YaST 3.3.1) presents an IPv6 checkbox that must be enabled manually. The module does not automatically detect whether the running kernel has IPv6 support, so the checkbox remains visible even when the kernel is compiled without IPv6. Enabling the checkbox in such a scenario has no effect and YaST logs a generic failure message, providing no clear indication of the underlying issue.
The core question is whether YaST should automatically hide or disable the IPv6 firewall options when the kernel lacks IPv6 capability, thereby preventing users from enabling non‑functional rules. If this behavior is not implemented, what diagnostic feedback should YaST provide to help administrators identify the missing kernel support?
1. Should YaST automatically detect kernel IPv6 support and hide or disable the IPv6 firewall options when unavailable?
2. If not, what specific diagnostic message or UI indicator should YaST present when an IPv6 rule fails due to missing kernel support?
35275 reputation · 13 Mar 2025, 14:41 UTC
Yes – YaST should automatically detect whether the running kernel has IPv6 support and hide or disable the IPv6 firewall checkbox when IPv6 is unavailable. If this detection is not implemented, YaST must present a clear diagnostic message and a UI indicator (e.g., a disabled checkbox with a tooltip) when an attempt to enable IPv6 rules fails due to missing kernel support.
YaST can determine IPv6 availability by checking for the ipv6 kernel module or the presence of the IPv6 proc interface:
opensuse# Check if the ipv6 module is loaded
lsmod | grep ipv6
# Or verify the proc file exists
[ -f /proc/net/if_inet6 ] && echo "IPv6 present" || echo "IPv6 absent"
When a user tries to enable IPv6 firewall rules on a system without kernel IPv6 support, YaST should display a message such as:
"IPv6 support not available in the kernel; IPv6 firewall rules cannot be applied. Load the
ipv6module or use a kernel with CONFIG_IPV6 enabled."
Accompany this with a UI indicator: the IPv6 checkbox rendered disabled (grayed out) and a tooltip that repeats the same message on hover.
lsmod | grep ipv6 or [ -f /proc/net/if_inet6 ] && echo IPv6 present.Use comments to ask for clarification. Post a solution as an answer.
35,275 reputation · 13 Mar 2025, 15:08 UTC
A critical detail in this behavior is the decoupling between the YaST UI and the underlying firewall backend (typically firewalld). YaST often acts as a configuration wrapper; when the IPv6 checkbox is toggled, it sends a command to the backend, which then attempts to interface with the kernel's netfilter/nftables subsystem.
The "generic failure message" likely occurs because the backend returns a non-zero exit code that YaST is not programmed to parse into a human-readable kernel error. To verify the specific failure point, administrators can monitor the system logs during the toggle:
journalctl -fIf the kernel lacks CONFIG_IPV6, the backend will fail to apply the rule, but the error remains trapped in the system log rather than surfacing in the YaST interface. This confirms that the issue is not just a missing UI check, but a lack of error propagation from the backend to the frontend.