Windows 7 – IPv4 vs IPv6 Priority

ipv6networkingwindows 7

I have IPv6 connectivity through Hurricane Electric tunnel. Since IPv6 day this year, many services (google.com, facebook.com, etc.) enabled IPv6 on their main domains. On my Windows machine, IPv6 is preferred over IPv4. This means that whenever I visit Google, all traffic goes through my tunnel to Hurricane Electric, which raises the latency by more than 100%:

C:\> ping www.google.com

Pinging www.l.google.com [2001:4860:8005::68] with 32 bytes of data:
Reply from 2001:4860:8005::68: time=85ms
Reply from 2001:4860:8005::68: time=84ms
Reply from 2001:4860:8005::68: time=112ms
Reply from 2001:4860:8005::68: time=86ms

Ping statistics for 2001:4860:8005::68:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 84ms, Maximum = 112ms, Average = 91ms


C:\> ping -4 www.google.com

Pinging www.l.google.com [173.194.79.103] with 32 bytes of data:
Reply from 173.194.79.103: bytes=32 time=28ms TTL=48
Reply from 173.194.79.103: bytes=32 time=28ms TTL=48
Reply from 173.194.79.103: bytes=32 time=55ms TTL=46
Reply from 173.194.79.103: bytes=32 time=29ms TTL=46

Ping statistics for 173.194.79.103:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 28ms, Maximum = 55ms, Average = 35ms

Question: How can I make Windows 7 to always prefer IPv4, when both IPv4 and IPv6 records are available for a specific domain name?

Best Answer

Solution #1: Add a prefix policy to prefer IPv4 addresses over IPv6

Prefix policy table is similar a routing table, it determines which IP addresses are preferred when making a connection. Note that higher precedence in prefix policies is represented by a higher "precedence" value, exactly opposite to routing table "cost" value.

Default Windows prefix policy table:

C:\> netsh interface ipv6 show prefixpolicies
Querying active state...

Precedence  Label  Prefix
----------  -----  --------------------------------
        50      0  ::1/128
        40      1  ::/0
        30      2  2002::/16
        20      3  ::/96
        10      4  ::ffff:0:0/96
         5      5  2001::/32

Note that IPv6 addresses (::/0) are preferred over IPv4 addresses (::/96, ::ffff:0:0/96).

We can create a policy that will make Hurricane Electric IPv6 tunnel less favorable than any IPv4 address:

netsh interface ipv6 add prefixpolicy 2001:470::/32 3 6

2001:470::/32 is Hurricane Electric's prefix, 3 is a Precedence (very low) and 6 is a Label.

I could have used a more generic prefix, but I wanted to make sure that if and when I get direct IPv6 connectivity from an ISP, it will take precedence over IPv4.

If you adapt this solution, you need to substitute an appropriate IPv6 prefix instead of my Hurricane Electric one.

Solution #2: Tweak registry to make Windows always prefer IPv4 over IPv6

This solution is more generic, but more invasive and less standards-compliant. In the end, Windows will still modify the prefix policy table for you.

Open RegEdit, navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\tcpip6\Parameters
Create DisabledComponents DWORD registry value, set its value to 20 (Hexadecimal). See Microsoft KB 929852 for more info about this registry key, especially if DisabledComponents already exists on your system.
Reboot.

Related Solutions

Debugging IPv6 routing issues

If you only have one /64 prefix and that prefix is on your WAN side then you can't do IPv6 for your LAN. An ISP is supposed to give you multiple /64s so that you can put a separate /64 on each LAN. It is common for an ISP to give everybody (residential and business) a /48 (65536 /64s). For residential customers they might hand out a /56 (256 /64s). That way you have plenty prefixes to number your network, even if it gets more complicated over time (Internet-of-Things deployment etc).

Some ISPs are still sticking too much to the IPv4 mentality and only giving out a /60 (16 /64s) or so. While that will probably be enough now it will cause problems as IP-capable devices become more common, and you don't really want your living room lighting and AC to be in the same subnet as the children's toys, do you? ;)

ISPs that only hand out a single /64 prevent you from any subnetting at all. If that /64 is on the WAN interface then you'll never get decent IPv6 on your LAN(s). This is the ISPs fault and they should fix this by giving out a decent amount (/48 or /56) of addresses.

Windows 10 is not using the IPv6 address by default

I had the same niggling issue -- ipv4 and ipv6 both work, but if I try to ping (or browse etc.) any name with an IPv4 A record, Windows would always prefer that over the v6 (AAAA) address. There is logic inside the network stack that sorts the addresses from a DNS query to choose which to prefer. In my case, it was preferring the v4 addresses because my Wifi interface supports wake-on-LAN aka always-on-always-connected (AOAC), but apparently only for IPv4.

There's an ETW trace point you can enable to find out exactly what is happening when it sorts the addresses; here's an example of how to do that using the built-in netsh tool. I'm using www.google.com as an example, but any host with both A and AAAA records should work.

netsh trace start provider=Microsoft-Windows-TCPIP level=5 keywords=ut:TcpipRoute
ping -n 1 www.google.com
netsh trace stop
netsh trace convert %TEMP%\NetTraces\NetTrace.etl

Now, look in the nettrace.txt file that it wrote, and hopefully you'll find a clue. In my case, it was:

[Microsoft-Windows-TCPIP]IP: Address pair (::ffff:192.168.1.100, ::ffff:74.125.28.99) is preferred over (2601:XXX:XXX:XXX:XXX:XXX:XXX:XXX, 2607:f8b0:400e:c04::67) by SortOptions: 0, Reason: Prefer Aoac Interface  (Rule D 1.1).

(where XXX is my public IPv6 address that I've redacted).

I don't know if there is any way to override this specific rule (now I know why it's making that choice, I'm comfortable enough leaving it as-is).