3 ms·
Even if you are blocking at the /64 allocation there are an awful lot of more possible addresses that you need to block than with IPv4.
by danieltillett 11y ago
Even if you are blocking at the /64 allocation there are an awful lot of more possible addresses that you need to block than with IPv4.
- zAy0LfpBZLC8mAC 11y agoSure it is, but it's still just a single firewall rule. There isn't really any difference for the firewall whether you block a specific address or some network prefix.
- pilif 11y agoYou will block many more possible addresses, but you'll still only block one subscriber's network(s) which is exactly equivalent to blocking a v4 NATed address - you block all of their LAN, regardless of which individual device is compromised and which one isn't.