6 ms·
FYI it's pretty common to get a /48 or a /56 from a data center, or /60 from Comcast.
by aftbit 2y ago
FYI it's pretty common to get a /48 or a /56 from a data center, or /60 from Comcast.
- hot_gril 2y agoMaybe the only equivalent is to penalize a /32, since there are roughly as many of those as there are ipv4 addresses.
- aftbit 2y agoMy ISP has a /28 block, so if they chose to penalize my /32 for some reason, that would include 1/16th of the customers of my ISP. Just guessing based on population and situation, that might include on the order of 50000 people.
- janosdebugs 2y agoThat may be true mathematically, but there are no guarantees that a small provider won't end up having only a single /64, which would likely be the default unit of range-based blocking. Yes, it "shouldn't" happen.
- hot_gril 2y agoRight. It's analogous to how blocking an ipv4 is unfair to smaller providers using cgnat. But if someone wants to connect to your server, you might want them to have skin in the game.
- janosdebugs 2y agoThe provider doesn't care, the owner of the server who needs to log in from their home internet at 2AM in an emergency cares. Bad actors have access to botnets, the server admin doesn't.
- hot_gril 2y agoUnfortunately the only answer is "pay to play." If you're a server admin needing emergency access, you or your employer should pay for an ISP that isn't using cgnat (and has reliable connectivity). Same as how you probably have a real phone sim instead of a cheap voip number that's banned in tons of places. Or better yet, a corp VPN with good security practices so you don't need this fail2ban-type setup. It's also weird to connect from home using password-based SSH in the first place.
- AnthonyMouse 2y agoThe better answer is to just ignore dull password guessing attempts which will never get in because you're using strong passwords or public key authentication (right?). Sometimes it's not a matter of price. If you're traveling your only option for a network connection could be whatever dreck the hotel deigns to provide.
- hot_gril 2y agoEven with strong passwords, maybe you don't want someone attempting to authenticate so quickly. Could be DoS or trying to exploit sshd. If you're traveling, cellular and VPN are both options. VPN could have a similar auth dilemma, but there's defense in depth. Also it's unlikely that your hotel's IP address is spamming the particular SSH server you need to connect to.
- AnthonyMouse 2y ago> Even with strong passwords, maybe you don't want someone attempting to authenticate so quickly. Could be DoS or trying to exploit sshd. DoS in this context is generally pretty boring. Your CPU would end up at 100% and the service would be slower to respond but still would. Also, responding to a DoS attempt by blocking access is a DoS vector for anyone who can share or spoof your IP address, so that seems like a bad idea. If someone is trying to exploit sshd, they'll typically do it on the first attempt and this does nothing. > Also it's unlikely that your hotel's IP address is spamming the particular SSH server you need to connect to. It is when the hotel is using the cheapest available ISP with CGNAT.
- dfox 2y agoYou cannot reasonably build an ISP network with single /64. RIPE assigns /32s to LIRs and LIRs are supposed to assign /48s downstream (which is somewhat wasteful for most of kinds of mass-market customers, so you get things like /56s and /60s).
- hot_gril 2y agoWhat if it uses NAT v6 :D
- 1oooqooq 2y agoi cannot tell if facetious or business genius.
- hot_gril 2y agoWell seriously, I remember AT&T cellular giving me an ipv6 behind a cgnat (and also an ipv4). Don't quote me on that though.
- pantalaimon 2y agoThat’s what Azure does. They also only allow a maximum of 16(!) IPv6 addresses per Host because of that.
- janosdebugs 2y agoAs I said, "should". In some places there will be enough people in the chain that won't be bothered to go to the LIR directly. Think small rural ISPs in small countries.
- deleted 2y ago[deleted]
- Sanzig 2y agoWell, allocating anything smaller than a /64 to a customer breaks SLAAC, so even a really small provider wouldn't do that as it would completely bork their customers' networks. Yes, DHCPv6 technically exists as an alternative to SLAAC, but some operating systems (most notably Android) don't support it it all.
- tsimionescu 2y agoThere are plenty of ISPs that assign /64s and even smaller subnet to their customers. There are even ISPs that assign a single /128, IPv4 style.
- cereal_cable 2y agoI can't imagine why any ISP would do such absurd things when in my experience you're given sufficient resources on your first allocation. My small ISP received a /36 of IPv6 space, I couldn't imagine giving less than a /64 to a customer.
- patmorgan23 2y agoWe should not bend over backwards for people not following the standard. Build tools that follow the standard/best practices by default, maybe build in an exception list/mechanism. IPv6 space is plentiful and easy to obtain, people who are allocating it incorrectly should feel the pain of that decision.
- dheera 2y agoI can never remember whether /x means "the last x bits are 0" or "the first x bits are 1" People should write 80/48 or 48/80 to be clear
- patmorgan23 2y ago/x is almost always the number of network bits (so the first half). There are some Cisco ISO commands that are the opposite but those are by far the minority. 99/100 it means the first bits.
- merlincorey 2y ago> I can never remember whether /x means "the last x bits are 0" or "the first x bits are 1" > People should write 80/48 or 48/80 to be clear The clarity is found implied in your preferred example. - "80/" would mean "80 bits before" - "/48" would mean "48 bits after"
- dheera 2y ago... and this is the opposite of the other 2 responses
- immibis 2y agoIt's not about how many bits are 1 - it's about how many bits are important. And the first bits are always most important. So it's the first x bits. If you have a /48 then 48 bits are used to determine the address is yours. Any address which matches in the first 48 bits is yours. If you have a /64, any address which matches in the first 64 bits is yours.
- patmorgan23 2y agoIt's about how many bits are 1, in the subnet mask.
- immibis 2y agoThe number of bits that are important is the number of 1 bits in the which bits are important mask, yes. I thought you couldn't remember how that mask worked.
- adraenwan 2y agorelated: https://adam-p.ca/blog/2022/02/ipv6-rate-limiting/ https://adam-p.ca/blog/2022/02/ipv6-rate-limiting/