3 ms·
This is lovely for end users but for server admin, how do you firewall countries for IPv6 without memory exhaustion?
by ck2 11y ago
This is lovely for end users but for server admin, how do you firewall countries for IPv6 without memory exhaustion?
- paralelogram 11y agohttps://www.arin.net/policy/archive/ipv6_policy.html#34 https://www.arin.net/policy/archive/ipv6_policy.html#34
- api 11y agoYou don't. You fix security more fundamentally instead of doing ham-fisted things like that. IPv6 is going to require that we stop using IP-based hacks as a substitute for actual authentication and robust protocols.
- bluecmd 11y agoYou.. don't track connections? Because why would you?
- marcosdumay 11y agoWhat? Differently from IPv4, IPv6 addresses are strictly hierarchical. You block areas by blocking their root network. Now, why do you need to firewall entire countries again? Are you working at the Great Firewall of China or some similar project?
- worklogin 11y agoHow about working for a company with sensitive defense or financial information, for which access from China/Russia/Ukraine is completely unnecessary? GeoIP blocking is not one's only defense, of course, but it's one of many tools to keep the low-to-mid level groups at bay.
- mhurron 11y agoMy firewall blocks China, a lot of the former Soviet countries and a few others to block spam and other traffic hitting my home network because I have no legitimate reason to be communicating with them. But yes, this type of blocking with IPv6 should be eaiser.
- X-Istence 11y agoYou block the top-level /16 or whatever has been assigned to the regional registry for the region you want to firewall. Instead of multiple IPv4 ranges you will simply block a single IP/netmask ;-) Your firewall rules will actually get smaller!