Score:0

Server

Block an IPv6 Address where only whitelisting is available

Tom

5/23/24, 12:09 PM

Came across a use case where I need to block an IPv6 address from accessing a site. It is fairly simple to block an IPv4 address by skipping the specific address from the whitelist range. Does any one know how to do a similar thing with the IPv6 address or is it even possible?

PS: Whitelisting is the only option I have, no blacklisting option. I am not very good with the networking concepts of IPv6 address so please consider the question as a newbie question. I can edit the question to include more details to make the question more comprehensible. I am using Salesforce experience cloud sites to set more context to the question.

1 + 1

ipv6

ip-blocking

whitelist

vidarlo

5/23/24, 3:47 PM

That's probably not doable.

Score:1

Server

Gal Weiss

5/23/24, 9:22 PM

Its probably doable, but it would probably require about 64 whitelist rules to block a certain address.

So before you are going there, I would ask myself if there is a better way to do it, for example - implement this filtering somewhere else along the way. if you have control on a proxy along the way or the service itself and add some specific logic to the service.

Assuming you have to, I would start by saying that you are probably safe by blocking the entire /64 subnet to which the blocked IP belongs, so if your blocked IPv6 address is 2001:4860:4860::8888 you can be safe with blocking 2001:4860:4860:0000/64 (normally written as 2001:4860:4860::/64) The reason is that /64 subnets are normally the smallest subnet that is used to represent a physical site (NAT is not needed for IPv6), so anything else within this site is safe to block.

You can also reduce your problem to allow only the 2000::/3 (everything that start with hex digit 2 or 3) because these are all the Global Unicast addresses (Read here about GUA addresses)

So basically you want to allow everything in 2000::/3 apart from 2001:4860:4860::/64

The remaining problem is not related to IPv6, its more about binary arithmetics. you need to do something like this: for simplicity, let's say we have an 8 bit address that is 0x34 which we want to block but allow the remaining address space, 0x34 is binary 0011:0100b. So here is a procedure to do that:

let's mark the whole 8 bit space as xxxx:xxxx we split it to two:

0xxx:xxxx
1xxx:xxxx

0011:0100 belongs to (1), so we can allow the complete 1xxx:xxxx

now we have a problem with 0xxx:xxxx, split that to get

00xx:xxxx << blocked number is here
01xx:xxxx

so we can also allow 01xx:xxxx

and again, the problem i not 00xx:xxxx, split that to get

000x:xxxx
001x:xxxx << blocked number is here

so we can allow 000x:xxxxx

and so on until you are left with exactly the blocked address.

+ 3

Dubu

5/26/24, 10:05 AM

I like your idea with the binary unblocking (although it does really not scale well if you have multiple addresses to blacklist), so have an upvote. But I disagree with the notion that "/64 subnets normally represent a physical site." A /64 is the smallest "normal" subnet in IPv6, and a site _should_ be a /48, but can be smaller, like /56 or even /60 (for residential sites). Whoever gets a single /64 for their home network from their ISP should complain.

Gal Weiss

5/26/24, 5:18 PM

@Dubu, thanks for the clarification, that's a fair point, what I meant to say is that a single site would be represented by *at least* a /64 network, since the solution I propose becomes simpler the larger the site you are looking to block. so the solution will take at most 60-61 whitelist rules for a single site blocked. It doesn't scale very well of course, since this is a terrible way to implement blocking. The only reason I went with suggesting a solution is because vidarlo wrote that this is probably not doable, So I thought "hmm .... challenge accepted" :) I'll fix my answer.

Tom

6/30/24, 7:01 AM

@GalWeiss Thank you for the suggestions, I think that might work maybe for cases where we have proxy, not quite sure. Although for my specific use case in Salesforce we don't have a way to use proxy - was checking this and hence the delay for response. Also, adding so many (64 whitelist) won't be feasible. So in summary I would conclude it is not doable.

Elon Musk

I sit in a Tesla and translated this thread with Ai:

EN: Block an IPv6 Address where only whitelisting is available

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.