Remix.run Logo
cogman10 a day ago

IDK for sure, but might be harder to maintain, monitor, and block.

One characteristic of v4 is it's somewhat reasonable to do a straight forward block on a range of addresses to shut down access. This is still somewhat possible with v6, but harder as there's simply a much larger portion of ip addresses that can be all over the place. It's theoretically a lot easier for anyone that wants to bypass a simple filter to grab a new public IP address.

toast0 a day ago | parent | next [-]

Otoh, ipv6 address assignment tends to be much more contiguous. My (small) residential ISP has one v6 prefix but several v4 prefixes. If you block the whole prefix for services you don't like, it's far less prefixes for v6.

But, it is a new skill, and you can turn off v6 at small cost if you're already ok with heavily restricting v4.

sva_ a day ago | parent | prev | next [-]

Additionally to the much larger IP space, you also have larger headers and additionally extension headers which make deep packet inspection computationally much more expensive if you consider the scale

miyuru a day ago | parent | prev | next [-]

>One characteristic of v4 is it's somewhat reasonable to do a straight forward block on a range of addresses to shut down access. This is still somewhat possible with v6, but harder as there's simply a much larger portion of ip addresses that can be all over the place. It's theoretically a lot easier for anyone that wants to bypass a simple filter to grab a new public IP address.

no its not, its easier to block IPv6 ranges than IPv4 ones.

if someone want be block my ISP, they only need a single /32 rule with v6.

iso1631 a day ago | parent | prev [-]

n ipv4 /32 is roughly equivalent to an ipv6 /56 or /64

You'd typically block an AS - i.e. every IP originating from AS12345. That's just as easy on v6 as v4.