First bot on IPv6 for me

[bhukkel]

Hello,

I have IPv6 enabled for a few months now and have havy abuse from 2001:250::/32 (China Education and Research Network). It is the first abuse from IPv6 for me. So i was wonder what to block?

Most providers in Europe give a /64 or /56 IPv6 subnet to hosting customers and /48 to home users. So blocking such range would be ok to block one customer.

Any ideas or experiences with ipv6 blocking in general?

Thanks,

Bill

[incrediBILL]

IPV4 or IPV6, unless you do business in China it should be blocked. Period.

[wilderness]

Here's very brief 2008 example [webmasterworld.com] that may help.

I recall a thread in either in this forum or the Apache forum in which the method to convert IPv4 ranges to IPv6 was discussed.

I've a vague recollection that somebody in another thread provided a URL to either a website or software that does the conversion.

[lucy24]

the method to convert IPv4 ranges to IPv6

IPv4 to IPv6 is trivial.

:: detour to investigate issue, with pause for hilarity thanks to highly-google-ranked site having blatant text-encoding problems ::

Quoting randomly from [isc.sans.edu...] *

IPv4: a.b.c.d translates to IPv6 2002:ab:cd::ab:cd

where :: = :0: = :0000: (this is part of the IPv6 definition)
and a, b, c, d are each converted from decimal to hexadecimal (255 > ff and so on down).

There are probably dozens of online converters, or you can make your own in, at most, five minutes of programming.

Outside of that 2002:a:b:0:a:b range, you can't go in the other direction because there doesn't seem to be anywhere to go to.

By my count, all of IPv4 = 1/2^96 of IPv6. Brrr.


* The ".edu" is more than a little borderline, but that's IANA's call, not mine. Or possibly ARIN. I forget.

[wilderness]

IPv4 to IPv6 is trivial.

Nothing is trivial once you get past ten fingers and toes :)

[bhukkel]

@wilderness thx for the example

My main problem is the size of the IPv6 range to block. With IPv4 home users get one IP address and for business ranges i lookup the info in the whois or routing database. But for IPv6 most providers get a few large blocks and they dont specifiy it in the whois database.

[keyplyr]

But for IPv6 most providers get a few large blocks and they dont specifiy it in the whois database.

That should start changing, albeit slowly but as larger sections of the WWW switch to IPv6, so shall all the services that document them.