0

Came across a use case where I need to block an IPv6 address from accessing a site. It is fairly simple to block an IPv4 address by skipping the specific address from the whitelist range. Does any one know how to do a similar thing with the IPv6 address or is it even possible?

PS: Whitelisting is the only option I have, no blacklisting option. I am not very good with the networking concepts of IPv6 address so please consider the question as a newbie question. I can edit the question to include more details to make the question more comprehensible. I am using Salesforce experience cloud sites to set more context to the question.

Improve this question
1
  • That's probably not doable.
    – vidarlo
    May 23 at 15:47

1 Answer 1

Reset to default
1

Its probably doable, but it would probably require about 64 whitelist rules to block a certain address.

So before you are going there, I would ask myself if there is a better way to do it, for example - implement this filtering somewhere else along the way. if you have control on a proxy along the way or the service itself and add some specific logic to the service.

Assuming you have to, I would start by saying that you are probably safe by blocking the entire /64 subnet to which the blocked IP belongs, so if your blocked IPv6 address is 2001:4860:4860::8888 you can be safe with blocking 2001:4860:4860:0000/64 (normally written as 2001:4860:4860::/64) The reason is that /64 subnets are normally the smallest subnet that is used to represent a physical site (NAT is not needed for IPv6), so anything else within this site is safe to block.

You can also reduce your problem to allow only the 2000::/3 (everything that start with hex digit 2 or 3) because these are all the Global Unicast addresses (Read here about GUA addresses)

So basically you want to allow everything in 2000::/3 apart from 2001:4860:4860::/64

The remaining problem is not related to IPv6, its more about binary arithmetics. you need to do something like this: for simplicity, let's say we have an 8 bit address that is 0x34 which we want to block but allow the remaining address space, 0x34 is binary 0011:0100b. So here is a procedure to do that:

let's mark the whole 8 bit space as xxxx:xxxx we split it to two:

  1. 0xxx:xxxx
  2. 1xxx:xxxx

0011:0100 belongs to (1), so we can allow the complete 1xxx:xxxx

now we have a problem with 0xxx:xxxx, split that to get

  1. 00xx:xxxx << blocked number is here
  2. 01xx:xxxx

so we can also allow 01xx:xxxx

and again, the problem i not 00xx:xxxx, split that to get

  1. 000x:xxxx
  2. 001x:xxxx << blocked number is here

so we can allow 000x:xxxxx

and so on until you are left with exactly the blocked address.

Improve this answer
3
  • I like your idea with the binary unblocking (although it does really not scale well if you have multiple addresses to blacklist), so have an upvote. But I disagree with the notion that "/64 subnets normally represent a physical site." A /64 is the smallest "normal" subnet in IPv6, and a site should be a /48, but can be smaller, like /56 or even /60 (for residential sites). Whoever gets a single /64 for their home network from their ISP should complain.
    – Dubu
    May 26 at 10:05
  • @Dubu, thanks for the clarification, that's a fair point, what I meant to say is that a single site would be represented by at least a /64 network, since the solution I propose becomes simpler the larger the site you are looking to block. so the solution will take at most 60-61 whitelist rules for a single site blocked. It doesn't scale very well of course, since this is a terrible way to implement blocking. The only reason I went with suggesting a solution is because vidarlo wrote that this is probably not doable, So I thought "hmm .... challenge accepted" :) I'll fix my answer.
    – Gal Weiss
    May 26 at 17:18
  • @GalWeiss Thank you for the suggestions, I think that might work maybe for cases where we have proxy, not quite sure. Although for my specific use case in Salesforce we don't have a way to use proxy - was checking this and hence the delay for response. Also, adding so many (64 whitelist) won't be feasible. So in summary I would conclude it is not doable.
    – Tom
    Jun 30 at 7:01

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .