I'm converting my good old IPV4 based iptables firewall script and would like to substitute the CLASS A/B/C/D/E reserved address spaces to the ones found in IPV6. My goal is to deny any packets that originate from these addresses, since these cannot reach the public net, so they must be spoofed.

I have found these so far, are there any more reserved spaces, where no data could come towards an IPV6 webserver?

Loopback ::1

Global Unicast (currently) 2000::/3

Unique Local Unicast FC00::/7

Link Local Unicast FE80::/10

Multicast FF00::/8

3 Answers 3

  • ::/8 - Reserved - deprecated IPv4 Compatible is ::/96
  • 0200::/7 - Reserved
  • 0400::/6 - Reserved
  • 0800::/5 - Reserved
  • 1000::/4 - Reserved
  • 2001:db8::/32 - Documentation
  • 2002::/24 - 6to4
  • 2002:0a00::/24 - 6to4
  • 2002:7f00::/24 - 6to4
  • 2002:a9fe::/32 - 6to4
  • 2002:ac10::/28 - 6to4
  • 2002:c000::/40 - 6to4
  • 2002:c0a8::/32 - 6to4
  • 2002:c612::/31 - 6to4
  • 2002:c633:6400::/40 - 6to4
  • 2002:cb00:7100::/40 - 6to4
  • 2002:e000::/20 - 6to4
  • 2002:f000::/20 - 6to4
  • 4000::/3 - Reserved
  • 6000::/3 - Reserved
  • 8000::/3 - Reserved
  • a000::/3 - Reserved
  • c000::/3 - Reserved
  • e000::/4 - Reserved
  • f000::/5 - Reserved
  • f800::/6 - Reserved
  • fc00::/7 - Unique Local
  • fe00::/9 - Reserved
  • fe80::/10 - Link Local
  • fec0::/10 - Site Local (deprecated, RFC3879)
  • ff00::/8 - Multicast

See RFC 5156 and IANA's reservation list for reference.

  • 2
    IANA also maintains a list of reserved prefixes (with RFC references) at iana.org/assignments/ipv6-address-space/ipv6-address-space.xml
    – voretaq7
    Dec 30, 2011 at 18:41
  • @voretaq7 I found a few more to add, too. Made this answer a community wiki - edit away. Dec 30, 2011 at 18:48
  • 2
    technically speaking, the 6to4 list is incomplete: any IPv4 address that is currently a bogon should also be treated as such in 6to4 form. If full bogon filtering is important to you, you should check out the Team Cymru bogons list.
    – Olipro
    Dec 30, 2011 at 20:35

Do not block arbitrary IPv6 addresses without really knowing what you are doing. Stop, this is bad practice. This will certainly break your connectivity in ways you didn't expect. Some time later, you will see that your IPv6 doesn't behave correctly, then you will start blaming that "IPv6 doesn't work", etc.

Whatever your ISP is, your edge router already knows what packets it can send to you and what packets to accept from you (your concern about spoofed addresses is totally baseless), and your operating system also knows what to do with the rest. Whatever you read about writing firewall rules 15 or so years ago doesn't apply today anymore.

Nowadays, whenever you receive a packet from an address in any of these ranges you are intending to block, it is much more likely to be a legitimate packet that you are incorrectly blocking than any sort of attack. The people who manage the backbone of the Internet have a lot more experience than you, and they already did their homework properly.

Also, the list of reserved blocks and what to expect from each of them is not set on rock. They change over time. Whatever expectations you have today will not be the same tomorrow anymore, then your firewall will be wrong and breaking your connectivity.

Firewalls are supposed to protect and monitor what is on the inside of your network. The outside is an always-changing jungle.

  • 1
    You're saying that a packet with a source address from an invalid or private range is more likely to be legitimate than not? That doesn't exactly fit with the real world, I'm sorry to say; trusting every ISP all over the world to do reverse path checking or filtering of their peers' source addresses against spoofed traffic on your behalf is naive. Judging by the amount of unicast traffic with spoofed sources that I see on firewalls every day, I really don't think this is a concern of decades ago. And we should all be long dead before 2000::/3 runs out of free space.. Dec 31, 2011 at 19:59
  • Yep, the devil never sleeps :).
    – Jauzsika
    Jan 1, 2012 at 4:23
  • 1
    See for example, tools.ietf.org/html/draft-fuller-240space-02 . Now everybody who special-cased 240/4 is in theoretical trouble.
    – jørgensen
    Jan 3, 2012 at 1:11

You've basically got it. There was also an RFC for site-local addresses in fec0::/10 but this has been deprecated. The idea with IPv6 is that NAT is no longer needed, therefore even globally-routable addresses can be used on an internal network. You simply configure your firewall to block, as appropriate.

By the way, even in IPv4-land classes are not referred to anymore. CIDR is used instead.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .