Currently, on my IPv4-only service, users can whitelist their IP address which allows them to bypass email 2-factor authentication when they log in. When they do this we only whitelist that single IP address since it is assumed that each ISP customer gets their own IPv4 address (at least in the United States).
We want to enable IPv6 support, and after research on how IPv6 subnetting works, we figured out we need to whitelist an entire IPv6 subnet, not a single address.
Searching other IPv6 questions on serverfault, there seems to be conflicting information on what subnet is delegated to each ISP end-user. See this answer:
/56: a block of 256 basic subnets. Even though current policies permit ISPs to hand out blocks as large as /48 to every end user and still consider their address utilisation well justified, some ISPs may (and already do) choose to allocate a /56 to consumer-grade customers as a compromise between allocation
/48: a block of 65536 basic subnets and the recommended size of block that every ISP customer end site should receive.
Just based on that answer, there are already 3 conflicting statements on what IPv6 block each user receives:
- /64: a single subnet, likely the most "economical" block to allocate to end-users
- /56: many ISPs already allocate this to each end-user
- /48: the recommended block each end-user should get
So for a service where IP addresses are used for whitelisting, what IPv6 block is appropriate to whitelist? Should I let the user decide? (The users are fairly tech proficient and would know what a subnet is)