Re: [v6ops] (IETF I-D): Implications of IPv6 Addressing on Security Operations (Fwd: New Version Notification for draft-gont-opsec-ipv6-addressing-00.txt)

[Simon <[e-mail]>]

Fernando Gont <[e-mail]> wrote:

> FYI, this one is targeted at opsec, but might be of interest to this group:
> 
> * TXT: https://www.ietf.org/archive/id/draft-gont-opsec-ipv6-addressing-00.txt
> * HTML: https://www.ietf.org/archive/id/draft-gont-opsec-ipv6-addressing-00.html

Interesting read. However, I think a few places are perhaps a little misleading.

One is discussing blocking a whole /64, and that it will probably block other (innocent) hosts on the same network. This isn’t really any different to the world of IPv4 where blocking a single address will most likely block all hosts in a network behind a NAPT gateway. To an extent, I can see that treating a /64 in much the same way as a /32 in the IPv4 world will become commonplace for the reasons you mention.
I’ve definitely dealt with the situation where the email for a whole office keeps going down because one device was misconfigured and kept triggering fail2ban on our servers.

As for fail2ban (as mentioned by Henri) and similar techniques. I can see scope (though I suspect there isn’t a ready-written module to do it) for banning by individual IP and escalating to banning the whole /64 if multiple addresses get banned. That would deal with the “attack till banned, then move” approach - but as mentioned, won’t stop a more stealthy attack of “attack and keep moving before the ban kicks in”. To deal with the latter would probably need a different filter to aggregate failures by /64 and ban the whole /64 if triggered.
So I think there is certainly scope, at the expense of more complicated rules, to be more nuanced with fail2ban (or similar) in the IPv6 world.


Simon