Re:IPv6 celebrates its 20th birthday by reaching 10% deployment
by danieltillett on Monday January 04, 2016 @08:31AM
(#10835493)
Even if you are blocking at the /64 allocation there are an awful lot of more possible addresses that you need to block than with IPv4.
[ Parent
| on HN ]
Re:IPv6 celebrates its 20th birthday by reaching 10% deployment
by pilif on Monday January 04, 2016 @08:45AM
(#10835565)
You will block many more possible addresses, but you'll still only block one subscriber's network(s) which is exactly equivalent to blocking a v4 NATed address - you block all of their LAN, regardless of which individual device is compromised and which one isn't.
Re:IPv6 celebrates its 20th birthday by reaching 10% deployment
by zAy0LfpBZLC8mAC on Monday January 04, 2016 @08:42AM
(#10835545)
Sure it is, but it's still just a single firewall rule. There isn't really any difference for the firewall whether you block a specific address or some network prefix.