Re:Enabling IPv6 support for GitHub Pages
by BenjiWiebe on Thursday September 30, 2021 @11:11PM
(#28714051)
Please don't block ttl exceeded packets... It will cause some very hard to troubleshoot network issues for someone somewhere sometime.
Amen, brother. Someone like your CEO at somewhere like his lake house at the end of a dodgy DSL line from Cletus's ISP and Bait Shop.
I kid, I kid...they didn't sell bait.
There are a lot of unpleasant failure modes to blocking ICMP without completely understanding the implications.
Re:Enabling IPv6 support for GitHub Pages
by throw0101a on Friday October 01, 2021 @09:02AM
(#28717885)
I agree… but some folks seem to think blocking ping and traceroute give you some kind of extra security.
If you wish to do this with IPv6 you can with ULA and NPTv6:
* https://en.wikipedia.org/wiki/Unique_local_address
* https://en.wikipedia.org/wiki/IPv6-to-IPv6_Network_Prefix_Tr...
> 3. All those ICMPv6 messages sniffing (and snooping?) really don't fill me with joy joy happiness.
For those wondering: ping works by sending ICMP(v4) echo request packets. If you wish to block v4 ping you block echo requests (Type 8) and echo replies (Type 0):
* https://en.wikipedia.org/wiki/Internet_Control_Message_Proto...
ping6 works by sending ICMP(v6) echo request packets. In IPv6-land block Types 128 and 129:
* https://en.wikipedia.org/wiki/Internet_Control_Message_Proto...
To block traceroute block Types 11 (v4) and 3 (v6): TTL/hop exceeded notifications.
> IPv6 really does feel like a Godzillian monstrosity and a chore to type in: double colons between every number and it's in Hex? At least with IPv4 you can type the numbers in pretty rapidly on a numpad.
We've run out of IPv4 addresses. We need a larger address space with more bits. More bits mean more typing. Get over it? ¯\_(ツ)_/¯