News for hackers. Stuff that matters.

A comment on Hello IPv6: a minimal tutorial for IPv4 users. Parent comment

Re:Hello IPv6: a minimal tutorial for IPv4 users by iptrans on Thursday October 07, 2021 @11:55AM (#28787981)
Having to do a DNS lookup for each firewall rule is going to suck. Not to mention blackholing traffic when cached DNS replies are out of sync with the actual IP.
[ Parent | on HN ]
Re:Hello IPv6: a minimal tutorial for IPv4 users by admax88qqq on Thursday October 07, 2021 @05:30PM (#28792338)
Doesn't have to be DNS, could be any sort of cache on the router that updates when new hosts come online or the prefix changes.

Plus blackholing temporarily due to a stale cache is better than blackholing permanently due to a stale rule pointing to an old IP.

[ Parent | on HN ]
Re:Hello IPv6: a minimal tutorial for IPv4 users by blibble on Thursday October 07, 2021 @09:51PM (#28794781)
how do client firewalls deal with that?

the don't know the router lost its connection

[ Parent | on HN ]
Re:Hello IPv6: a minimal tutorial for IPv4 users by vetinari on Thursday October 07, 2021 @04:30PM (#28791653)
I can see that there is a user-space daemon, that watches TTLs in the resolved DNS records and if they change, updates an corresponding ip set in the firewall.
[ Parent | on HN ]