> There's no way to lock out after N failures or even to rate limit attempts.

Given it’s a single machine with a /80, couldn’t the machine rate limit attempts to any IP in the /80? Ie rate limit by source, and separately rate limit by destination. Cover both bases.

The way I understood it, only the correct IP address would even be connected to anything, the rest would just fail. You probably could do something like that, yeah.

Good point, just had a look at the code. The NF queue will receive packets from all IPs in the /80 and they are all processed and validated by the ghost program that reads from the queue. So it could do the rate limiting there with full visibility.

https://github.com/aidansteele/ipv6-ghost-ship/blob/main/mai...

A /80 prefix is equivalent to 65536 ipv4 Internets. Not so brute-forceble.

The random part is six digits. I'd say pretty brute-forceable.

The TOTP spec (rfc6238) allows up to 10 digits or 10 billion unique values, a bit bigger than IPv4's space.

Running anything like fail2ban on IP address misses would stop brute forcing in its tracks.

Both good ideas.

None of this fixes even a passive mitm attack, but it's still better.