dslreports logo
 
    All Forums Hot Topics Gallery
spc
Search similar:


uniqs
733

timcuth
Braves Fan
Premium Member
join:2000-09-18
Pelham, AL
Technicolor ET2251

timcuth

Premium Member

[ipv6] Another ipv6 firewall question

I have two ipv4 firewall rules that I need to implement for ipv6, also. But I have no idea how to identify the v6 address ranges or to specify them in ipv6 notation.

173.194.55.0/24
206.111.0.0/16

How do I go about doing this?

Tim

Cabal
Premium Member
join:2007-01-21

1 recommendation

Cabal

Premium Member

Re: [ipv6] Another ipv6 firewall question

You'll need to know the IPv6 ranges to implement filtering for. They are (almost always) unrelated to the IPv4 assignments.

The actual syntax should be fairly similar, firewall-depending.

leibold
MVM
join:2002-07-09
Sunnyvale, CA
Netgear CG3000DCR
ZyXEL P-663HN-51

2 recommendations

leibold to timcuth

MVM

to timcuth
173.194.55.0/24 is a small chunk out of a larger IPv4 block allocated to Google in AS15169 (Google has other IPv4 blocks as well and also multiple AS numbers).

Of the two IPv6 blocks assigned to Google, 2001:4860::/32 is in the same AS and therefore likely to contain the block you are looking for. However short of asking Google, I do not know how you can narrow down that /32 to the narrower subset that you may be interested in.

It is also worth noting that the second IPv6 block assigned to Google (2607:F8B0::/32) is in AS15169 as well as AS22577. Therefore the block you are looking for could also be in this 2nd range (or the servers could be multihomed in both ranges).

AS15169 is Google itself while AS22577 is for their mobile ads network.
leibold

1 edit

1 recommendation

leibold to timcuth

MVM

to timcuth
206.111.0.0/16 is just one out of many IPv4 blocks allocated to ISP XO Communications.

Since XO Communications has only a single IPv6 block assigned to it your target block is somewhere in 2610:18::/32

Once again, I'm not aware of any way to narrow that down without contacting XO Communications.
leibold

1 recommendation

leibold to timcuth

MVM

to timcuth
said by timcuth:

How do I go about doing this?

While it is not an exact science (as Cabal See Profile correctly states there is no requirement for IPv6 assignments to be related to prior IPv4 assignments), what you can do is looking up ownership and possibly associated AS numbers for a given IPv4 block by contacting the relevant IP number registry (www.arin.net for North America).

You can then check the IPv6 address assignments to the same owner. There is a high probability that any dual-stack servers (those with both IPv4 and IPv6 addresses) can be found within those IPv6 blocks.

You didn't explain why you have filter rules for those specific address blocks (and perhaps you chose them for illustration only) but there may be other addresses you may have to filter in addition to any new IPv6 addresses that may get assigned to those blocks.
Depending on your exact scenarios and security needs you may also have to block IPv6 addresses that embed those IPv4 address in various address translation and IPv4 to IPv6 transition schemas (e.g. Teredo, 6to4).

timcuth
Braves Fan
Premium Member
join:2000-09-18
Pelham, AL
Technicolor ET2251

timcuth

Premium Member

This is about how I figured things would be. IPv6 blocks are so huge, it is probably a black art to figure out what I need, if it's even possible. Almost certainly over my head.

All I am trying to do is get better performance for Youtube streaming. A widely suggested workaround is to block those IP ranges. It wasn't working for me and I was at a loss. Then it dawned on me that my system is probably getting to them via IPv6, defeating the workaround. Hence my question.

The odd thing about the big picture (Youtube performance) is that my sons can stream the same videos that give my system fits to their Macbook Pros on the same LAN, with no hiccups at all. On my Debian Linux system, they either go in fits and starts, or they stop altogether.

Thanks, everyone. We can probably just let this thread die.
quesix
join:2005-12-19
Cary, IL

quesix to timcuth

Member

to timcuth
if using Firefox can force video sites to use Ipv4 like so:

add these to firefox "about:config" search "ipv" for "network.dns.ipv4OnlyDomains", change "" to "youtube.com,netflix.com" etc...

timcuth
Braves Fan
Premium Member
join:2000-09-18
Pelham, AL

timcuth

Premium Member

Cool! Thanks, quesix See Profile

Tim