Re: prefix len confusion

On Wed, 10 Jun 2026, at 5:33 PM, Randy Bush wrote:
>> table ip raw {
>>     chain PREROUTING {
>>         type filter hook prerouting priority raw;
>>         ip daddr 42.642.11.82 tcp dport 22 meta nftrace set 1
>>     }
>> }
>> 
>> 
>> Next, run "nft monitor trace".
>
> thanks a million.  this showed pretty conclusively that the
> `/etc/nftables.conf` was indeed correct and filtering as one
> would hope/expect.  and i learned a new hack!
>
> so we are now looking for more subtle attack surface, e.g. loose
> source routing, bouncing off a legitimately open service on the
> same LAN, etc.
>
> we also see this (distributed source) attack on proxmox clusters' web
> interfaces
>
>     2026-06-07T02:01:39.274405+00:00 pv0 pvedaemon[2276]: 
> authentication failure; rhost=::ffff:85.11.167.7 user=root@pam 
> msg=Authentication failure
>     2026-06-07T02:01:42.970943+00:00 pv0 pvedaemon[2277]: 
> authentication failure; rhost=::ffff:85.11.167.7 user=root@pam 
> msg=Authentication failure
>
> can we safely just add ffff::0 to the v6 bogon list?

It's an IPv4 address being logged in the form of an IPv4-mapped IPv6 address. If you wish to block it, consider it as an ordinary IPv4 address (85.11.167.7). Your BOGONS6 variable does not need to be adjusted.

For that reason, you should also be able to observe the packet(s) if you add a suitable tracing rule to the existing PREROUTING chain. That is, unless it is bridged traffic or does not traverse the firewall (as discussed previously).

--
Kerin Millar