Re: prefix len confusion

On Wed, 10 Jun 2026, at 6:19 PM, Randy Bush wrote:
>>> we also see this (distributed source) attack on proxmox clusters' web
>>> interfaces
>>>
>>>     2026-06-07T02:01:39.274405+00:00 pv0 pvedaemon[2276]: 
>>> authentication failure; rhost=::ffff:85.11.167.7 user=root@pam 
>>> msg=Authentication failure
>>>     2026-06-07T02:01:42.970943+00:00 pv0 pvedaemon[2277]: 
>>> authentication failure; rhost=::ffff:85.11.167.7 user=root@pam 
>>> msg=Authentication failure
>>>
>>> can we safely just add ffff::0 to the v6 bogon list?
>> 
>> It's an IPv4 address being logged in the form of an IPv4-mapped IPv6
>> address. If you wish to block it, consider it as an ordinary IPv4
>> address (85.11.167.7).
>
> if nft treats it as an ipv4 addy, then the ipv4 filters should have
> blocked, n'est-ce pas?
>
>     tcp dport 8006 ip daddr $PROX4 drop

Assuming the packets arrive at $IFACE, that pv0 resides within $PROX4 and so on and so forth.

-- 
Kerin Millar