Does Discourse handle blocking of IPv6 okay?

Product Support

AI-generated summary

A user, 1101010, is experiencing issues with a troll who frequently returns with different IPv6 addresses. They noticed that the Screened IPs feature only shows partial IPs, but editing the entry reveals the full IP with a /128 suffix. 1101010 wonders if they can block the troll’s IPv6 range using a mask.

codinghorror explains that repeated spam blocks will automatically roll up IP address blocks to larger subnets for IPv4, but is unsure about IPv6. zogstrip confirms that IPv6 blocks were not tested.

supermathie successfully tested blocking an IPv6 range, but notes that there are issues with search and column width. They also propose a solution for automatic roll-up of IPv6 blocks. 1101010 thanks the respondents and shares their own experience with attempting to block the troll’s IPv6 range.

1

We’ve got a troll who keeps coming back and it’s true that he has a new IP each time but it’s relatively easy for me to spot him and stop him based on his location coming up and his style. Mostly he has IPv6 IPs

What I noticed was that Screened IPs shows a couple of his:

image
image833×421 25.5 KB

But they’re not the full IP. When I put 2001 into the Search box on the top right it brings up nothing, whereas if I do, say, ‘81’, I get a couple of IPv4s come up.

Anyway, all of his IPv6 addresses begin
2001:2012:208:2a00
so I’d like to do a block mask on that basis but I’m not sure if masks are possible but I assume they are. However, since the full IP isn’t showing on this screen I wasn’t sure what that meant in terms of doing such a block?

Thanks

2

Apologies, if I click to edit I see the full IP with a /128 at the end, so maybe I can mask ban?

3

Yes, in fact repeated spam blocks will automatically roll up IP address blocks to increasingly large subnets, such as 255.255.255.* and 255.255.*.*

I’m not sure what this code does with IPv6 though.. cc @mpalmer @zogstrip

4

I reckon I didn’t test IPv6 blocks. Added to my list.

5

I can confirm that if you add a block for an IPv6 range (e.g. 2001:2012:208:2a00::/64) it’ll work as expected:

image

but we do need to fix search and the column width.

As for the automatic roll-up, we probably want to do something like:

  • if we have ≥3 blocks in the same IPv6 /64, then summarize to blocking that /64
6

Thanks a lot for this.

I did briefly try one with four stars in between the remaining colon blocks and /128 at the end but it was rejected as in error.