1

For IPv4 I have a rule that blocks the VPNs to access the local addresses like this:

:PRIVATE_ADDRS_FILTER - [0:0]
-A PRIVATE_ADDRS_FILTER -d 10.0.0.0/8 -j DROP
-A PRIVATE_ADDRS_FILTER -d 172.16.0.0/12 -j DROP
-A PRIVATE_ADDRS_FILTER -d 192.168.0.0/16 -j DROP
-A FORWARD -j PRIVATE_ADDRS_FILTER

Is this how I would do it for IPv6? (based on this source)

:PRIVATE_ADDRS_FILTER - [0:0]
-A PRIVATE_ADDRS_FILTER -d fc00::/7 -j DROP
-A PRIVATE_ADDRS_FILTER -d fc00::/8 -j DROP
-A PRIVATE_ADDRS_FILTER -d fd00::/8 -j DROP
-A FORWARD -j PRIVATE_ADDRS_FILTER
Houman
  • 1,545
  • 4
  • 22
  • 36

1 Answers1

0

Just fc00::/7 contains all of ULA. Simplify by deleting the /8s.

John Mahowald
  • 32,050
  • 2
  • 19
  • 34