IPv6 and ban by IP address?

Question

Computer networks

In connection with the gradual transition to IPv6, there are questions about the uniqueness of the IP address. As you know, now a lot is tied to the IP address (v4): the ability to ban the offender on the forum, for example, is quite limited - the offender can be behind NAT, by banning one, you can ban all the rest of his "neighbors". Therefore, this measure is used in extreme cases. And what will happen in the case of the ubiquitous distribution of v6? Will it be possible to easily ban violators, repel DDoS attacks, etc.? After all (as far as I understand), the site will have access to a real user IP that does not affect other users from the same network. Or will they still have some way to get around this limitation? Moreover, if they can assign themselves an IP address, it will be almost impossible to ban them (without knowing their subnet)?

Answer 1

More to the point, there are IPv6 privacy extensions that are enabled on all systems by default. The system assigns temporary, correct, random IPv6 addresses to the interface, which are used to establish connections for an hour, after which the address is declared obsolete and the next random one is assigned. Those. any IPv6 user looks like a constantly changing address within his network.
So if you need to ban someone by address in this way, you will have to ban him by subnet, just like now in the case of IPv4 NAT, the entire network will be blocked due to one freak.

Answer 2

With the introduction of IPv6, NATs are not going anywhere, the only thing that can change is that ISPs can stop issuing dynamic IPs. there are enough ranges for everyone

Answer 3

I've been using IPv6 for a year now, probably three. Of course, these are all non-native addresses, but either through a broker tunnel or through 6to4.
In any case, RIPE strongly recommends issuing /64 to the end client. In the real world, they issue either one /64 or two /64 (so that routing can be simply configured, in fact, one /64 is enough, and in LAN, route through link-local addresses), or something larger, /60 or /56. Finding out which range is given to the client is somewhat problematic, there is only logic and intuition, and, well, googling for the provider. Therefore, you need to ban all /64 at once.

Answer 4

It's too early for you to think about it, I think. When the time comes, there will be recipes on blogs, and everything you need.