As a side note, there are now *TWO* documentation prefixes:
-éric
From: Rinse Kloek <rinse@kindes.nl>
Date: Sunday, 6 October 2024 at 17:15
To: ipv6-wg@ripe.net <ipv6-wg@ripe.net>
Subject: [ipv6-wg] Re: BCP/BCOP for ipv6 deployment and filtering policy
This RIPE Security PDF is also a good starting point:
https://www.ripe.net/media/documents/IPv6Security-Slides.pdf
It advises blocking ICMP Type 137 (Redirect) and Type 138 (Route Renumbering). The other types should not be blocked; however, some prefer to rate limit Echo requests/replies (Type 128 and 129). You may want to rate limit these
types of requests to your infrastructure nodes or handle them in the control plane on your nodes.
Additionally, at the ISP level, you could implement some ingress ACLs such as:
·
Block everything to documentation address space (RFC3849):
deny ipv6 any 2001:db8::/32 icmp-off
·
Block everything to benchmarking address space (RFC5180):
deny ipv6 any 2001:2::/48 icmp-off
·
Block everything to Automatic Multicast Tunneling (RFC7450):
deny ipv6 any 2001:3::/32 icmp-off
·
Block everything to deprecated ORCHID/ORCHIDv2 (RFC4843/RFC7343):
deny ipv6 any 2001:10::/28 icmp-off
deny ipv6 any 2001:20::/28 icmp-off
·
Block Router Advertisements (RAs):
deny icmpv6 any any router-advertisement icmp-off
·
Allow everything else from locally connected internet customers to the IPv6 global unicast space (as a rudimentary/coarse anti-source-IP spoofing measure):
permit ipv6 <YOUR IPv6 space> 2000::/3
I think there are some more you could block, but always be sure you know what's in your filters and change them according to your network requirements.
In addition, it's recommended to implement anti-spoofing protection at the ISP level. Only allow traffic from your customers originating from the IP space they were assigned via DHCPv6 or PPPoE.
Rinse
On 6-10-2024 11:28, Michiel Klaver via ipv6-wg wrote: