carlos2
Member
OP
- Joined:
- Jun 2024
- Posts:
- 158
- From:
- Medellín, CO
Running fail2ban on my OVHcloud VPS and noticed something weird—bans weren't sticking. Checked the logs and my IPv6 address keeps rotating. Privacy extensions doing their job too well, I guess.
Turns out fail2ban was banning /64 prefixes but my host rotates through a /56 pool. Every reconnect = fresh address, clean slate for attackers. Silent failure for weeks until I audited manually.
Anyone else hit this? Which providers take XMR for IPv6-static add-ons? The privacy coin angle meets actual privacy extensions irony here.
not your keys, not your coins
kasiaxus
Member
- Joined:
- Aug 2024
- Posts:
- 74
- From:
- Wrocław, Poland
My box is on Hetzner , same thing xd fail2ban this was useless for ipv6, I dont know why, I thought this is normal
They give /64 but I have privacy extensions on, so address rotate, I never check this, I have server two years and this was broken whole time? Maybe
I checked now and b/v I mean ban list is full of dead addresses, nobody there xd
POLISH SERVERS. LOUD FANS. GOOD PRICE.
MARIA3
Member
- Joined:
- Jul 2024
- Posts:
- 126
- From:
- Madrid, ES
I make a server up with RackNerd and have same problem. I disable privacy extensions now, thank you @tarekcai for the sysctl. I think many people dont know this, is very silent.
Before I use only IPv4 for fail2ban and ignore IPv6, but this is not good security. Now I fix both.
Regards
siesta first, deploy later
uma
Member
99.99% or bust
- Joined:
- Jun 2024
- Posts:
- 324
- From:
- Dublin, IE
I've been tracking failed login attempts on my KnownHost box and the IPv6 noise is 340% higher than IPv4, yet my ban list growth was flat. Red flag I missed for 14 months in production. My status page showed green the whole time. Alert fatigue on the wrong metrics. I now monitor ban-list-to-attempt ratio as a secondary signal. But they need to be the right graphs.
436 days. reboot is surrender.
