Interesting point. I guess the dual-stack carries inevitably an ambiguity
on how to treat mapped addresses. Although they are IPv6, it makes
sense to treat them as plain IPv4 as they traverse the IPv4 stack rather
than the 6 one.
I'll think about it over the next days.
On Feb 24, 2010, at 14:03 , Arne Riecken wrote:
> Hello,
>
> when proftpd runs with ipv6 support, it maps ipv4 addresses to ipv6
> (::ffff:1.2.3.4) in the log. Then sshguard treats it as ipv6 address
> and executes e.g.
>
> ip6tables -A sshguard -s ::ffff:1.2.3.4/128 -j DROP
>
> so the ipv4 address will not be blocked with iptables.
>
> I posted the problem here:
>
> http://forums.proftpd.org/smf/index.php/topic,3817.msg13663.html#msg13663
|
