I'm interested in this in the context of protecting a web application from bots, but I guess it applies to all kind of attacks that can be done over IPv6 by bots.
In a web application, you have some pages you want to protect from bots.
It could be a login page: you want to avoid million of requests trying username/password combinations.
It could be a registration page. You don't want thousands of bot accounts created on your website.
Or maybe you don't want the whole content of your database to be downloaded at once. You think it's ok for an anonymous user to make 100 or 200 requests a day to your database to get some infos, but you're not ok with bots downloading all the content you're offering by doing 1000 requests a minute.
Or just for statistical purpose. You're logging visitors activity on your site and you don't want bots to completely bias your data, by say, artificially clicking a link thousands of time so that the article it's linking to becomes the "most popular article" on your news website.
I've often handled this using throttling/rate limiting based on IP addresses, using Nginx rate limiting capabilities:
limit_req_zone $binary_remote_addr zone=mylimit:10m rate=10r/m;
server {
location /sensitiveUrl {
limit_req zone=mylimit;
proxy_pass http://my_upstream;
}
}
But with IPv6, I'm not sure how effective this is. I mean, with IPv4, it's relatively effective because it's costly for attackers to create and use thousands of ip addresses, but it seems that with IPv6 anyone can create millions of IPs. How to handle this? Should I apply restrictions on IPv6 networks instead of addresses? How effective would that be in practice if I did that?