Re: prefix len confusion

[Randy Bush <randy@psg.com>]

>> we also see this (distributed source) attack on proxmox clusters' web
>> interfaces
>>
>>     2026-06-07T02:01:39.274405+00:00 pv0 pvedaemon[2276]: 
>> authentication failure; rhost=::ffff:85.11.167.7 user=root@pam 
>> msg=Authentication failure
>>     2026-06-07T02:01:42.970943+00:00 pv0 pvedaemon[2277]: 
>> authentication failure; rhost=::ffff:85.11.167.7 user=root@pam 
>> msg=Authentication failure
>>
>> can we safely just add ffff::0 to the v6 bogon list?
> 
> It's an IPv4 address being logged in the form of an IPv4-mapped IPv6
> address. If you wish to block it, consider it as an ordinary IPv4
> address (85.11.167.7).

if nft treats it as an ipv4 addy, then the ipv4 filters should have
blocked, n'est-ce pas?

    tcp dport 8006 ip daddr $PROX4 drop

> For that reason, you should also be able to observe the packet(s) if
> you add a suitable tracing rule to the existing PREROUTING chain.

after pouting another cup

> That is, unless it is bridged traffic or does not traverse the
> firewall (as discussed previously).

no bridging.  we are hunting other holes in the attack surface.
using your prerouting hack to demonstrate the filtering is working
is a big help in focusing our efforts.

randy