Suppose I wanted to block facebook.

Suppose you have access to your firewall and you want to block Facebook.
Then you need to get their prefixes which you can find out their ASN.

You can find out their asn from traceroute:

$  traceroute -n -A www.facebook.com
....
14  4.69.149.82 [AS3356]  630.713 ms  633.180 ms 4.69.149.146 [AS3356]  629.633 ms
15  4.53.112.58 [AS3356]  578.959 ms  580.703 ms  579.624 ms
16  204.15.20.120 [AS32934/AS10753]  577.604 ms  557.247 ms  636.807 ms
17  74.119.76.67 [AS32934]  633.454 ms 74.119.76.186 [AS32934]  602.556 ms  603.583 ms
18  74.119.76.197 [AS32934]  634.461 ms 74.119.76.205 [AS32934]  634.431 ms 74.119.77.55 [AS32934]  702.079 ms
19  69.63.190.10 [AS32934/AS10753]  701.423 ms  700.644 ms  700.937 ms

Which you can verify with tools such as these

$ dig +short AS32934.asn.cymru.com TXT
"32934 | US | arin | 2004-08-24 | FACEBOOK - Facebook, Inc."

Then you'd get their prefixes using a lookup service

$ lynx --dump https://www.dan.me.uk/bgplookup?asn=32934 2>&1 | grep AS32934
   IPv4 Prefixes seen at AS32934:
     204.15.20.0/22       [AS32934]
     2620:0:1c00::/40     [AS32934]
     66.220.144.0/21      [AS32934]
     66.220.152.0/21      [AS32934]
     66.220.159.0/24      [AS32934]
     69.171.224.0/20      [AS32934]
     69.171.239.0/24      [AS32934]
     69.171.240.0/20      [AS32934]
     69.171.255.0/24      [AS32934]
     69.63.176.0/21       [AS32934]
     69.63.184.0/21       [AS32934]
     74.119.76.0/22       [AS32934]

You can then feed the prefixes into your firewall.
Of course, If I was a determined user, I could use any of the free proxies out there rendering this whole post moot (DPI anyone?).

Precedence for IPv4 vs IPv6

You can use /etc/gai.conf to set up your IPV4/IPV6 precedence as documented here and here.


Say we have two hosts www.he.net and www.ripe.net

$ host www.he.net
www.he.net is an alias for he.net.
he.net has address 216.218.186.2
he.net has IPv6 address 2001:470:0:76::2


$ host www.ripe.net
www.ripe.net has address 193.0.6.139
www.ripe.net has IPv6 address 2001:67c:2e8:22::c100:68b

Case 1: Prefer IPV4
Append the following to /etc/gai.conf

precedence ::ffff:0:0/96  100

then we have:

$ telnet www.ripe.net 80
Trying 193.0.6.139...
^C
$ telnet www.he.net 80
Trying 216.218.186.2...

Case 1: Prefer IPV6 for specific hosts
If we append

precedence 2001:470::/32 100

then we have

$ telnet www.ripe.net 80
Trying 193.0.6.139...
^C
$ telnet www.he.net 80
Trying 2001:470:0:76::2...
^C

So we seem to prefer that network for ipv6 and ipv4 everywhere else.


Case 3: Prefer ipv4 for specific hosts
Wondering if we invert the mask the reverse will be true.

Debian lenny ipv4 socket bind failing

A certain daemon that had been working elsewhere was refusing to bind to v4 on my box. Strace'ing it showed this

connect(5, {sa_family=AF_UNSPEC, sa_data="\0\0\0\0\0\0\0\0\0\0\0\0\0\0"}, 16) = 0
connect(5, {sa_family=AF_INET, sin_port=htons(10042), sin_addr=inet_addr("0.0.0.0")}, 16) = -1 EAFNOSUPPORT (Address family not supported by protocol)
close(5)                                = 0
socket(PF_INET, SOCK_DGRAM, IPPROTO_IP) = 5
connect(5, {sa_family=AF_INET, sin_port=htons(10042), sin_addr=inet_addr("0.0.0.0")}, 16) = 0
getsockname(5, {sa_family=AF_INET, sin_port=htons(60862), sin_addr=inet_addr("127.0.0.1")}, [16]) = 0
close(5)                                = 0
socket(PF_INET6, SOCK_STREAM, IPPROTO_TCP) = 5
setsockopt(5, SOL_SOCKET, SO_REUSEADDR, [1], 4) = 0
bind(5, {sa_family=AF_INET6, sin6_port=htons(10042), inet_pton(AF_INET6, "::", &sin6_addr), sin6_flowinfo=0, sin6_scope_id=0}, 28) = 0
listen(5, 5)                            = 0
write(2, "Config port: 10042\n", 19Config port: 10042

Notice the kernel says IPV4 binding is not supported! I am dual stacked! I had IPV4, I could ping the box and other hosts over IPV4. A quick look at my sysctl.d showed

net.ipv6.bindv6only = 1

Switching this off (0) fixed the issue. You can also do it interactively by

echo 0 > /proc/sys/net/ipv6/bindv6only 

Now everything works as expected.
Update:
This is weird. According to the kernel documentation

bindv6only - BOOLEAN
        Default value for IPV6_V6ONLY socket option,
        which restricts use of the IPv6 socket to IPv6 communication
        only.
                TRUE: disable IPv4-mapped address feature
                FALSE: enable IPv4-mapped address feature

        Default: FALSE (as specified in RFC2553bis)

Which as far as I can tell shouldn't touch the IPV4 stack. I expected to find this sysctl check under net/ipv4 but grep can only find the checks in net/ipv6. Any ideas?

Last few IPV4 Blocks

Looking at the statistics from IANA:

Non legacy allocated blocks are:

$ for RIR in AfriNIC ARIN APNIC RIPE UNALLOCATED ; do echo -e "$RIR:\t `cat ipv4-address-space.txt|grep ALLO |grep $RIR|grep -Ee '8'|wc -l`"; done
AfriNIC: 3
ARIN: 35
APNIC: 42
RIPE: 34
UNALLOCATED: 7

%wise these are:
for RIR in AfriNIC ARIN APNIC RIPE UNALLOCATED ; do echo -e $RIR $(echo "scale=2;100*`cat ipv4-address-space.txt|grep ALLO |grep $RIR|grep -Ee '8'|wc -l`/$TOTAL"|bc); done
AfriNIC 2.47
ARIN 28.92
APNIC 34.71
RIPE 28.09
UNALLOCATED 5.78


UNALLOCATED blocks are:
$ cat ipv4-address-space.txt |grep UNALLO|grep -Ee "8"
039/8 IANA UNALLOCATED
102/8 IANA UNALLOCATED
103/8 IANA UNALLOCATED
104/8 IANA UNALLOCATED
106/8 IANA UNALLOCATED
179/8 IANA UNALLOCATED
185/8 IANA UNALLOCATED

This year allocations:

$for RIR in AfriNIC ARIN APNIC RIPE; do echo -e "`cat ipv4-address-space.txt|grep ALLO |grep $RIR|grep -Ee '2010'`"; done|sort -k2

105/8 AfriNIC 2010-11 whois.afrinic.net ALLOCATED
001/8 APNIC 2010-01 whois.apnic.net ALLOCATED
027/8 APNIC 2010-01 whois.apnic.net ALLOCATED
223/8 APNIC 2010-04 whois.apnic.net ALLOCATED
014/8 APNIC 2010-04 whois.apnic.net ALLOCATED
049/8 APNIC 2010-08 whois.apnic.net ALLOCATED
101/8 APNIC 2010-08 whois.apnic.net ALLOCATED
036/8 APNIC 2010-10 whois.apnic.net ALLOCATED
042/8 APNIC 2010-10 whois.apnic.net ALLOCATED
050/8 ARIN 2010-02 whois.arin.net ALLOCATED
107/8 ARIN 2010-02 whois.arin.net ALLOCATED
023/8 ARIN 2010-11 whois.arin.net ALLOCATED
100/8 ARIN 2010-11 whois.arin.net ALLOCATED
031/8 RIPE NCC 2010-05 whois.ripe.net ALLOCATED
176/8 RIPE NCC 2010-05 whois.ripe.net ALLOCATED
005/8 RIPE NCC 2010-11 whois.ripe.net ALLOCATED
037/8 RIPE NCC 2010-11 whois.ripe.net ALLOCATED

ARIN, AfriNIC and RIPE just got a bunch of /8s each. While APNIC consumes about two /8s each ~3 months. So, we should be down to the last 5 in January or February next year!

Welcome to the age of IPV6