IPv6 suffix settings

[lyc8503]

When I tried to add a IPv6 suffix range to an IPSet `::1234/::ffff:ffff:ffff:fff`, it complains "Parameter verification failed. (400)cidr: invalid format - value does not look like a valid IP address or CIDR network"

How could I specify an suffix range in IPv6 here?

 

[encryptedserver]

Looks like suffix like this is not supported, you need a full IPv6 address.

 

[UdoB]

There can only be ONE "::" to eat up ONE sequence of zeros. For your example I would try ::1234:ffff:ffff:ffff:ffff/64 - which looks wrong either. The "left" half should contain your network address, the right half the specific computer address. The netmask itself is usually given as "/64" at the end. Note that 64 is usual and highly recommended, but some other values may be used for specific circumstances.

So... if your network address is 1234 and you PVE should get the address 567 I would enter 0:0:0:1234::567/64 OR ::1234:0:0:0:567/64

Note that you can always write the full address 0:0:0:1234:0:0:0:567/64

Disclaimer: never used IPv6 on PVE yet.

 

[lyc8503]

Let me explain my usecase.

I am running PVE on my HomeLab and I am getting my IPv6 prefix from my ISP. However, my ISP changes the prefix from time to time.
If I only specify one address like "2001:abcd:abcd:5678::1234" in my ipfilter-net0, it disconnects from the Internet when the prefix from ISP changes.

So I want to match the right half and ignore the left 64 bits of my address.

OpenWRT supports this syntax "::1234/::ffff:ffff:ffff:ffff" (suffix mask), it matches all addresses like "xxxx:xxxx:xxxx:xxxx:0000:0000:0000:1234":


Or are there any others ways to correctly enable the IP filter feature with changing IPv6 prefixes?