Rate Limiting and Banning IPv6 Clients by /64 Prefix with nftables

Rate limits and ban lists built on individual IPv6 addresses fail because one client with a /64 can cycle through an enormous number of source addresses. The article recommends aggregating limits and bans on the /64 prefix instead, since a /64 is a standard subnet and the natural unit for IPv6 client identification. It demonstrates an nftables meter that masks source addresses to their top 64 bits and rate-limits new HTTPS connections per prefix, plus an interval set with timeouts for banning offending prefixes. The author cautions that shared /64s on public Wi-Fi or mobile networks can harm innocent users, and that customers holding a /56 or /48 may hop between /64s, so limits and bans should be tuned and kept temporary. The piece also advises keeping ICMPv6 accepted to avoid breaking neighbour discovery and Packet Too Big messages.