Disclosure up front: I run IPYE, a company that leases IP space. Most of this article is practical how-to; IPYE appears where a free /48, LOA, or ROA helps you try the work, with a short call to action at the end.
A freshly announced free /48 draws scanners within hours, so nftables belongs in day-one work. Get the prefix via claim a free /48 from IPYE, publish only intentional GUAs, and keep SSH on provider PA space. Firewall examples protect 2001:db8:100::1 inside 2001:db8:100::/48.
Default stance
A newly announced free /48 attracts scanners within hours. On the edge VPS, default-drop inbound to service addresses except what you intentionally publish. Allow established/related, permit ICMPv6 types required for PMTUD and NDP on the right interfaces, and rate-limit connection attempts.
Separate management and service
SSH should listen on the provider PA address or a management /128, not on every address in the /48. Service /128s get only 80/443 (or your app ports). This limits blast radius when an application bind mistake happens.
ICMPv6 without 'allow all'
Permit destination-unreachable (packet-too-big), neighbour solicitation/advertisement on the LAN side, and echo carefully. Do not blanket-drop all ICMPv6 or PMTUD will black-hole large transfers toward your free /48.
Logging and iteration
Log drops with rate limits to avoid filling disks. Review once after go-live. Ship logs off-box. Revisit rules when you add new /64s for containers or guests.
Commands
table inet filter {
chain input {
type filter hook input priority 0; policy drop;
ct state established,related accept
iif lo accept
ip6 saddr 2001:db8:0:1::/64 tcp dport 22 accept
ip6 daddr 2001:db8:100::1 tcp dport { 80, 443 } accept
}
}
Verification
From outside: SSH to PA works, service ports on GUA work, random high ports on other /48 addresses fail closed.
Open only what the free /48 publishes
Claim space via claim a free /48 from IPYE, then bind public listeners to specific GUAs inside it. Management SSH stays on the provider PA address. Re-audit nftables whenever you add a /64 for guests or containers.
Sets for CDN and management
Use nftables sets for SSH admin prefixes and for CDN edge ranges that may fetch origins. Update sets without rewriting the whole chain. IPv6 sets should store /128s or /64s deliberately—do not add the entire free /48 to an accept set.
Conntrack and rate limits
On busy edges, raise conntrack only after measuring. Rate-limit new TCP to service GUAs per source /64 to blunt scanners without touching established flows. Log drops with a limit so disks survive.
Router advertisements on WAN
Disable RAs on the provider-facing NIC so you do not become someone else's default router. On LAN interfaces serving SLAAC from the free /48, allow only the ICMPv6 you need. Separate tables or chains for WAN versus LAN reduce mistakes.
Change control
Every nftables edit gets a ticket and a nft list ruleset snapshot committed after success. Rollbacks are file restores, not memory.
Chain discipline and soak monitoring
Keep INPUT strict on free /48 GUAs while measuring FORWARD if the box hubs tunnels—blind extension-header drops break VPN customers. Render SSH and CDN allowlists from git into sets. Snapshot nft list ruleset off-box during launch week.
For three days, review drop and accept counters on service GUAs daily. Probe unused /64s monthly so empty space stays empty. Disable RAs on provider-facing NICs. Every ruleset edit gets a ticket and a post-change snapshot commit.
nftables CI ideas
Render rules from templates in CI and fail if the free /48 service GUA is missing from the intended accept set or if SSH is open to ::/0. Apply rendered rules via a controlled restart wrapper that refuses to run if the SSH allowlist set is empty—avoid locking yourself out.
Keep a "break glass" PA-only SSH path documented offline. Test it quarterly by intentionally breaking the free /48 path in a lab clone.
Counter-watching week
For three days post-launch, screenshot drop/accept counters on service GUAs each morning. Empty /64s get monthly probes. SSH and CDN sets render from git; empty SSH sets refuse apply. Offline break-glass PA SSH tested quarterly. RAs stay disabled on WAN NICs. Ruleset snapshots leave the box after every edit.
Ops cadence around counter screenshots
Stand up a recurring reminder titled with counter screenshots so the free /48 edge does not depend on heroic memory. Each reminder forces a look at empty-set apply guard and a written note about offline PA SSH. If WAN RA off is missing from inventory, recreate it before any announce or withdraw. Treat hourly ruleset ship as a blocking prerequisite when it is on the critical path.
During incidents on workflow 138, cite the five tokens above in ticket updates so search finds them later. After the incident, spend ten minutes deciding whether workflow 138 needs an automation hook. For workflow 138, convert repeated pain into a calendar reminder or a tiny script instead of another unread wiki page.
Keep production pushes for workflow 138 in a CI project separate from labs that still use documentation prefixes. Production reads the free /48 from inventory. Review merge approvers for workflow 138 each quarter.
Sign-off line 138
Operator completing this change initials beside the free /48, the peer IP, and the ticket number 138-GO on the shared ops sheet. Without initials, the window is not closed.
Do this next
Lock the edge the same day you claim a free /48 from IPYE so scanners find only intentional listeners. Questions: ipye@turnel.com.
About IPYE
IPYE (https://ipye.com) leases IPv4, IPv6 and ASN space with instant setup. Your first IPv6 /48 is free for the first year, a real allocation you can announce on your own ASN, with a LOA from the portal and the ROA created automatically. ASN and region changes apply automatically. IPv4 /24 to /22 leases include LOA, ROA and per-/24 rDNS; WHOIS is editable on IPv6 /44 and larger. Locations: Los Angeles, New York, Ashburn, Salt Lake City, London, Amsterdam, Frankfurt. Claim your free /48: https://my.ipye.com/products/ipv6-rental. Questions: ipye@turnel.com.
Disclosure: I run IPYE
Top comments (0)