Stop IPv6 Google traffic

Hi All,

I need to stop IPv6 web traffic going from our customers to Google
without touching all other IPv6 and without blackhole IPv6 Google
network (this case my customers are complaining on long timeouts).

What can you advice for that?

Umm.. fix the reasons why they're seeing timeouts? :slight_smile:

Have you determined why the timeouts are happening?

I don't understand the motive here. You want to provide a partial view of the IPv6 table, but sans Google?

Do you as a network do the same for v4? If not, you really need to consider having congruent implementations.

- jared

Customers see timeouts if I blackhole Google network. I looking for
alternatives (other than stop providing IPv6 to customers at all).

Why do you want to prevent IPv6 access to Google?
What's the point?

"Doctor, it hurts when I do this.." "Then don't do that..."

Why are you blackholing Google?

I think the group wants to know what problem you're trying to solve. Obviously if you block something, there will be a timeout in getting to it.

What is broken that you're trying to fix by blackholing them?

Hello!

Same question from my side. What's original issue with IPv6 and Google?

The problem is IPv6-enabled customers complaints see captcha, and Google
NOC refuses to help solve it saying like find out some of your customer
violating some of our policy. As you can imagine, this is not possible.

So, the working solutions is either correctly cut IPv6 to Google, or cut
all IPv6 (which I don't want to do).

He works for cogent :stuck_out_tongue: ?

Regards,

Dovid

Assign your customers larger v6 prefixes so one customer's bad
behavior doesn't affect the others?

If I'm not mistaken, when there is some "abuse",
Google typically shows captcha for the single IPs, not for whole provider, so only the customers who actually do something nefarious should get flagged.

Also, if you see captcha while using IPv6, switching to IPv4-only won't solve the problem because if there really is abuse, Google will flag the IPs regardless of IP protocol version.

Every have /56 or /48, depending on type of service. All our /32
allocation is affacted.

* maxtul@netassist.ua (Max Tulyev) [Sun 10 Apr 2016, 15:30 CEST]:

I need to stop IPv6 web traffic going from our customers to Google
without touching all other IPv6 and without blackhole IPv6 Google
network (this case my customers are complaining on long timeouts).

What can you advice for that?

You can add a reject route at your borders rather than nullroute. That will cause ICMP Unreachables to be sent by your routers back to your customers so their applications will know immediately to retry using IPv4 rather than waiting for TCP timeouts.

Alternatively, you could ask Google to exempt your nameservers from being responded to with AAAA records - something that may happen automatically if v6 connectivity is bad.

  -- Niels.

That is the problem with some of these companies. They've gotten just as cocky and arrogant as the incumbent telco providers and won't actually tell you what you're doing wrong, but will punish you for doing wrong.

You are mistaken. Google flags entire netblocks, more so for IPv6 it seems.

* nanog@ics-il.net (Mike Hammett) [Sun 10 Apr 2016, 16:53 CEST]:

That is the problem with some of these companies. They've gotten just as cocky and arrogant as the incumbent telco providers and won't actually tell you what you're doing wrong, but will punish you for doing wrong.

I'm happy with them not sharing what exactly other people are doing online when quizzed.

  -- Niels.

Thank you! I think it is what I need now :wink:

That was another Google reply, but all /32 still affected. IPv4 is not
affected (at least no complaints), so...

Hi,

The problem is IPv6-enabled customers complaints see captcha, and Google
NOC refuses to help solve it saying like find out some of your customer
violating some of our policy. As you can imagine, this is not possible.

your customers are getting AAAA addresses when looking up google addresses...so their
clients are trying to use IPv6 to talk to google..... so doing anything to that traffic - blackholing
or just denying it, WILL affect the clients.

give clients their own bigger blocks - or identify the clients violating policy (what the policy
they are violating?) - you'll probably find the ones getting the captchas are the ones violating! :wink:

alan