Apache2: How to block a range of IPv6 addresses in .htaccess?

Question

My website gets flooded with requests from the following IPv6 addresses:

2a03:2880:13ff:4::face:b00c
2a03:2880:22ff:3::face:b00c
2a03:2880:11ff:d::face:b00c
2a03:2880:13ff:9::face:b00c
2a03:2880:15ff::face:b00c

and so on.

Note that I am aware that AbuseIPDB claims this range is on their whitelist and that the Deny from syntax is deprecated.

I am running Apache 2 and - based on the above pattern - would like to block the following range: 2a03:2880:*:*::face:b00c

However, I don't know how to configure this in my .htaccess file. When I put Deny from 2a03:2880:*:*::face:b00c I get an internal server error (500), I guess because of the asterisk (*) that is not recognised. So far I ended up using Deny from 2a03:2880::/32

However, I am aware that I am blocking way too many addresses like this. Is there a more precise way to achieve my goal?

I searched on the internet about possible solutions, but did not find anything useful.

Answer 1

... and that the Deny from syntax is deprecated. So far I ended up using Deny from 2a03:2880::/32

Assuming you are using Apache 2.4 then, as you say, Deny, Allow and Order directives are indeed deprecated. You should be using the corresponding Require directive instead (although you would need to change over completely to using Require, not mix old and new directives). For example:

<RequireAll>
    Require all granted
    Require not ip 2a03:2880::/32
</RequireAll>

When I put Deny from 2a03:2880:*:*::face:b00c I get an internal server error (500)

You can't target IPs of the form 2a03:2880:*:*::face:b00c (where * is effectively a wildcard) using IP CIDR notation in directives like Require and Deny.

However, the range you want to block is easily handled with a regex instead. For example, on Apache 2.4 you could use an <If> expression comparing the requesting IP address with a regex like this:

<If "%{REMOTE_ADDR} =~ /^2a03:2880:[^:]+:[^:]+::face:b00c$/">
    Require all denied
</If>

See also my answer to the following related question for more detail:

• Block ip range using htaccess