Hetzner netscan abuse warning. about kubo HOT 2 OPEN

It seems 64:ff9b:1::/48 is used for ipv4 translation... essentially you need to update your AddrFilters to exclude whatever Hetzner is using for LAN addresses. The server profile includes some well-known ranges but it seems to be missing this one. I guess it should be included...

Of course, let's not forget that Hetzner sucks, that they don't implement any network isolation and instead they put this shitty netscan detector and make ipfs-users life hard without giving any warning. You may well ask their support what private IP ranges to avoid because they may belong to other customers, but instead of dealing with Hetzner support, it is better that you buy yourself an icecream and spend the remaining time migrating off to a sane cloud provider that doesn't make you deal with this BS, if possible (in my humble and personal opinion).

from kubo.

Mostly agree with @hsanjuan, but poking into this more it looks like there are a few things going on here (although lmk if I'm wrong).

• ::/8 was reserved by IETF and has carved out some uses https://www.iana.org/assignments/ipv6-address-space/ipv6-address-space.xml
  • For some reason there are machines out there with what seem to be invalid addresses like ::5054:ff:fe92:8bc9 (i.e. they don't fall under one of the approved uses in a space reserved by IETF)
  • Hetzner yells at you for dialing these addresses... which they could just drop because they're invalid, but it also seem like fair game for go-libp2p to block dialing these addresses too
• 64:ff9b:1::/48 should be add to the server profile filters in kubo because it's a private IP range
• 64:ff9b::/96 is a valid public IP space per https://www.iana.org/assignments/iana-ipv6-special-registry/iana-ipv6-special-registry.xhtml
  • 64:ff9b::175:1005 falls into this range rather than the one above which should be filtered in kubo. If I'm doing the conversion correctly this is 1.117.16.5 (apparently a Tencent datacenter in China). This means Hetzner is blaming you for dialing what should be valid IP addresses... they might just have a filter for ::/8 and yell at you for dialing anything in that range (since the loopback addresses shouldn't touch the network anyway).

If so this would mean the actions here are:

1. Add filters (likely in go-libp2p, although they could be hardcoded in kubo if necessary) that block the subset of ::/8 that's undefined
2. Add 64:ff9b:1::/48 to the server profile filters in kubo
3. Hetzner users should tell them that 64:ff9b::/96 is fair game
   • See https://www.iana.org/assignments/iana-ipv6-special-registry/iana-ipv6-special-registry.xhtml (globally reachable column)
   • See RFC 6052
   • Hetzner users can also choose to block this range as well while they wait on Hetzner to deal with the issue

from kubo.