IPv6 address prefix difinition

As drteeth pointed out in an earlier post today: "Listen to the forum"!

You are comparing the IP addresses as strings. Thus the application of a netmask is not observed at all. To accomplish this you need to compare the IP addresses as IP addresses by using the IP::addr command.

Also, there is currently an issue with comparing network masks that has been corrected in 9.0.5, which involves which address you apply the mask to. In pre-9.0.5 versions, you need to apply the netmask to host address.

Here's an Example:

 
 when CLIENT_ACCEPTED { 
    if { [IP::addr "[IP::remote_addr]/64" eq 3ffe:1234:1234:5678::] } { 
       pool lb_pool 
    } else { 
       discard 
    } 
 } 
 

Also, you can use either / notation or " mask " notation. However, with the long netmasks of IPv6, I would suggest sticking with the / notation.

Second example:

 
 when CLIENT_ACCEPTED { 
    if { [IP::addr "[IP::remote_addr] mask ffff:ffff:ffff:ffff::0" eq "3ffe:1234:1234:5678::"] } { 
       pool lb_pool 
    } else { 
       discard 
    } 
 } 
 

After 9.0.5, you can do the following:

 
 when CLIENT_ACCEPTED { 
    if { [IP::addr [IP::remote_addr] eq 3ffe:1234:1234:5678::/64] } { 
       pool lb_pool 
    } else { 
       discard 
    } 
 }