# Block ipv6

**URL:** <https://community.f5.com/t/block-ipv6/76331>\
**Category:** Technical Forums\
**Tags:** security\
**Created:** [July 14, 2025, 7:42am UTC](https://community.f5.com/t/block-ipv6/76331 "2025-07-14T07:42:29Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Antonio3](https://avatars.discourse-cdn.com/v4/letter/a/ecb155/32.png) [@Antonio3](https://community.f5.com/u/Antonio3)\
**Post date:** [July 14, 2025, 7:42am UTC](https://community.f5.com/t/block-ipv6/76331/1 "2025-07-14T07:42:29Z")

</div>

Hi,  
From the anti-bot profile logs, I noticed requests from an IPv6 client IP.  
I applied this iRules to the VIP to see what was happening.

when FLOW\_INIT {  
&nbsp; if { [IP::version] eq “6” } {  
&nbsp; &nbsp; drop  
&nbsp; &nbsp; log local0. “Blocked IPv6 connection from [IP::client\_addr]”  
&nbsp; }  
}

The statistics are incremented by one per second, but I don’t see any logs in /var/log/ltm

 ![image_342482.png](https://d20hrnpixdzcsd.cloudfront.net/original/3X/7/8/7805a8615b00dfd9acb11132320ba7df770ee5b8.png)

Does anyone have any idea what’s going on?

thanks

---

<div class="post-metadata">

**Author:** ![VishnuGatla](https://d1p9zq3aats0t8.cloudfront.net/user_avatar/community.f5.com/vishnugatla/32/10865_2.png) [@VishnuGatla](https://community.f5.com/u/VishnuGatla)\
**Post date:** [July 14, 2025, 5:58pm UTC](https://community.f5.com/t/block-ipv6/76331/2 "2025-07-14T17:58:21Z")

</div>

Hi @Antonio3

If your syslog configuration (in bigip.conf) only includes “warning” or higher severity for the local0 facility, informational messages will be filtered and not written to the log file. By default, iRule log messages use the “informational” severity level.

Option 1: Follow the steps in the following article and update.

[K000139985](https://my.f5.com/manage/s/article/K000139985): iRule local0 logs aren’t appearing in /var/log/ltm or syslog

Option 2: I **ncrease the log level in your iRule** to “warning” so it matches your current filter

log local0.warning “Blocked IPv6 connection from [IP::client\_addr]”

---

<div class="post-metadata">

**Author:** ![Antonio3](https://avatars.discourse-cdn.com/v4/letter/a/ecb155/32.png) [@Antonio3](https://community.f5.com/u/Antonio3)\
**Post date:** [July 15, 2025, 7:15am UTC](https://community.f5.com/t/block-ipv6/76331/3 "2025-07-15T07:15:39Z")

</div>

Hi f51,

Thanks for your support  
The sys db log.rules.level is already “Warning”

sys db log.rules.level {  
&nbsp; &nbsp; default-value “Informational”  
&nbsp; &nbsp; scf-config “false”  
&nbsp; &nbsp; value “Warning”  
&nbsp; &nbsp; value-range “Debug Error Informational Notice Warning”  
}

If I try to apply a different iRules, for example, log when my public IP contacts the VIP, I see the logs in /var/log/ltm.

Thanks

---

<div class="post-metadata">

**Author:** ![VishnuGatla](https://d1p9zq3aats0t8.cloudfront.net/user_avatar/community.f5.com/vishnugatla/32/10865_2.png) [@VishnuGatla](https://community.f5.com/u/VishnuGatla)\
**Post date:** [July 15, 2025, 2:21pm UTC](https://community.f5.com/t/block-ipv6/76331/4 "2025-07-15T14:21:20Z")

</div>

Thank you for the update. Try as below. Move the log command before the drop command in your iRule.

when FLOW\_INIT {  
&nbsp; if { [IP::version] eq “6” } {  
&nbsp; &nbsp; log local0.warning “Blocked IPv6 connection from [IP::client\_addr]”  
&nbsp; &nbsp; drop  
&nbsp; }  
}