Block a client not working

[cust0muser]

I cannot block a client. I found the IPv4 address of a phone using my router and would like to block it completely. To do this, I entered the IP address in the DNS settings under prohibited clients. However, this client can continue surfing the Internet without any problems. How come? The device is definitely connected to the same network. In general, I noticed that the blocks don't work reliably. I don't use DNS encryption or Adguard's DHCP server. What am I doing wrong? If I enter my smartphone's IP for testing purposes, then I can't do anything. This is how it should be if I enter other IPs or not?

[ppfeufer]

IPv6 and its privacy mode, welcome to the nightmare.

Your phone is probably also having an IPv6 address. And most likely the IPv6 privacy mode is active. which means, it will get a new IPv6 address every time it connects, sometimes even more,( and not re-use the same address(es)) depending on how the apps are set up to handle IPv6 and if they request their own IPv6 address, thanks to privacy mode. (Dang, that was a lot of IPv6 in one sentence …)

In other words, it's almost impossible to block completely, as it will just change its IPv6 address again. And if you hope it will one day run out of IPv6 addresses to use, I have really bad news for you …

PS.: I haven't found a way to disable the IPv6 privacy mode on mobiles yet, still looking …

[cust0muser]

Many thanks for your response. I have activated the Always assign ULA function in my router under IPv6. Doesn't that help? That's a persistent IPv6 address.

[ppfeufer]

Nope, ULA (Unique Local Address) are, as the name says, local addresses. Privacy mode also works with public addresses.

Addition:
That setting in the router only means that it gets this one address definitely, not that it can't request additional addresses.

[cust0muser]

Stupid question but why does this function exist if it doesn't work? Would it make sense to completely deactivate IPv6 so that communication only takes place via IPv4?

[ppfeufer]

Erm, nope.

The address pool on IPv4 is extremely limited.

Example IPv4:
Ignoring private network ranges, IPv4 has about 4.7 billion possible addresses. and that's it.
Remove the private networks from it, you'll be probably closer to something like 2.5 - 2.8 billion possible public addresses.
I guess you can see the limitation here in modern times.

IPv6 on the other hand has a much larger address pool. And by much larger I mean … a lot larger …

Example IPv6:
Your ISP assigns a public IPv6 subnet to you, which you can use as you see fit. This subnet has more IP addresses than you ever would be able to use. Probably enough for each and every grain of sand in the Sahara desert and then some. Or to put it in numbers, if your device would switch the IPv6 address every 10 seconds and never re-use any of them, it would take about 5300 years or so to go through all of them. (Told you I have bad news …)

The IPv6 privacy mode is to do exactly that. Not that fast though, but you get the idea. This is to protect your device or program/app and so on from being traced over a longer period of time by its IP(v6), since IP tracking is a rather good way to track a user on its way through the internet. So in other words, it somewhat protects your privacy.

In general, a nice idea but the implementation is a bit lacking, and as we can see in this example it has its drawbacks. It protects your device from being completely blocked.

Edit:
I mean, sure, you can completely disable IPv6 for you but …

• You will have trouble connecting to IPv6-only servers/websites.
• IPv4 will be discontinued at some point in the future. Probably not in the next 5 - 10 years, but at some point it will be shut down.