Not understanding this ip block (https://ipinfo.io/AS32934)

I have added https://ipinfo.io/AS32934 as a source in both ipv4 and ipv6. The rules look as they should. AS32934 is facebook. Dig facebook.com returns 31.13.69.228 (this time, it changes over time). 31.13.69.0/24 is in the list but facebook.com still loads in a browser. dig facebook.com also often returns 31.13.65.36. Which is explicitly in the list.

Looking at it in IPv6 facebook.com resolves to 2a03:2880:f111:83:face:b00c:0:25de which is explicitly in the ipv6 list.

I'm sure I have it setup correctly, deny_both. (yes. I know but I am just trying things. deny_outbound should have the result I'm looking for)

So, what trickery is at work here? What's going on in the browser that allows facebook.com to load?

Thanks!

Edited to add: I use cloudflare for DNS. I wonder if facebook uses cloudflares cdn which would be ip ranges not in facebooks AS.

I know I could just use tcpdump, but life is short. Later if no one has other ideas.

Edited again to say that 2a03:2880:f103:83:face:b00c:0:25d aka edge-star-mini6-shv-01-iad3.facebook.com is reachable (ping) always. 2a03:2880:f103::/48 is in the block list. Looking at the rules, the ipv6 list (from the ipv6 tab) is an ipv4 rule. I think that is a bug...

One last edit: changed that rule to use ipv6 address family and all is as it should be. Facebook is blocked.

Sorry to have a conversation with myself, I feel a bit foolish. Should have waited until I worked this out before posting.

So, it looks like ipv6 "tab" lists get incorrectly setup as ipv4 rules. And it looks like this has been fixed in the devel version.

BBcan177

@jwj said in Not understanding this ip block (https://ipinfo.io/AS32934):

So, it looks like ipv6 "tab" lists get incorrectly setup as ipv4 rules. And it looks like this has been fixed in the devel version.

Yes this is fixed in pfBlockerNG-devel