I need to set some rules to block network traffic, both IPv4 and IPv6. The routes should be a blackhole or unrecheable depending on the case. In Linux and MacOSX seems simple, there are specific keywords/flags when adding a route ("blackhole", "unreachable" in linux, and the flag "B" or "R" in MacOSX). My problem is Windows.
I found a solution for Blackhole, that you can see here for example, just to mention one website. Basically sending the traffic to the loopback interface. That is for IPv4. For IPv6 I use a similar trick, using the loopback interface, but pointing to
0100::1, a discard prefix, citing:
"0100::/64 as a Discard-Only Prefix in the "Internet Protocol Version 6 Address Space""
Then, my questions are:
- are the solution I have written the "standar way"? is there a better way to achieve this?
- how can I achieve a "unreachable" route in Windows and not a "blackhole"?
- [WRONG, see edit] I could also use the firewall, that sometimes I read is the best solution in Windows. For example, I can put a filter with a
FWP_ACTION_BLOCKaction, see FWPM_ACTION0 structure. But this roule will act as blackhole? or as unreachable?
It seems a firewall rule is the wrong solution. I tested that while using a route to
0100::1 through the loopback interface, if a try to ping using IPv6, I get a
General failure error, while doing it using a blocking firewall rule, I get a timeout (that is exactly what I do NOT want). But I am still not able to get a
Route Unreachable error as in MacOSX and Linux...