Mysql grant limited by IPv6 subnet I want to permit access to a mysql server over IPv6 and limit access to the particular account to our ULA subnet we are using (fdd7:03d7:6247::/48).  

The manual seems to suggest that wildcards are valid in the host when using IPv4, but how do you do this with IPv6?


  You can specify wildcards in the host name. For example, 'user_name'@'%.example.com' applies to user_name for any host in the example.com domain, and 'user_name'@'192.168.1.%'.


I have tried all these values which seemed like they should be valid.

GRANT ALL PRIVILEGES ON *.* TO 'zoredache'@'fdd7:3d7:6247::%'  IDENTIFIED BY  '...' WITH GRANT OPTION;
GRANT ALL PRIVILEGES ON *.* TO 'zoredache'@'fdd7:3d7:6247:%'   IDENTIFIED BY  '...' WITH GRANT OPTION;
GRANT ALL PRIVILEGES ON *.* TO 'zoredache'@'fdd7:03d7:6247:%'  IDENTIFIED BY  '...' WITH GRANT OPTION;
GRANT ALL PRIVILEGES ON *.* TO 'zoredache'@'fdd7:03d7:6247::%' IDENTIFIED BY  '...' WITH GRANT OPTION;


Using the % only in the host field works, so I know I have the password, and server setup properly.

GRANT ALL PRIVILEGES ON *.* TO 'zoredache'@'%' IDENTIFIED BY  '...' WITH GRANT OPTION;


The server has DNS resolution disabled with the skip-name-resolve, and I don't really want to enable it, and mess around with setting up reverse DNS zones for the ULA address space.

To repeat, how do I grant access for a user only if they connect from the  fdd7:03d7:6247::/56 network?
::, as I understand IPv6 indicates as many chunks of all zero as are needed to fill out the full length.  The question comes as to whether MySQL treats % as a single chunk and treat fdd7:03d7:6247::% as fdd7:03d7:6247:0000:0000:0000:0000:% or interpret it some other way.  (Sorry, I don't know the answer.)

A second problem is that /56 splits the middle of some chunk.  I don't know if that can be represented with %.

Anyway, here's my best guess:

'fdd7:03d7:6247:00%'


This confirms PacoHope's contention that leading zeros in each segment are optional:

SELECT HEX(INET6_ATON('1111:698:2222::'));
         --&gt;           11110698222200000000000000000000