Anyone who relies on IP filtering for security deserves to have it broken. Change my mind.
IP filtering is a valuable factor for security. I know which IPs belong to my organisation and these can be a useful factor in allowing access.
I've written rules which say that access should only be allowed when the client has both password and MFA and comes from a known IP address. Why shouldn't I do that?
And there are systems which only support single-factor (password) authentication so I've configured IP filtering as a second factor. I'd love them to have more options but pragmatically this works.
I do understand the value of blocking unwanted networks/addresses, but that's a bit different problem space.
There's value in restricting access and reducing ones attack surface, if only to reduce noice in monitoring.
I've done a lot of IP filtering, it's what a lot of systems and services allow us to, so I'm curious what the IPv6 mechanism is