How does the ISP filter private IP addresses?

[Mitrixsen]

Hello, everyone.

I am studying for my ENCOR exam and my current topic is NAT. From my CCNA studies, I understand that private IP addresses aren't routable. The ISP will drop traffic destined to these addresses and also traffic that is sourced from these addresses.

My question is, how exactly is this implemented from the ISP's side? I would like just a quick high-level overview if possible. The routers must have some sort of filtering applied, correct? And whatever is filtering this traffic also  has to read the source.

Thank you

David

//Edit: Does this filtering only check whether the destination IP is a private IP address (thus it should be dropped) or does it also check the source? That's something that I am unsure about.

[M02@rt37]

Hello @Devaa 

uRPF  is more related to protect a BGP router, 'BGP speaker', from DoS attacks that employ source IP spoofing in the data plane.

To go further concerning uRPF, an attacker can send IP packets with a spoofed or randomly changing source address to the destination, consuming resources and causing a DoS attack. These attacks are possible because routers only check for a destination IP address before forwarding IP packets, not the source address. 

To sum up: uRPF checks if an entry exists in the routing table matching the source IP before forwarding...

[Joseph W. Doherty]

uRPF might be used, but if used, it needs to be used with extreme care, as it's not just a question that a router doesn't have a route for the source destination, but whether that the ingress packet arrived on an interface that would be used as an egress interface if sending to the source IP.  Basically it assumes symmetrical routing, and, of course, real routing can be asymmetric for various reasons.

That noted, uRPF, might be just fine with a PE interface to a CE, when there's only one such link to the customer.