private ipv4 address, and routers in internet

[sarahr202]

hi every body

i hope every body is having happy holidays.  I have few questions.

Routers in Internet are configured to drop packets, destined to private ip addresses.  How do we accomplish this ?  by using acl?

Let say an isp router  receives a packet from home user with source address 192.192.192.192 and destination address 100.100.100.100.  The question is will isp router drop this packet, considering  the packet is destined to valid,internet ip address(100.100.100.100), because source address is  private ip address?.  I understand  that  return packet will be dropped for sure as it will have source ip address 100.100.100.100 and destination ip address 192.192.192.192.

i just want to know what is usually done   in the real world  where source ip address happened to be private ip address and destination ip address is valid Internet ip address and  how ISP routers handle such kind of packets?

Thanks and Marry christmax  to all of you

[Dan-Ciprian Cicioiu · Accepted solution]

Hi ,

I think that depends on ISP.

But that can be accomplished with Unicast Reverse Path Forwarding ( uRPF).

You can read more here :

http://www.cisco.com/web/about/security/intelligence/unicast-rpf.html

Marry Christmas to all of you.

Dan

[Mahesh Gohil · Accepted solution]

Hi,

You can achieve this by putting below prefix-list at customer bgp config

ip prefix-list bgp-cust-deny-in seq 15 deny 10.0.0.0/8 le 32
ip prefix-list bgp-cust-deny-in seq 20 deny 172.16.0.0/12 le 32
ip prefix-list bgp-cust-deny-in seq 25 deny 192.168.0.0/16 le 32
ip prefix-list bgp-cust-deny-in seq 30 deny 0.0.0.0/8 le 32
ip prefix-list bgp-cust-deny-in seq 35 deny 127.0.0.0/8 le 32

This way any of the packet with source ip as above will be blocked. For static customers isp put a route-map along with

redistribute static statement

like

router bgp <>

redistribute static route-map STATIC-CUSTOMERS

route-map STATIC-CUSTOMERS deny 10

match ip address prefix-list bgp-cust-deny-in

route-map STATIC-CUSTOMERS permit 10

Regards

Mahesh

[jgraafmans · Accepted solution]

With this config you don't deny packets with an private IP address as source. You only deny static routes to private IP subnets from being advertised to BGP neighbors. This is the configuration of a PE router so there shouldn't be static routes to private IP subnets to the customers anyway.

And even this is not going to work with this config.

If you use an access-list or prefix-list in a route-map you match traffic or deny traffic from being matched. So if you use deny rules in your prefix-list you don't deny this subnets from being advertised but denies them from being matched by the route-map entry.

On the end of a prefix-list is an implicit deny. So with this prefix-list you deny all prefixes from being matched

Your first route-map entry which is intended to deny routes from being advertised, as stated above don't match any prefix and therefore don't deny any subnet from being advertised. Your second route-map entry matches any traffic and therefore all subnets are advertised by this config.

If you want this to work you should change all the denies on the pre-fix list to permits. Then the first route-map entry will match this subnets and denies them from being advertised.

To come back on the question. Most likely an ISP don't only wants to block traffic sourced from private IP addresses but only wants to permit traffic with a source address that is assigned to the customer to prevent IP spoofing. This can be done by using Unicast Reverse Path Forwarding ( uRPF) or by placing an access-list inside on the customer interface wit:

permit ip cust_ip any

deny ip any any

[Reza Sharifi · Accepted solution]

Hi Sara,

Here is good discussion on how to block Martian and Bogon routes:

https://cisco-support.hosted.jivesoftware.com/thread/2028979?decorator=print&displayFullThread=true

HTH

Reza

[Mahesh Gohil · Accepted solution]

Hello,

uRPF is something which cross check for source ip in routing table.

Say for example: I have permitted every prefix at PE end coming from customer. Now customer is advt. private IP say 10.0.0.0/24 ,

PE will permit the private one because  there is no prefix-list which deny anything. Now customer send packet with source as 10.0.0.1 for which uRPF will check for that source ip in routing table and it found matching one and it will permit those IP's. So uRPF is having no meaning if prefix-list with deny private ip is not there.

The next option is the access-list on interface, Let's it will block the packet with source ip as private one. But is it really
scalable option? Well I have never seen ISP who put access-list on interface for their internet customers.

The link shared by reza is all talking about blocking at customer end which I feel scalable as customer will not be having
more than 3-4 internet connection.

But for ISP who is having 1000's of connection it is not meaningful for those  ISP who do manual provisioning. (I agree it is ok for those ISP who use automatic tool for service delivery config.)

I feel uRPF with prefix-list (denying private IP's / permit only customer owned ip's or provider assigned IP's) is very good option.

I really not mean to criticize someone but trying to figure out what is the scalable option for ISP.

I appreciate if people can share their more views on this

Regards

Mahesh

[francisco_1 · Accepted solution]

Many addresses that are reserved for private or future use that should not be used on the internet (Bogons). These addresses such as the ones already mentioned should not be used on the on internet. Many ISPs and end-user firewalls filter and block bogons, because they have no legitimate use, and usually are the result of accidental or malicious misconfiguration.

Bogons can be filtered by using router ACLs, or by BGP blackholing.

For example with BGP, we can avoid to route packets with a bogon destination address, simply by adding a route toward bogon prefixes with a null-pointing next-hop;

example
ip route 192.0.2.1 255.255.255.255 Null0
ip route 1.0.0.0 255.0.0.0 192.0.2.1

we can also drop incoming packets presenting bogon source IP addresses; we can accomplish this using uRPF in a kind of source-based black hole filtering

example

interface Serial1/0
ip verify unicast source reachable-via any

see http://www.team-cymru.org/Services/Bogons/
http://pierky.wordpress.com/2009/10/28/automatically-filter