Automatic Bogon Firewalling Using uRPF and Team Cymru - Revision history

Casey at 04:09, 16 April 2015

2015-04-16T04:09:16Z

Casey at 21:51, 25 November 2013

2013-11-25T21:51:51Z

Casey at 21:33, 25 November 2013

2013-11-25T21:33:47Z

Casey at 21:24, 25 November 2013

2013-11-25T21:24:02Z

Casey at 17:14, 8 November 2013

2013-11-08T17:14:23Z

Casey at 17:13, 8 November 2013

2013-11-08T17:13:57Z

Casey at 17:11, 8 November 2013

2013-11-08T17:11:17Z

Casey at 14:39, 8 November 2013

2013-11-08T14:39:46Z

Casey at 14:36, 8 November 2013

2013-11-08T14:36:58Z

Casey: Created page with "interface FastEthernet0 description EXTERNAL ip verify unicast reverse-path 100 ! router bgp 65504 bgp log-neighbor-changes neighbor CYMRU peer-group neighbor CYMRU remot..."

2013-11-08T14:27:53Z

Created page with "interface FastEthernet0 description EXTERNAL ip verify unicast reverse-path 100 ! router bgp 65504 bgp log-neighbor-changes neighbor CYMRU peer-group neighbor CYMRU remot..."

New page

interface FastEthernet0
description EXTERNAL
ip verify unicast reverse-path 100
!
router bgp 65504
bgp log-neighbor-changes
neighbor CYMRU peer-group
neighbor CYMRU remote-as 65000
neighbor CYMRU description CYMRU BOGONS LIST
neighbor CYMRU ebgp-multihop 255
neighbor CYMRU password 7 1234567890
neighbor CYMRU update-source Loopback6
neighbor 2000:B00:B00:10::2 peer-group CYMRU
neighbor 2000:C00:C00:10::2 peer-group CYMRU
!
address-family ipv4
neighbor CYMRU soft-reconfiguration inbound
neighbor CYMRU prefix-list CYMRU-OUT out
neighbor CYMRU route-map CYMRU-BOGONS in
neighbor 2000:B00:B00:10::2 activate
neighbor 2000:C00:C00:10::2 activate
no auto-summary
no synchronization
exit-address-family
!
ip route 192.0.2.1 255.255.255.255 Null0 name NULL_ROUTE_FOR_CYMRU_BOGONS
!
ip bgp-community new-format
ip community-list expanded CYMRU-BOGONS permit 65000:888
!
ip prefix-list CYMRU-OUT seq 10 deny 0.0.0.0/0 le 32
!
ip prefix-list CYMRU_NAT-T_FIX seq 10 permit 192.168.0.0/16
!
access-list 100 remark ---- ACL FOR URPF ----
access-list 100 permit udp any eq bootps any eq bootpc
access-list 100 deny ip any any
!
route-map CYMRU-BOGONS deny 5
description TO FIX NAT-T
match ip address prefix-list CYMRU_NAT-T_FIX
match community CYMRU-BOGONS
!
route-map CYMRU-BOGONS permit 10
description BOGONS LIST FOR URPF FILTERING
match community CYMRU-BOGONS
set ip next-hop 192.0.2.1

@@ Line 78: / Line 78: @@
 ==Fix for DMVPN==
-If you're running [[DMVPN]], you may run into some issues.  This could actually be a bug.  If you have client routers that are behind NAT, they are likely to have a private IP, and all the RFC1918 subnets are in the bogons list.  DMVPN attempts to communicate with the client using NAT Traversal (NAT-T) on UDP port 4500.  There appears to be a bug where the router will send packets addressed to the client's public IP out the next hop for the '''private'' IP (the null route).  So instead of sending out the WAN interface, it will send them out the null interface.  I verified this by replacing the null route with an interface route to a sniffer.
+If you're running [[DMVPN]], you may run into some issues.  This could actually be a bug.  If you have client routers that are behind NAT, they are likely to have a private IP, and all the RFC1918 subnets are in the bogons list.  DMVPN attempts to communicate with the client using NAT Traversal (NAT-T) on UDP port 4500.  There appears to be a bug where the router will send packets addressed to the client's public IP out the next hop for the ''private'' IP (the null route).  So instead of sending out the WAN interface, it will send them out the null interface.  I verified this by replacing the null route with an interface route to a sniffer.
 The solution is easy enough:  deny the routes from the BGP feed, and manually place the RFC1918 IPs in your WAN interface ACL.

@@ Line 14: / Line 14: @@
 ==Policies==
-First, set up the policy for received routes.  These can be identified by a BGP community, route tag, "any", or any other method that your route source provides.  In this case, I'm matching on the BGP community 65000:888.  Then I set up a null route.  It all comes together in the route-map, which matches the community, then sets the next hop to the null route.  Because the router will have a route for each bogon, uRPF will have a viable route to check against, even though it's a null route.
+First, set up the policy for received routes.  These can be identified by a BGP community, route tag, "any", or any other method that your route source provides.  In this case, I'm matching on the BGP community 65000:888.  Then I set up a null route.  It all comes together in the route-map, which matches the community, then sets the next hop to the null route.  Because the router will have a route for each bogon, uRPF will have a viable route to check against, even though it's a null route.  If you're running a dark net, you can set the next-hop IP as your collector, instead of the null interface.
 Lastly, we need an outbound policy.  This one sends no routes to the BGP peer.
@@ Line 64: / Line 64: @@
 ==uRPF==
 <PRE>
 access-list 100 remark ---- ACL FOR URPF ----
@@ Line 76: / Line 78: @@
 ==Fix for DMVPN==
 <PRE>
 ip prefix-list CYMRU_NAT-T_FIX seq 10 permit 192.168.0.0/16
 route-map CYMRU-BOGONS-IN deny 5
-  description TO FIX NAT-T
+  description TO FIX NAT-T ISSUE
   match ip address prefix-list CYMRU_NAT-T_FIX
   match community CYMRU-BOGONS-COMMUNITY
 </PRE>

@@ Line 11: / Line 11: @@
 It doesn't even need to be using Team Cymru's list.  If you have a bunch of routers, and just want some centralized firewall control, you can use this method.
-<PRE>
+The example below is using IPv6 transport for the BGP session, and is only receiving the IPv4 bogons.  You can mix and match any combination.  Just update your config accordingly.
-ip bgp-community new-format
-</PRE>
+==Policies==
 <PRE>
 ip community-list expanded CYMRU-BOGONS permit 65000:888
@@ Line 27: / Line 31: @@
 </PRE>
 <PRE>
 router bgp 65535
   bgp log-neighbor-changes
@@ Line 50: / Line 58: @@
 </PRE>
 <PRE>
 access-list 100 remark ---- ACL FOR URPF ----
@@ Line 60: / Line 70: @@
 </PRE>
 <PRE>
 ip prefix-list CYMRU_NAT-T_FIX seq 10 permit 192.168.0.0/16

@@ Line 8: / Line 8: @@
 * You've set up a dark net.  Instead of dropping packets from bogons, you could redirect them to a collector.
 * You want to be the Alpha Nerd.
 <PRE>

← Older revision		Revision as of 17:11, 8 November 2013
Line 1:		Line 1:
		+	A "bogon" is a prefix (IP subnet) that shouldn't be on the internet. These include RFC1918 private IP addresses, as well as public IP blocks that haven't been assigned to companies by their local RIR. The folks over at [http://www.team-cymru.org/ Team Cymru] have a great list of all the IPv4 and IPv6 bogons. It's updated frequently, and is available as static text files or a BGP feed.
		+
		+	Routers have an option called a uRPF check, short for Unicast Reverse Path Forwarding, which looks at an incoming packet and compares the source address against the routing table. If the packet was received on the same interface that the router would use for the return traffic, the packet is allowed though. Otherwise, it gets discarded. Combine this with the bogon routes you get from Team Cymru, and you've got automatic bogon filtering.
		+
		+	Why might you want it?
		+	* DDoS attacks may have spoofed source IPs, which could include bogon IPs.
		+	* Some nefarious people may be cyber squatting on some unassigned IPs, and using them for any number of less-than-good purposes.
		+	* You've set up a dark net. Instead of dropping packets from bogons, you could redirect them to a collector.
		+	* You want to be the Alpha Nerd.
		+
	<PRE>		<PRE>
	ip bgp-community new-format		ip bgp-community new-format

@@ Line 19: / Line 19: @@
 <PRE>
-ip community-list expanded CYMRU-BOGONS permit 65000:888
+ip community-list expanded CYMRU-BOGONS-COMMUNITY permit 65000:888
 ip route 192.0.2.1 255.255.255.255 Null0 name NULL_ROUTE_FOR_CYMRU_BOGONS
-route-map CYMRU-BOGONS permit 10
+route-map CYMRU-BOGONS-IN permit 10
   description BOGONS LIST FOR URPF FILTERING
-  match community CYMRU-BOGONS
+  match community CYMRU-BOGONS-COMMUNITY
   set ip next-hop 192.0.2.1
-ip prefix-list CYMRU-OUT seq 10 deny 0.0.0.0/0 le 32
+ip prefix-list CYMRU-BOGONS-OUT seq 10 deny 0.0.0.0/0 le 32
 </PRE>
 ==BGP==
 <PRE>
 ip bgp-community new-format
@@ Line 49: / Line 53: @@
   address-family ipv4
    neighbor CYMRU soft-reconfiguration inbound
-   neighbor CYMRU prefix-list CYMRU-OUT out
+   neighbor CYMRU prefix-list CYMRU-BOGONS-OUT out
-   neighbor CYMRU route-map CYMRU-BOGONS in
+   neighbor CYMRU route-map CYMRU-BOGONS-IN in
    neighbor 2000:B00:B00:10::2 activate
    neighbor 2000:C00:C00:10::2 activate
@@ Line 75: / Line 79: @@
 ip prefix-list CYMRU_NAT-T_FIX seq 10 permit 192.168.0.0/16
-route-map CYMRU-BOGONS deny 5
+route-map CYMRU-BOGONS-IN deny 5
   description TO FIX NAT-T
   match ip address prefix-list CYMRU_NAT-T_FIX
-  match community CYMRU-BOGONS
+  match community CYMRU-BOGONS-COMMUNITY
 </PRE>

@@ Line 28: / Line 28: @@
 <PRE>
-router bgp 65504
+router bgp 65535
   bgp log-neighbor-changes
   neighbor CYMRU peer-group