nanog mailing list archives
Re: BCP38 on public-facing Ubuntu servers
From: Fran via NANOG <nanog () nanog org>
Date: Tue, 8 Jun 2021 23:38:59 +0200
Hey, to my knowledge there is no IPv6 equivalent for net.ipv4.conf.all.rp_filter. Therefore I use netfilter to do the RP filtering for both address families. ip(6)tables -t raw -I PREROUTING -m rpfilter --invert -j DROP Using the raw tables less resources are used, but you could also choose other tables. Details abour rpfilter can be found here [1]. This can also be achieved using nftables [2]. Best Fran [1] https://ipset.netfilter.org/iptables-extensions.man.html#lbBX [2] https://wiki.nftables.org/wiki-nftables/index.php/Matching_routing_information On 04.06.21 20:43, Jay Vosburgh wrote:
Grant Taylor via NANOG <nanog () nanog org> wrote:On 6/3/21 8:44 AM, William Herrin wrote:rp_filter is great until your network is slightly less than a perfect hierarchy. Then your Linux "router" starts mysteriously dropping packets and, as with allow_local, Linux doesn't have any way to generate logs about it so you end up with these mysteriously unexplained packet discards matching no conceivable rule in iptables... This failure has too often been the bane of my existence when using Linux for advanced networking.I don't remember the particulars, but I thought that was the domain of log_martians (net.ipv4.conf.*.log_martians). Without log_martians or explicitly looking for such, no, you won't get any indication of such drops.Yes, enabling the log_martians sysctl will generate a kernel log message for each rp_filter failure (subject to rate limiting). There are also stat counters in /proc/net/stat/rt_cache (one line per CPU) for in_martian_dst and in_martian_src which increment regardless of the log_martians setting. The rp_filter sysctl defaults to strict mode (== 1) on Ubuntu, but can be set to loose mode (== 2); the difference is, essentially, in strict mode the reverse path must be the same interface as the ingress interface, whereas in loose mode the reverse path can be any interface (as long as the source address is reachable). https://www.kernel.org/doc/Documentation/networking/ip-sysctl.rst -J --- -Jay Vosburgh, jay.vosburgh () canonical com
Current thread:
- BCP38 on public-facing Ubuntu servers Stephen Satchell (Jun 01)
- RE: BCP38 on public-facing Ubuntu servers Jean St-Laurent via NANOG (Jun 02)
- Re: BCP38 on public-facing Ubuntu servers Grant Taylor via NANOG (Jun 02)
- Re: BCP38 on public-facing Ubuntu servers William Herrin (Jun 03)
- Re: BCP38 on public-facing Ubuntu servers Grant Taylor via NANOG (Jun 03)
- Re: BCP38 on public-facing Ubuntu servers Jay Vosburgh (Jun 04)
- Re: BCP38 on public-facing Ubuntu servers Fran via NANOG (Jun 08)
- Re: BCP38 on public-facing Ubuntu servers Stephen Satchell (Jun 08)
- RE: BCP38 on public-facing Ubuntu servers Jean St-Laurent via NANOG (Jun 09)
- Re: BCP38 on public-facing Ubuntu servers Grant Taylor via NANOG (Jun 02)
- RE: BCP38 on public-facing Ubuntu servers Jean St-Laurent via NANOG (Jun 02)