nanog mailing list archives

BGP38 egress filter on Ubuntu Server


From: Stephen Satchell <list () satchell net>
Date: Tue, 1 Jun 2021 13:43:03 -0700

Before I re-invent the wheel, has anyone come up with blackhole route specifications for netplan in Ubuntu servers? Such a capability would perform the egress blocking for an edge server.

The table of blackhole routes I would set up:
IPv4
Address block       Scope           Description
0.0.0.0/8           Software        Current network (only valid as
                                    source address).
10.0.0.0/8          Private network Used for local communications
                                    within a private network.
100.64.0.0/10       Private network Shared address space[3] for
                                    communications between a service
                                    provider and its subscribers
                                    when using a carrier-grade NAT.
127.0.0.0/8         Host            Used for loopback addresses to
                                    the local host.
169.254.0.0/16      Subnet          Used for link-local addresses
                                    between two hosts on a single
                                    link when no IP address is
                                    otherwise specified, such as
                                    would have normally been
                                    retrieved from a DHCP server.
172.16.0.0/12       Private network Used for local communications
                                    within a private network.
192.0.0.0/24        Private network IETF Protocol Assignments.
192.0.2.0/24        Documentation   Assigned as TEST-NET-1,
                                    documentation and examples.
192.88.99.0/24      Internet        Reserved. Formerly used for
                                    IPv6 to IPv4 relay
192.168.0.0/16      Private network Used for local communications
                                    within a private network.
198.18.0.0/15       Private network Used for benchmark testing of
                                    inter-network communications
                                    between two separate subnets.
198.51.100.0/24     Documentation   Assigned as TEST-NET-2,
                                    documentation and examples.
203.0.113.0/24      Documentation   Assigned as TEST-NET-3,
                                    documentation and examples.
224.0.0.0/4         Internet        In use for IP multicast.
240.0.0.0/4         Internet        Reserved for future use.
255.255.255.255/32  Subnet          Reserved for the "limited
                                    broadcast" destination address.

IPv6
Address block       Usage           Purpose
::/0                Routing         Default route.
::/128              Software        Unspecified address.
::1/128             Host            Loopback address to local host.
::ffff:0:0/96       Software        IPv4 mapped addresses.
::ffff:0:0:0/96     Software        IPv4 translated addresses.
64:ff9b::/96        Global Internet IPv4/IPv6 translation.
100::/64            Routing         Discard prefix.
2001::/32           Global Internet Teredo tunneling.
2001:20::/28        Software        ORCHIDv2.
2001:db8::/32       Documentation   Addresses used in documentation
                                    and example source code.
2002::/16           Global Internet The 6to4 addressing scheme
fc00::/7            Private network Unique local address.
fe80::/10           Link            Link-local address.
ff00::/8            Global Internet Multicast address.


Current thread: