Re: BCP38 on public-facing Ubuntu servers

[William Herrin <bill () herrin us>]

On Wed, Jun 2, 2021 at 2:04 PM Grant Taylor via NANOG <nanog () nanog org> wrote:
> On 6/2/21 4:35 AM, Jean St-Laurent via NANOG wrote:
> > Maybe you can explore the in kernel feature call RP filter or reverse
> > path filter. In router gear it's called uRPF.
> >
> > cat /proc/sys/net/ipv4/conf/default/rp_filter
>
> +100 to rp_filter

rp_filter is great until your network is slightly less than a perfect
hierarchy. Then your Linux "router" starts mysteriously dropping
packets and, as with allow_local, Linux doesn't have any way to
generate logs about it so you end up with these mysteriously
unexplained packet discards matching no conceivable rule in
iptables... This failure has too often been the bane of my existence
when using Linux for advanced networking.

Regards,
Bill Herrin


-- 
William Herrin
bill () herrin us
https://bill.herrin.us/