<HTML><BODY><br><br><br>Вторник, 3 декабря 2013, 13:04 +01:00 от Alessandro Brega <alessandro.brega1@gmail.com>:<br>
<blockquote style="border-left:1px solid #0857A6;margin:10px;padding:0 0 0 10px;"><div id=""><div class="js-helper js-readmsg-msg"><div id="style_13860722630000000739" class="mr_read__body"><div id="style_13860722630000000739_BODY"><div dir="ltr"><p style="margin:0px 0px 1em;padding:0px;border:0px;font-size:14px;vertical-align:baseline;clear:both;color:rgb(0,0,0);font-family:Arial,'Liberation Sans','DejaVu Sans',sans-serif;line-height:18px">
Hi guys,</p><p style="margin:0px 0px 1em;padding:0px;border:0px;font-size:14px;vertical-align:baseline;clear:both;color:rgb(0,0,0);font-family:Arial,'Liberation Sans','DejaVu Sans',sans-serif;line-height:18px">
right now I have a quagga router, but I'm open to switch to bird if it makes sense and helps me with my problem below.<br></p><p style="margin:0px 0px 1em;padding:0px;border:0px;font-size:14px;vertical-align:baseline;clear:both;color:rgb(0,0,0);font-family:Arial,'Liberation Sans','DejaVu Sans',sans-serif;line-height:18px">
My router has two transit neighbors and announcing my own IP space. I recently joined a public peering exchange (IXP) and so I'm part of their local network (/24), together with all other participants. So far everything works fine.</p><p style="margin:0px 0px 1em;padding:0px;border:0px;font-size:14px;vertical-align:baseline;clear:both;color:rgb(0,0,0);font-family:Arial,'Liberation Sans','DejaVu Sans',sans-serif;line-height:18px">Now for security I wonder if other participants could not simply route all their outgoing traffic through me? For example what happens if any other participant would point a default route to my IXP ip. If I understand correctly all outgoing traffic from that participant would then go to my router which would route it to the internet using my transit uplink, right?</p><p style="margin:0px 0px 1em;padding:0px;border:0px;font-size:14px;vertical-align:baseline;clear:both;color:rgb(0,0,0);font-family:Arial,'Liberation Sans','DejaVu Sans',sans-serif;line-height:18px">So I wonder if I have to take any measures against it. My ideas are:</p><ol style="margin:0px 0px 1em 30px;padding:0px;border:0px;font-size:14px;vertical-align:baseline;list-style-position:initial;color:rgb(0,0,0);font-family:Arial,'Liberation Sans','DejaVu Sans',sans-serif;line-height:18px"><li style="margin:0px;padding:0px;border:0px;vertical-align:baseline;background-color:transparent"><p style="margin:0px 0px 1em;padding:0px;border:0px;vertical-align:baseline;background-color:transparent;clear:both">Setup firewall (iptables) rules so that only traffic with a destination of my own IP space is accepted from other IXP participant. Drop any other traffic from IXP participants.</p></li></ol></div></div></div></div></div></blockquote><blockquote style="border-left:1px solid #0857A6;margin:10px;padding:0 0 0 10px;"><div id=""><div class="js-helper js-readmsg-msg"><div id="style_13860722630000000739" class="mr_read__body"><div id="style_13860722630000000739_BODY"><div dir="ltr"><ol style="margin:0px 0px 1em 30px;padding:0px;border:0px;font-size:14px;vertical-align:baseline;list-style-position:initial;color:rgb(0,0,0);font-family:Arial,'Liberation Sans','DejaVu Sans',sans-serif;line-height:18px"><li style="margin:0px;padding:0px;border:0px;vertical-align:baseline;background-color:transparent"><p style="margin:0px 0px 1em;padding:0px;border:0px;vertical-align:baseline;background-color:transparent;clear:both">Somehow make quagga use a different kernel routing table for each neighbor (or peer-group). The routing table for the IXP neighbors would not contain any entries except for my own IP space and so no routing using my ip transit uplinks would occur. Looking at the output of ip rule showshows quagga is not doing this automatically? Would bird do this automatically?</p></li></ol></div></div></div></div></div></blockquote>Not sure about quagga and multiple kernel routing tables (at least without external patch), but BIRD supports multiple routing tables internally and each internal table could be attached and synchronized with kernel. By using Linux PBR (Policy-Based Routing) mechanisms (see ip-rule(8) for more information) you could accomplish task in your second setup (different kernel routing tables).<br><br>An minimal PBR config might look like this:<br>-----------------------------------------------------<br><br>ip -4 rule add pref 10000 iif <iface2ixp> table ixp<br>ip -4 rule add pref 10000 iif lo from <ip_on_iface2ixp> table ixp<br><br>(do not forget to add mapping between symbolic name of the routing table "ixp" and routing table number to /etc/iproute2/rt_tables)<br><br>In BIRD configuration you should create routing table instance, attach kernel syncer protocol to it (kernel protocol).<br>Populate routing table at least with following routes: directly connected network on <iface2ixp> (needed to establish<br>sessions with IXP RSes for example), routes to your ip space, blackhole default route (to match all other routes not in table<br>and drop traffic).<br><br><span class="Apple-style-span" style="font-family: Arial, 'Liberation Sans', 'DejaVu Sans', sans-serif;font-size: 14px;line-height: 18px;">Am I on the right track? How do other routers like bord or hardware routers (cisco, juniper, ..) deal with this problem?<br></span><br><blockquote style="border-left:1px solid #0857A6;margin:10px;padding:0 0 0 10px;"><div id=""><div class="js-helper js-readmsg-msg"><div id="style_13860722630000000739" class="mr_read__body"><div id="style_13860722630000000739_BODY"><div dir="ltr"><p style="margin:0px 0px 1em;padding:0px;border:0px;font-size:14px;vertical-align:baseline;clear:both;color:rgb(0,0,0);font-family:Arial,'Liberation Sans','DejaVu Sans',sans-serif;line-height:18px">
Thank you for any help!</p><p style="margin:0px 0px 1em;padding:0px;border:0px;font-size:14px;vertical-align:baseline;clear:both;color:rgb(0,0,0);font-family:Arial,'Liberation Sans','DejaVu Sans',sans-serif;line-height:18px">
Alessandro</p></div></div></div></div></div></blockquote>
<br>
<br>--
<br>SP5474-RIPE
<br>Sergey Popovich<br></BODY></HTML>