[c-nsp] Dropping traffic based on source address

[Rodney Dunn]

I actually did some checking.

What you would do is turn on Loose uRPF and announce the
networks you want to drop with a next hop that points to Null0.
Just like you do for normal remote triggered blackhole filtering.

ip verify unicast source reachable-via any

But when you enable Loose uRPF if the lookup on the source
matches a Null0 interface you drop it.

On Thu, Jun 30, 2005 at 11:11:55PM -0400, Rodney Dunn wrote:
> Thinking out loud on this one...
> 
> But could you spoof the routing advertisement to make
> it look like it come in from a different interface
> and then enable uRPF and let it drop the traffic on ingress?
> 
> On Fri, Jul 01, 2005 at 11:47:11AM +0930, Brad Gould wrote:
> > Hi!
> > 
> > We have a (large) list of spamming evil hosts/networks we would like 
> > block from our mail servers. (~500k entries)
> > 
> > The list is being imported into the routing table via bgp, and we can 
> > drop the return path traffic, using PBR.  But the initial syn traffic is 
> > getting through to the servers.
> > 
> > I'd like to drop the inbound traffic, based on its source address, but I 
> > cant construct a sensible ACL - there are too many entries (around 500k).
> > 
> > But can I match based on known routes in the routing table, and apply 
> > that on the way into the network?
> > 
> > Any ideas?
> > 
> > Thanks
> > 
> > Brad
> > 
> > -- 
> > Brad Gould, Network Engineer
> > Internode
> > PO Box 284, Rundle Mall 5000
> > Level 3, 132 Grenfell Street, Adelaide 5000
> > P: 08 8228 2999  F: 08 8235 6999
> > bradley at internode.com.au; http://www.internode.on.net/
> > _______________________________________________
> > cisco-nsp mailing list  cisco-nsp at puck.nether.net
> > https://puck.nether.net/mailman/listinfo/cisco-nsp
> > archive at http://puck.nether.net/pipermail/cisco-nsp/