Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have an Ubuntu 12.10 workstation with the following interfaces:

eth0 :
lo:1 :
lo:2 :
tap0 :

As you can see, all IPs fit in subnet.

Also I have Quagga on it that announces my link states to the other routers via OSPF. Here is my /etc/quagga/ospfd.conf:

router ospf
   passive-interface eth0


   redistribute kernel route-map MYMAP
   redistribute connected route-map MYMAP
   redistribute static route-map MYMAP

   network area

   ip prefix-list MYLIST seq 5 deny le 32
   ip prefix-list MYLIST seq 10 permit le 32
   ip prefix-list MYLIST seq 20 deny any

   route-map MYMAP permit 10
   match ip address prefix-list MYLIST

I'm failing in attempts to prevent Quagga from advertising route which is my local subnet.

Neither ip prefix-list MYLIST seq 5 deny le 32 nor ip prefix-list MYLIST seq 5 deny has no influence on the route advertising. The strangest thing is that Quagga keeps advertising routes even in case I change all prefix-list actions from permit to deny. Do you have any ideas what am I doing wrong?

share|improve this question

It looks like you should be using something like

distribute-list noeth0 out kernel
access-list noeth0 deny
access-list noeth0 permit any

The Quaggga OSPF daemon documentation is a bit vague there, though - you probably would have to tweak this a bit.

share|improve this answer
Is that a good idea to allow everything in the end? – Fmy Oen Jan 16 '13 at 9:19
@FmyOen this is not an "access list" in terms of security, it is just a list specifying a rule set to match against - in this case for a distribute-list directive which is doing route filtering based on the rule set. So what it should do is allow distribution of all kernel routes but the ones to – the-wabbit Jan 16 '13 at 10:50

First of all. Why are you redistributing and then blocking subnets that are picked up in the advertisement/routing statement? I see this time and time again when folks redistribute the kitchen sink and then try to block it later. This is fundamentally unsound. Finally, the link you want to exclude is covered in the routing statement and will be advertised as a stub network despite the passive interface command. Do not redistribute connected routes that are already included.

Those who advertise, redistribute everything, and then try to filter need to learn basic OSPF routing setup.

Get rid of the redistribute connected for starters. Keep the passive interface command and make your statement specific or even better place them on the specific interfaces you want to include.

router ospf 1
network area 0
network area 0
network area 0

or at a specific interface for example (no associated network statement above)

interface lo:1 
ip ospf 1 area 0

and do this for the other links that you want to include

Finally, DO NOT REDISTRIBUTE anything unless you absolutely have to.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.