I have a private network with a handful of Linux routers all route sharing via OSPF. How do I blackhole private network ranges that I don't have routes for?

In other words, I want to be sure I NEVER route, or out to the default gateway. I can't just create static sink (blackhole) routes for these networks as a network within one of the private ranges may get advertised via OSPF.

I could use netfilter to just DROP all traffic going out the default GW connected interface if its in a private range, but I figured iproute2/linux might have had a simpler or more 'correct' solution.

ip route add blackhole
ip route add blackhole
ip route add blackhole

Since more specific routes always take precedence, any ranges advertised via OSPF will take precedence over the blackhole routes.


router>sh ip route
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area 
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route

Gateway of last resort is to network

     xx.0.0.0/32 is subnetted, 2 subnets
C       xx.xx.xx.192 is directly connected, Dialer0
C       xx.xx.xx.1 is directly connected, Dialer0 is variably subnetted, 2 subnets, 2 masks
C is directly connected, Tunnel1
S is directly connected, Null0
C is directly connected, FastEthernet0/0
S* is directly connected, Dialer0
S is directly connected, Null0
S is directly connected, Null0

On Linux:

michael:~$ sudo ip route add blackhole 
michael:~$ ping
PING ( 56(84) bytes of data.
64 bytes from icmp_req=1 ttl=64 time=0.238 ms
64 bytes from icmp_req=2 ttl=64 time=0.180 ms
michael@challenger:~$ ping
connect: Network is unreachable
  • This is what I've ended up doing, I just configured it in my routing daemon. After setting up, I felt silly for forgetting a route is selected with the most specific first. bird.network.cz/?get_doc&f=bird-6.html#ss6.9
    – tMC
    Jul 27 '11 at 17:53

As long as you are thinking along these lines, you should know about the BOGON list. http://www.team-cymru.org/Services/Bogons/

And I would probably just use the netfilter/DROP like you suggested. The safest thing to do it keep the BOGON config at the external interface or firewall, so it is only in one place and doesn't break internal changes. If you have a firewall machine or an external router THAT is where I'd put the blocks. At the last possible step.

  • +1 for the Bogon List and the single-point filtering (at your public edge you should neither emit nor accept Bogons).
    – voretaq7
    Jul 27 '11 at 17:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.