Say you have a router with two subnets attached:

192.168.100/24 192.168.200/24

I plug my PC into the 192.168.100/24 network, but I statically set my IP address to be within 192.168.200/24 or any other IP out-of-subnet for that matter...

Assuming the circumstances are correct (or I otherwise force traffic to the default gateway), all routers I've tested accept this traffic coming from an interface that is known to be "192.168.100.xxx" despite the IP address being outside of that range.

Is there an easy setting to prevent traffic "leaving an interface" that hasn't a source address within the known subnet range? I'm just curious, but also feel that could be leveraged somehow maliciously. Or perhaps this is required and I'm not considering all situations.

  • Cisco: ip verify unicast reverse-path Linux: net.ipv4.conf.all.rp_filter ("all" can be an interface)
    – Ricky
    Feb 14 '15 at 1:56
  • That's what I'm seeking. I don't think I can flag a comment as an answer. If you post as answer I'll mark. Thanks.
    – Nathan
    Feb 14 '15 at 3:17
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin
    Aug 10 '17 at 23:22

For Cisco (IOS): ip verify unicast reverse-path

For Linux: set net.ipv4.conf.all.rp_filter to 1 ("all" can be an interface)

  • Also known as BCP 38. (bcp38.info)
    – cpt_fink
    Mar 17 '15 at 4:35
  • While this is most definitely the answer to this question, it might help future readers to provide a bit more context/background around what that command is actually doing... and maybe its limitation with the interface facing the default gateway.
    – Eddie
    Mar 17 '15 at 7:30

There are basically two approaches to this.

One is the firewalling aproach. You create explicit rules to restrict the traffic, for example on a Linux router you would create rules using iptables.

The other is the reverse path filtering approach discussed in RFC3704. This talks about three filtering modes. Strict, loose and feasible.

  • Strict mode only accepts packets if their input interface matches the best path for their source address.
  • Feasible mode only accepts packets if their input interface is a feasible path.
  • Loose mode only accepts packets if there is some route available to thier source address.

Strict mode is appropriate for tree networks where all routing is symetric and each destination is reachable through exactly one route but it is too strict for use in more complex networks.

Loose mode is useful for dropping private IP traffic on default-free routers but provides little protection against other spoofing and is pretty useless on systems that are not default-free.

Feasible mode provides somewhat effective filtering for more complex networks while reducing the risk of blocking legitimate traffic. However it is more troublesome to implement. Routers (both hardware and software) are designed to quickly determine if an IP is reachable and if-so what the best path is. Determining whether a path is feasible requires a different sort of table.

Systems may use different modes for different interfaces, so interfaces to simple user networks can be in strict mode while core interfaces and links to peers, upstreams and large customers can be in feasible or loose mode.

I get the impression that support for feasible mode is limited to high end routers.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.