4

From the way I understand it, Source based RTBH (http://packetlife.net/blog/2010/aug/23/source-based-rtbh/) works on the principle that only if the routing entry for the IP address is present, it will allow the packet through.

My understanding is that if I initiate the connection to 123.123.123.123 (which is on the internet) then the response will be allowed to enter as the FIB will see that the request was actually initiated from my end (hopefully this is a correct understanding).

My question is that at any given time.. someone will always be on Google, or Wikipedia. So how can one prevent an attack from someone who is spoofing their IP and using the IP of a large organisation such as Google or Wikipedia.

If my understanding is correct, If I initiate the connection to Google, then the response will be allowed in (as the FIB will see that I sourced it), but how would it know that it was someone impersonating Google that is re-entering.

  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide your own answer and accept it. – Ron Maupin Aug 6 '17 at 23:57
4

I think you are both misunderstanding how RTBH works and what it is designed to do.

My understanding is that if I initiate the connection to 123.123.123.123 (which is on the internet) then the response will be allowed to enter as the FIB will see that the request was actually initiated from my end (hopefully this is a correct understanding).

I'm afraid that's not how S/RTBH works. The router doesn't know who initiated a connection; routers generally do not maintain connection state (firewalls do that). Routers treat each packet individually, so the routing decision for an individual packet is made without regard to what happened before.

S/RTBH works because you are, in effect, spoofing the route: you tell your border router that the attacker's IP is inside your network, not on the Internet. When the router receives the bad packet from the outside interface, the RPF check fails and the packet is dropped because the router thinks the IP is on the inside.

S/RTBH can't protect against spoofed packets. It can only protect from known bad source IPs. In that sense, it works like an access list, but more efficiently.

| improve this answer | |
  • 1
    "Loose URPF checks the packet and forwards it if there is a route entry for the source IP of the incoming packet in the router FIB. If the router does not have a FIB entry for the source IP address, or if the entry points to Null0, the Reverse Path Forwarding (RPF) check fails, and the packet is dropped." Does this not mean the border router checks for a matching FIB entry and only allows it if it exists? actually how is a FIB entry recorded on the Border router? – user2883071 Sep 18 '15 at 17:26
  • Yes, the router checks to see if the route to the source address (of the attack packet) uses the same interface it was received on. The FIB is based on the routing table. It has nothing to do with traffic flows. – Ron Trunk Sep 18 '15 at 17:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.