Quagga routing and security

Question

I have a quagga router with two transit neighbors and announcing my own IP space. I recently joined a public peering exchange (IXP) and so I'm part of their local network (/24), together with all other participants. So far everything works fine.

Now for security I wonder if other participants could not simply route all their outgoing traffic through me? For example what happens if any other participant would point a default route to my IXP ip. If I understand correctly all outgoing traffic from that participant would then go to my router which would route it to the internet using my transit uplink, right?

So I wonder if I have to take any measures against it. My ideas are:

1. Setup firewall (iptables) rules so that only traffic with a destination of my own IP space is accepted from other IXP participant. Drop any other traffic from IXP participants.

2. Somehow make quagga use a different kernel routing table for each neighbor (or peer-group). The routing table for the IXP neighbors would not contain any entries except for my own IP space and so no routing using my ip transit uplinks would occur. Looking at the output of ip rule show shows quagga is not doing this automatically?

Am I on the right track? Why is 2. not implemented in Quagga directly? How do hardware routers (cisco, juniper, ..) deal with this problem?

Answer 1

You're right, if you don't take any measures this could happen. It's a violation of the acceptable use policy of most IXP's I know, but still you want to prevent it from happening.

Your first solution is a good thing to do and will solve your problem. Just make sure you don't keep track of session state in iptables, that will probably kill performance or even your router.

You could consider to do outbound filtering as well in a similar way: do not allow packets to leave your network originating from unknown sources. This will prevent prevent hosts in your network from sending spoofed IP packets, which are commonly used in DDoS attacks.

I wouldn't implement the second solution. It's complicated and doesn't scale well if you have multiple routers handling your transits and peerings or if you have a large number of peering sessions (a couple of hunderds on an IXP isn't that uncommon).

On all the hardware router platforms I know this problem is solved in configuration by configuring RPF on the outbound interface and/or by writing filters.

Answer 2

If you're running Quagga on a Linux box, you can enable RPF by setting kernel parameter net.ipv4.conf.default.rp_filter to 1 or 2.

Please see this page for more details: http://www.slashroot.in/linux-kernel-rpfilter-settings-reverse-path-filtering

Answer 3

As far as I understand it you have 2 connections to transit providers and 1 connection to a peering point, in this situation I assume that you are using BGP to peer with your transit providers and with an IXP router.

The way BGP works is others can only reach the destinations you advertise to them. So for example you have a /24 and you will advertise this to your transit providers so hosts on the internet can reach you through you transit peers and you would also advertise your /24 to the peering point so that hosts connected to the peering point can reach you directly without going over the internet (as this would be seen as the best path).

For BGP sessions you would normally be filtering what you advertise to your peers and what they advertise to you (if you have downstream peers) with a prefix list for example. Generally you wont filter inbound from the peering exchange as the exchange will only send you routes of people connected on the exchange. This is similar to your transit providers except they will generally send you the full global routing table (all destinations on the internet).

In this situation you would add a prefix list matching an ACL in the outbound direction on the BGP session connected to the peering point to only advertise your /24 prefix this will allow hosts on the peering exchange to reach only IP's in your /24 via your router (which is what you want).

If someone advertises a default route to you and you accept it, you wont be taking their traffic and sending it to the internet. In this situation you would see a route to the internet via them because your router will see a route to 0.0.0.0/0 (the internet) through them because they advertised it to you.

The only time hosts connected to the peering exchange will see the internet via you is if you advertise a default route on to the exchange yourself. The only other time you may be used as a “transit AS” is if you have customers that are downstream peers with you and they ask that you advertise their IP space to the IXP so they can reach the exchange through you.