One of my BGP transit customers has asked me for a solution to make it easier for him to blackhole traffic within our network when he's suffering from DDoS attacks. Usually, BGP blackholing is done by blackholing the target, however, my customer is looking for a solution to blackhole based on the source address so the target of the attack won't be taken offline.

Building a blackhole solution based on the target address isn't that hard: just have the customer announce the target as a more specific route via a seperate BGP session or have him tag it with a specific community, then use a routing policy to set the next-hop to some discard interface.

Building a blackhole solution where sources of the attack (which are not within the customer's IP-space) are blackholed seems to be a bit harder. If I'd use the same solution as for filtering destinations my problem is that I only want to discard traffic from specific sources towards this specific customer, so inserting discard routes into my routing table isn't acceptable anymore since it would affect other customers as well. So I need some way to create a filter which only applies to this specific customer.

The first solution I was thinking about was to use BGPFlowspec. Unfortunately, this won't work for this specific customer since his equipment doesn't support it.

So what I've been looking for is a way to create a dynamic firewall filter based on some routing property, most likely a community set either by our customer or by us when receiving a specific route via a dedicated BGP blackhole session. This filter then can be applied on the customer's interfaces to block unwanted traffic. Unfortunately, I haven't found an easy way to create a firewall filter (or prefix-list) this way.

I did find http://thomas.mangin.com/posts/bgp-firewall.html, which 'misuses' SCU/DCU to more or less achieve what I'm looking for, but it does sound like a bit of a hack.

One of the other solutions I can think of is to create some static filter on our routes and build an interface which allows our customer to modify the prefix-list used by this filter. However, pushing configuration changes on my routers every time the customer wants to add a blackhole isn't really what I want. Some solution using BGP would be preferred.

On our side routing is done on Juniper, for a solution I'd prefer to have something which can be used on a variety of platforms, so it basically should just us BGP via a separate session or tagging routes via a specific community. This way I can use it for other customers as well.

I'm really interested if anyone has a nice solution for this (other than the SCU/DCU one).

  • Did you ever figure this out, I know this is super old, figured it might be worth checking? What platform are you using? – Jordan Head Jun 24 '15 at 1:28
  • @JordanHead unfortunately not, I more or less gave up on this. We run a platform of various Juniper MX routers (5/80/104 mostly). – Teun Vink Jun 24 '15 at 5:03
  • How many source addresses are attacking? – Jordan Head Jun 25 '15 at 14:25
  • That would be up to the customer and should be dynamic, but at least tens or hundreds should be possible. I'm looking for something which enables my customer to insert sources for which traffic isn't delivered to their network via BGP. Perhaps it's easier to just offer access via a portal to a dedicated box inserting blackhole (flowspec)routes. – Teun Vink Jun 25 '15 at 14:57
  • Look into ExaBGP, written by Thomas Mangin (SCU/DCU hack author) - fully programmable BGP daemon, which supports Flowspec. Putting a portal interface on this for your customer would be a nice solution – Benjamin Dale Jul 13 '15 at 12:32

GRNET (the Greek Research and Education network) have developed a web application for customers to do this with Flowspec. The web portal has a BGP Flowspec backend which injects flowspec into your network. Highly configurable and in use on the 500-1,000 Gbps pan-European GEANT backbone: https://www.noc.grnet.gr/en/fod

up vote 1 down vote accepted

To (finally) answer my own question:

This is not possible the way I want to implement this with the currently supported versions of JunOS. Yes, there are other ways to reach the goal as were mentioned in the other answer and in comments, but my specific question was to be able to signal blackholing using a BGP session.

Dynamic Creation of firewall rules is not only to redirect the traffic for a blachole but also to allow inter-datacenter, inter corporate and intranet traffic geo-distributed, to have firewall policies defined with ip abstraction, using some labelling on the dynamic routing to populate firewall objects and then to allow for the control of the traffic. I searched for a solution like that some years ago with Juniper but I did not have any feedback. There are some scripting on Junos which may help on the subject but then the object population was not completely done in response to routing exchange events. There was also no possibility to tag direct routes in order to classify them according to the needs:

  • If there would be a network for backends on one datacenter then this could be tagged using a "backend tag" directly on the interface
  • On the dynamic routing this "backend tag" could be translated into a community (e.g. BGP SoO) and advertised with that
  • The remote datacenter would receive the advertised network and populate an object group of addresses that could direct access other backends.

FlowSpec could be a help and a firewall which could connect directly to the mpls core as a PE would be also a help. Does someone know about such a solution?

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.