Routing and security

[Eliezer Croitoru]

Hey Alessandro,

As for you question:
There are two levels that you should notice while this can or cannot happen.
If your network has couple peers and for example the end of the Fiber 
Optic cables is attached at the IXP to a machine that you *own* you will 
see one thing.
While if your machine is in the other end of the cable and a switch that 
is owned by the IXP is managing the traffic your strategy would be 
different.

Since IXP have rules every participant would be obligated to not abuse 
other peers without at-least contact the IXP or ISP management.
If one of the peers would be found abusing you, he will need eventually 
to pay for the *usage* of bandwidth since it's the same thing like using 
your friend car without permission.

Most public IXP ISPs or companies would not try to abuse others peers 
intentionally but sometimes it can happen that an automated system was 
missing a "column" or whatever and someone made a mistake.

It would be preferable to define a rule in the switch that would not 
allow any "rouge" traffic to be dropped\blocked but this is not a 
security measure but a smart thing to implement if possible.

The basic general rule is to use a policy route rule that applies to a 
specific interface and specific traffic.
For example: "for interface0 allow only traffic from my internal src IPs"
This will protect you from rouge clients inside your network imposing to 
other IP addresses.

But this logic is more of a FIREWALL and\or IPTABLES logic.
In a router you don't want any unneeded processing that is above the 
routing level!

When you use a tool like PING for example and the kernel determines that 
there is no "route" in the routing table which matches the host it will 
drop in the terminal something like "no route to this host".
Inside a router it's another story in a completely lower level in the 
kernel.
The kernel "catch" a packet from the interface and put it in the 
corresponding routing "table" which then if found and only if found a 
route "best" matches it will use it to just "put" the packet into the 
cable again towards the next router in the network changing couple tiny 
binary data.

There should not be a "default" route in use in the router that applies 
also on the *forwarded* traffic.
(I will not say anything regarding using a default route globally)

Once you have a route policy which "throw" the traffic that is either 
flowing from your network IP masks or flowing towards your IP masks in 
the right interfaces you can throw it towards the right routing table 
which contains only the needed routes.
Remember that the packet has only one IP address as a src and one IP 
address as a dst which can be matched for two different interfaces but 
there are packets that will never contain src IP address on a specific 
interface.

If you must use IPTABLES for securing your router host there is a 
NO_TRACK module in IPTABLES which should assist you to avoid any 
connection tracking for the FORWARD table by removing any unneeded load 
on the kernel and kernel modules operations.

I have read about something regarding using packet MARKING(not 
connection marking) and IPTABLES which can help while applying dynamic 
rules on LB routers.

One system that can demonstrate a Linux routing system setup would be 
VYATTA which already uses quagga.

The algorithm that cisco or juniper apply that you have asked about is 
not public(to me) and in the case of a Linux kernel it would not even 
make sense to look at their settings or code.
It's sounds to me like "I have a drill and I want to put a nail in the 
wall".

I would just first ask at the IXP what administrative rules they have 
and what are the basic support I have from them about a case I need 
their help to block some traffic or even contact the abuser by phone or 
knock his office\home door.

Traffic flowing towards your router do add overhead to the CPU and 
power-consumption if continues a long period of time.

Regards,
Eliezer

On 03/12/13 14:04, Alessandro Brega wrote:
> Now for security I wonder if other participants could not simply route
> all their outgoing traffic through me? For example what happens if any
> other participant would point a default route to my IXP ip. If I
> understand correctly all outgoing traffic from that participant would
> then go to my router which would route it to the internet using my
> transit uplink, right?
>