Linux Networking Cookbook

6.13. Blackholing Routes with Zebra

Problem

You are getting hit hard by a spammer or other pest, and you would like to drop all traffic from them at your router, instead of hassling with content or packet filters.

Solution

You can set null routes in zebra.conf with ip:

	ip route 22.33.44.55/24 null0

You may also do this in a telnet session:

	$ telnet localhost 2601
	router1> enable
	router1# configure terminal
	router1(config)# ip route 22.33.44.55/24 null0

Another way to do the same thing is with this command:

	router1(config)# ip route 22.33.44.55/24 blackhole

A variation on this is to use the reject option instead, which sends a "Network is unreachable" error:

	router1(config)# ip route 22.33.44.55/24 reject

Change your mind with a no command:

	router1(config)# no ip route 22.33.44.55/24 reject

Discussion

This blocks everything in the netblock that you specify, so you run the risk of blocking wanted traffic as well as unwanted if you cast your net too widely. Use ipcalc to tell you exactly which addresses you are blocking. CIDR notation lets you whittle it finely; for example, 22.33.44.55/32 is a single host address. 22.33.44.55/31 is two hosts, and 22.33.44.55/29 is six hosts. (Yes, ipcalc even calculates fake addresses.) 22.33.44.55/24 means you're blocking 254 addresses, and /8 is 16,777,214 addresses.

The incoming packets are not blocked; instead, nothing is sent back to the sender to tell them "neener neener, you're being dev-nulled." Or, to put it in more technical terms, the blackhole option ...