The Book of PF

Handling Nonroutable Addresses from Elsewhere

Even with a properly configured gateway to handle filtering and potentially network address translation for your own network, you may find yourself in the unenviable position of having to compensate for other people's misconfigurations.

One depressingly common class of misconfigurations is the kind that lets traffic with nonroutable addresses out to the Internet. Traffic from non routable addresses has also played a part in several Denial of Service (DoS) attack techniques, so it may be worth considering explicitly blocking traffic from nonroutable addresses from entering your network.

One possible solution is outlined below, which for good measure also blocks any attempt to initiate contact to nonroutable ...