{"id":2925,"date":"2011-05-23T01:37:25","date_gmt":"2011-05-23T07:37:25","guid":{"rendered":"http:\/\/gregsowell.com\/?p=2925"},"modified":"2011-05-19T13:37:59","modified_gmt":"2011-05-19T19:37:59","slug":"block-rfc-1918-spoofed-traffic","status":"publish","type":"post","link":"https:\/\/gregsowell.com\/?p=2925","title":{"rendered":"Block RFC-1918 Spoofed Traffic"},"content":{"rendered":"<p>A general rule of thumb in a service provider network is to block <a href=\"http:\/\/en.wikipedia.org\/wiki\/Private_network\">RFC-1918<\/a>(private addressing) address space.  You want to block this incoming from your upstream providers also, but generally filtering it in your network is a good idea.  You will also want to block any traffic coming from your provider sourced from your address space&#8230;why would you be sending yourself traffic from outside of your network with your own network addressing?<\/p>\n<p>First create the address-list that contains the RFC-1918 address space as well as the multicast range.<\/p>\n<pre class=\"gs-code\"><code class=\"language-plaintext\">\/ip firewall address-list\r\nadd address=192.168.0.0\/16 comment=&quot;&quot; disabled=no list=rfc-1918\r\nadd address=172.16.0.0\/12 comment=&quot;&quot; disabled=no list=rfc-1918\r\nadd address=10.0.0.0\/8 comment=&quot;&quot; disabled=no list=rfc-1918\r\nadd address=0.0.0.0\/8 comment=&quot;&quot; disabled=no list=rfc-1918\r\nadd address=224.0.0.0\/3 comment=&quot;&quot; disabled=no list=rfc-1918<\/code><\/pre>\n<p>Next create address-lists that contain the private addressing you might be using inside your network that is valid.<\/p>\n<pre class=\"gs-code\"><code class=\"language-plaintext\">\/ip firewall address-list\r\nadd address=10.0.0.0\/24 comment=&quot;&quot; disabled=no list=local-subnets<\/code><\/pre>\n<p>We then create two firewall rules.  One that allows our defined local-subnets and the next that blocks the rest of rfc-1918 and multicast.<\/p>\n<pre class=\"gs-code\"><code class=\"language-plaintext\">\/ip firewall filter\r\nadd action=accept chain=forward comment=\\\r\n    &quot;accept traffic from our local subnets&quot; disabled=no src-address-list=\\\r\n    local-subnets\r\nadd action=drop chain=forward comment=\\\r\n    &quot;block anything sourced from RFC-1918 and multicast.&quot; disabled=no \\\r\n    src-address-list=rfc-1918<\/code><\/pre>\n<p>If you are curious about who is sending what where, duplicate the drop rule, but change the action to log.  This will provide you with entrance\/exit interface, MAC address and source\/destination IP of the packets.  You can then lookup their MAC address and trace them down.<\/p>\n<p><strong>*NOTE*<\/strong> Exercise caution when logging.  If this is a high packet count spoofed attack, you may kill your router&#8217;s CPU.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>A general rule of thumb in a service provider network is to block RFC-1918(private addressing) address space. You want to block this incoming from\u2026<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[16,6,8,24],"tags":[],"class_list":["post-2925","post","type-post","status-publish","format-standard","hentry","category-cisco","category-mikrotik","category-networking","category-security"],"_links":{"self":[{"href":"https:\/\/gregsowell.com\/index.php?rest_route=\/wp\/v2\/posts\/2925","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/gregsowell.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/gregsowell.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/gregsowell.com\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/gregsowell.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2925"}],"version-history":[{"count":7,"href":"https:\/\/gregsowell.com\/index.php?rest_route=\/wp\/v2\/posts\/2925\/revisions"}],"predecessor-version":[{"id":2932,"href":"https:\/\/gregsowell.com\/index.php?rest_route=\/wp\/v2\/posts\/2925\/revisions\/2932"}],"wp:attachment":[{"href":"https:\/\/gregsowell.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2925"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/gregsowell.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=2925"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/gregsowell.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=2925"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}