Default Route and Blackhole Routing

[JasMan]

H all,

I've a general question about a best practise for noobs 🙂

Some clients in our network try to communicate with RFC1918/private IP addresses, which subnets are not existing in our network.
Therefore, the traffic takes the default route to our perimeter gateway (CP 9000 Appliance) which forwards it to the ISP line.

I think it's not a big problem, but I don't like to see traffic with private IP addresses as destination on our WAN line.

What are your suggestions to block or reject the traffic before it enters the ISP line?
Is blackhole routing a good idea? I'm not sure if the priority of smaller routes for a subnet within the blackhole route is higher. I'm afraid to block any traffic by adding a blackhole route like 10.0.0.0/8.

[Bob_Zimmerman]

I would look into why the rules are allowing the traffic out. If a private destination isn't in your network or at the other end of a VPN, you probably shouldn't have rules allowing traffic to it.

Routing should not be used for access control. Down that path lies incredible and lasting pain.

[the_rock]

I totally second what Bob said. If you think about it logically, say even if routes are 100% right, say if rule said any any block, then nothing would work, except web ui to 443 (ONLY that port) and ssh, thats it.

[simonemantovani]

Also for me, I agree with Bob and The_Rock, if there is traffic for RDC1918 private IP addressses that doesn't exist in your network the best solution is to create a rule to block this traffic (put the rule in the right position, before the rule that permit traffic to Internet.

[Alex-]

There are different aspects to this question. The policy should indeed be correctly articulated.

However in a controlled and segmented network, a blackhole route for private ranges with their largest subnet mask can eliminate back and forth traffic which would be accepted by the policy but would cause unnecessary sessions and load on the NIC's.

Let's say you route from your core the default to the FW and on the FW 10.0.0.0/8 to the core instead of the discrete networks you use.

Now an application with misconfigured, hardcoded or incorrect values would talk not to 10.1.1.1 but to 10.2.1.1 which doesn't exist. If somehow this flow would be permitted in the rules, you would have a loop until the TTL stops the party. Multiply this by hundreds or thousands depending on the architecture and you use X% of your capacity in useless traffic.

Whenever we can, we use those blackhole routes and ensure the supernets or segments are routed towards the core or reside on direct VLAN for a more intentional, predictable routing.

On top of a sensible security policy, of course.

[Vincent_Bacher]

Or do it different: no default route to internet breakouts.  😉