Documentation
Dropping traffic
arriving from
the internet
The configuration you already have drops traffic your network sends to a blackholed address. Dropping traffic that arrives from one is a different mechanism, and it is one line per interface.
Two different problems
A blackhole route is a route to a destination. Installing it with a discard next-hop means packets addressed to that destination are dropped in the forwarding table. That is destination-based RTBH, and it is what the generated configuration sets up.
It does nothing about a scanner in that same prefix connecting to you. The packet is addressed to your address, so the blackhole route is never consulted.
| Direction | Matches on | Mechanism |
|---|---|---|
| Outbound — you to them | destination address | discard route (already configured) |
| Inbound — them to you | source address | loose uRPF (this page) |
How source-based RTBH works
Unicast Reverse Path Forwarding asks a simple question of every arriving packet: if I had to send a reply to this source, where would it go? In loose mode it does not care which interface the answer points at — only whether a usable path exists.
Your BlackHawk routes make that question answer itself. A blackholed prefix is in your FIB pointing at 192.0.2.1 — or 100::1 for IPv6 — which you have already routed to a discard interface. So when a packet arrives from an address inside that prefix, the reverse lookup lands on a discard route, uRPF fails, and the packet is dropped in hardware — before any ACL, before the firewall, at line rate.
No new feed, no new session, no ACL to maintain. The same routes you already receive start working in both directions.
Loose, not strict
Strict uRPF also requires the reply to leave via the interface the packet arrived on. That is false for any multihomed network with asymmetric routing, and it will drop legitimate traffic. Use loose mode — reachable-via any — everywhere except a single-homed edge you are certain about.
The default-route trap
Read this before you configure anything. Getting it wrong takes your edge off the internet.
Loose uRPF drops a packet when the source has no usable route. If your edge router carries a full BGP table, every legitimate source on the internet has a specific route, so this is safe as written.
If your edge router only has a default route, almost no source has a specific route — and by default uRPF does not count the default route as a usable path. Enable it as written and the router will drop essentially all inbound traffic.
If you do not carry a full table, add allow-default
ip verify unicast source reachable-via any allow-default
Legitimate sources then pass via the default route, while blackholed sources still fail — because the BlackHawk prefix is more specific than 0.0.0.0/0, so the discard route is what the lookup actually finds. You lose nothing by adding it, and on a default-only edge it is the difference between a filter and an outage.
Not sure which you have? show ip route summary — hundreds of thousands of routes means a full table, a handful means default-only.
Configuration
Applied to the internet-facing interface — the one untrusted traffic arrives on. Never on internal interfaces, where it will drop legitimate asymmetric traffic and teach everyone to distrust the feature.
Cisco IOS / IOS-XE
interface GigabitEthernet0/0/0 ip verify unicast source reachable-via any allow-default ipv6 verify unicast source reachable-via any allow-default
Cisco IOS-XR
interface TenGigE0/0/0/0 ipv4 verify unicast source reachable-via any allow-default ipv6 verify unicast source reachable-via any allow-default
Cisco NX-OS
interface Ethernet1/1 ip verify unicast source reachable-via any allow-default ipv6 verify unicast source reachable-via any allow-default
Arista EOS
interface Ethernet1 ip verify unicast source reachable-via any allow-default
Juniper Junos
Junos calls it an RPF check and sets the mode per family. Loose mode is rpf-check mode loose; there is no separate allow-default, because loose mode on Junos already accepts a default route as a feasible path.
set interfaces xe-0/0/0 unit 0 family inet rpf-check mode loose set interfaces xe-0/0/0 unit 0 family inet6 rpf-check mode loose
FRRouting / Linux
uRPF is a kernel function rather than an FRR one. 2 is loose mode; 1 is strict and will break asymmetric routing.
sysctl -w net.ipv4.conf.eth0.rp_filter=2 sysctl -w net.ipv4.conf.all.rp_filter=2 # persist it echo 'net.ipv4.conf.eth0.rp_filter = 2' >> /etc/sysctl.d/99-urpf.conf
Other platforms
Nokia SR OS, Huawei VRP, FortiOS and Aruba AOS-CX all implement loose uRPF, but the stanza differs enough between releases that we would rather point you at your vendor’s documentation than have you paste something from ours into a production edge. Search for “loose uRPF” or “unicast reverse path forwarding”. The mechanism and the default-route caveat above apply identically.
Choosing what to apply it to
uRPF acts on every route in your FIB that resolves to the discard next-hop — it cannot distinguish one BlackHawk category from another. That matters, because the categories differ in how comfortable you should be dropping inbound from them.
| Category | Dropping inbound is… |
|---|---|
| C2, malware, scanners | exactly what you want — these are the hosts probing you |
| GeoIP | a decision, not a default — this refuses every inbound connection from that country, including customers and remote staff |
If you subscribe to GeoIP categories and want them for outbound only, run a second session with a separate discard next-hop that is not covered by uRPF, and subscribe each session to different categories. Ask us and we will set the second session up.
Verifying and rolling back
Turn it on during a change window on one interface, and watch the drop counter.
Cisco — is it dropping anything?
show ip interface GigabitEthernet0/0/0 | include verify|drop
Cisco — see the drops as they happen
show cef drop
Linux
# rp_filter drops are counted per-interface cat /proc/net/netstat | grep -i ipreversepathfilter
A counter climbing steadily is the feature working. A counter that jumps and coincides with users complaining means either strict mode, or loose mode without allow-default on a router that has no full table.
Rolling back is one line
interface GigabitEthernet0/0/0 no ip verify unicast source reachable-via any
It fails open, not closed
If the BGP session drops, the routes withdraw, the discard entries leave the FIB and uRPF stops matching them. Losing BlackHawk costs you the filtering — it does not black-hole your network.