BGP38 egress filter on Ubuntu Server

Stephen Satchell list at satchell.net
Tue Jun 1 20:43:03 UTC 2021


Before I re-invent the wheel, has anyone come up with blackhole route 
specifications for netplan in Ubuntu servers?  Such a capability would 
perform the egress blocking for an edge server.

The table of blackhole routes I would set up:
IPv4
Address block       Scope           Description
0.0.0.0/8           Software        Current network (only valid as
                                     source address).
10.0.0.0/8          Private network Used for local communications
                                     within a private network.
100.64.0.0/10       Private network Shared address space[3] for
                                     communications between a service
                                     provider and its subscribers
                                     when using a carrier-grade NAT.
127.0.0.0/8         Host            Used for loopback addresses to
                                     the local host.
169.254.0.0/16      Subnet          Used for link-local addresses
                                     between two hosts on a single
                                     link when no IP address is
                                     otherwise specified, such as
                                     would have normally been
                                     retrieved from a DHCP server.
172.16.0.0/12       Private network Used for local communications
                                     within a private network.
192.0.0.0/24        Private network IETF Protocol Assignments.
192.0.2.0/24        Documentation   Assigned as TEST-NET-1,
                                     documentation and examples.
192.88.99.0/24      Internet        Reserved. Formerly used for
                                     IPv6 to IPv4 relay
192.168.0.0/16      Private network Used for local communications
                                     within a private network.
198.18.0.0/15       Private network Used for benchmark testing of
                                     inter-network communications
                                     between two separate subnets.
198.51.100.0/24     Documentation   Assigned as TEST-NET-2,
                                     documentation and examples.
203.0.113.0/24      Documentation   Assigned as TEST-NET-3,
                                     documentation and examples.
224.0.0.0/4         Internet        In use for IP multicast.
240.0.0.0/4         Internet        Reserved for future use.
255.255.255.255/32  Subnet          Reserved for the "limited
                                     broadcast" destination address.

IPv6
Address block       Usage           Purpose
::/0                Routing         Default route.
::/128              Software        Unspecified address.
::1/128             Host            Loopback address to local host.
::ffff:0:0/96       Software        IPv4 mapped addresses.
::ffff:0:0:0/96     Software        IPv4 translated addresses.
64:ff9b::/96        Global Internet IPv4/IPv6 translation.
100::/64            Routing         Discard prefix.
2001::/32           Global Internet Teredo tunneling.
2001:20::/28        Software        ORCHIDv2.
2001:db8::/32       Documentation   Addresses used in documentation
                                     and example source code.
2002::/16           Global Internet The 6to4 addressing scheme
fc00::/7            Private network Unique local address.
fe80::/10           Link            Link-local address.
ff00::/8            Global Internet Multicast address.


More information about the NANOG mailing list