<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
And by that he means: "only a few" =D.<br>
<pre class="moz-signature" cols="72">-----
Alain Hebert <a class="moz-txt-link-abbreviated" href="mailto:ahebert@pubnix.net">ahebert@pubnix.net</a>
PubNIX Inc.
50 boul. St-Charles
P.O. Box 26770 Beaconsfield, Quebec H9W 6G7
Tel: 514-990-5911 <a class="moz-txt-link-freetext" href="http://www.pubnix.net">http://www.pubnix.net</a> Fax: 514-990-9443
</pre>
<div class="moz-cite-prefix">On 6/2/21 12:40 AM, Stephen Satchell
wrote:<br>
</div>
<blockquote type="cite"
cite="mid:e3a227ea-bb9d-6b72-1751-512c3c85699f@satchell.net">Not
every uplink service implements BCP38. When putting up servers
connected more-or-less directly to the Internet through these
uplinks, it would be nice if the servers themselves were able to
implement ingress and egress filtering according to BCP38. (Sorry
about the typo in the subject lines of my previous message -- not
everyone can get a BGP feed.)
<br>
<br>
(Or, when using Ubuntu server edition to implement edge routers.)
<br>
<br>
My earlier query was asking if anyone has encoded the blackhole
routes in YAML for inserting in netplan(5). My prior message
contains the routes to be blackholed. That takes care of egress
routing.
<br>
<br>
(I think I can write a Python program to take my list and convert
it to the YAML that netplan(5) wants to see. That way, the routes
are inserted when the public interface is up, and removed when the
public interface is down.)
<br>
<br>
Ingress routing appears to be one-line addition. IPTABLES can be
told to weed out packets with unroutable source addresses. My
experiments will add something like this line to the firewall:
<br>
<br>
# iptables -A INPUT -m addrtype -i enp1s0 --src-type BLACKHOLE -j
DROP
<br>
<br>
THIS HAS NOT BEEN VERIFIED. I'm building a web server that will
integrate this idea, and try it out.
<br>
</blockquote>
<br>
</body>
</html>