Include basic reasonable set of IPv6 filters and update the IPv4 filter.
This should include all offical non routeable networks. It does not
include inofficial non routeable networks like unallocated space.
The prefixlen filter for IPv6 is a bit fuzzy as there is no defined
largest allocation. To my knowledge no network bigger or equal to a /19
was assigned and it makes sense to not allow /16 or bigger since those are
the blocks handled to the RIRs.
Is this OK?
--
:wq Claudio
Index: bgpd.conf
===================================================================
RCS file: /cvs/src/etc/bgpd.conf,v
retrieving revision 1.10
diff -u -p -r1.10 bgpd.conf
--- bgpd.conf 13 Oct 2010 08:27:44 -0000 1.10
+++ bgpd.conf 26 Nov 2010 12:14:26 -0000
@@ -77,18 +77,35 @@ neighbor 10.2.1.1 {
aes 4e0f2f1b5c4e3c0d0e2f2d3b8c5c8f0b
}
-# filter out prefixes longer than 24 or shorter than 8 bits
+# filter out prefixes longer than 24 or shorter than 8 bits for IPv4
+# and longer than 48 or shorter than 19 bits for IPv6.
deny from any
allow from any inet prefixlen 8 - 24
+allow from any inet6 prefixlen 19 - 48
# accept a default route (since the previous rule blocks this)
#allow from any prefix 0.0.0.0/0
-# filter bogus networks
+# filter bogus networks according to RFC5735
+deny from any prefix 0.0.0.0/8 prefixlen >= 8
deny from any prefix 10.0.0.0/8 prefixlen >= 8
-deny from any prefix 172.16.0.0/12 prefixlen >= 12
-deny from any prefix 192.168.0.0/16 prefixlen >= 16
+deny from any prefix 127.0.0.0/8 prefixlen >= 8
deny from any prefix 169.254.0.0/16 prefixlen >= 16
+deny from any prefix 172.16.0.0/12 prefixlen >= 12
deny from any prefix 192.0.2.0/24 prefixlen >= 24
+deny from any prefix 192.168.0.0/16 prefixlen >= 16
+deny from any prefix 198.18.0.0/15 prefixlen >= 15
+deny from any prefix 198.51.100.0/24 prefixlen >= 24
+deny from any prefix 203.0.113.0/24 prefixlen >= 24
deny from any prefix 224.0.0.0/4 prefixlen >= 4
deny from any prefix 240.0.0.0/4 prefixlen >= 4
+
+# filter bogus IPv6 networks according to IANA
+deny from any prefix ::/8 prefixlen >= 8
+deny from any prefix 2001:db8::/32 prefixlen >= 32 # docu range [RFC3849]
+deny from any prefix 2001:10::/28 prefixlen >= 28 # ORCHID [RFC4843]
+deny from any prefix 3ffe::/16 prefixlen >= 16 # old 6bone
+deny from any prefix fc00::/7 prefixlen >= 7 # unique local unicast
+deny from any prefix fe80::/10 prefixlen >= 10 # link local unicast
+deny from any prefix fec0::/10 prefixlen >= 10 # old side local unicast
+deny from any prefix ff00::/8 prefixlen >= 8 # multicast
