Discussion

8.7 Filtering Traffic Using Unicast Reverse-Path
Forwarding
Problem
You want to more adequately filter traffic that is not coming through the proper
interfaces to better prevent spoofing.
Solution
Turn on unicast reverse-path forwarding (RPF) on the router:
[edit routing-options]
aviva@router1# set forwarding-table unicast-reverse-path active-paths
Then enable it on the desired interface:
[edit interfaces so-0/0/0 unit 0 family inet]
aviva@router1# set rpf-check
Discussion
Unicast RPF is an extension of RPF, which is used by IP multicast routing protocols
to prevent multicast routing loops. As the name implies, unicast RPF verifies unicast
source addresses. When a router receives a packet, unicast RPF performs a route
lookup on the source address to determine the interface closest to the source address
(the reverse path to the source). If the receiving interface is not the closest interface,
the packet is dropped.
Unicast RPF is one mechanism for dealing with address-spoofing DoS attacks. In
these attacks, an intruder floods its target with packets that contain a spoofed source
address, essentially impersonating another system’s IP address. The flooding results
in a DoS at the target, and because the source address is spoofed, the true source of
the traffic is difficult to trace. UDP applications are more vulnerable to spoofing
attacks than TCP applications because, though TCP uses sequence numbers and
handshakes that require more than a single packet to establish and maintain a session,
UDP applications perform their own internal verification to ensure that a given
source is who it says it is and that the IP headers in the source of the packets have
not been forged. rlogin and other Unix r-utilities and X Windows are commonly subject
to spoofing attacks. DNS servers are also vulnerable to spoofing, because they
regularly send queries to obtain the IP addresses of hosts, and cache this information,
but do not authenticate the source of the answers they receive. This operation
makes it possible for an attacker to send false or improper answers to DNS queries,
thus poisoning the cache.
Figure 8-1 illustrates how a spoofing attack might work. The attacker, somewhere on
the Internet at 10.0.0.1, sends packets through your router to one of your customers
at 172.16.0.2.
266 | Chapter 8: IP Routing
This is the Title of the Book, eMatter Edition
Copyright © 2008 O’Reilly & Associates, Inc. All rights reserved.