[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]

Re: reconsidering default exit policy

On Fri, Mar 11, 2005 at 11:02:44AM +0100, Valient Gough wrote:
> Geoffrey Goodell wrote:
>># reject private networks (no surprises!)
>>ExitPolicy reject*
>>ExitPolicy reject*
>>ExitPolicy reject*
>>ExitPolicy reject*
>>ExitPolicy reject*
>>ExitPolicy reject*

> Also, is the list of private networks above exhaustive?

AFAIK, it would.

> I took my list of networks to block from my firewall list (from
> firehol.sourceforge.net):

> # IANA Reserved IPv4 address space
> # Suggested by Fco.Felix Belmonte <ffelix@xxxxxxxxxxxxx>
> # Optimized (CIDR) by Marc 'HE' Brockschmidt <marc@xxxxxxxxxxxxxxxxxxx>
> # Further optimized and reduced by http://www.vergenet.net/linux/aggregate/
> # The supplied get-iana.sh uses 'aggregate-flim' if it finds it in the path.
> 31.0
> .0.0/8
> 76.0.0.
> 0/6
> 176.0.0.
> 0/5"

At first sight, this looks like a BOGON list; these are IP ranges that
aren't allocated to anyone NOW (plus "special use"). So if anyone uses
these addresses NOW, it is a nasty spoofer. But these addresses can
get allocated in the future, it is thus *critical* for
interoperability that these bogon filters be used ONLY if the filter
*will* get updated *often* automatically, e.g. from
http://www.cymru.com/Bogons/ . And never in "configure once and don't
touch it" mode.

I might be a good idea to filter out multicast space, though. That's And other "special use" spaces:

  		"this" network - only for source,
				never destination
  	reserved for documentation and examples
  	reserved for benchmarks
  		"reserved for future use", and listed
	                        in the "martian" list; I suppose one
				doesn't expect assignments from this
				space before a long time, but it could
				happen, I guess. Or the space could be
				used for a totally different use.

(multicast plus reserved aggregate to

TCP connections to 6to4 auto-router space ( don't make
much sense either; we can filter those.