MavEtJu's Distorted View of the World - 2004-07

When routing goes bad....

Back to index

When routing goes bad....

Posted on 2004-07-02 10:54:01, modified on 2006-01-09 16:29:22
Tags: Networking, FreeBSD

At BarNet, our backup link to the internet goes via a different ISP which is charged per megabyte. Being the backup link, this normally doesn't give much problems. Except when we suddenly got a nasty bill for it. Time for some investigation... (read on)

At this moment, we have say four class C networks ( - The first two are allocated, the last two are in use for later. Our IP space is part of the IP space of the backup ISP. Our default gateway is pointing to our normal ISP, and we route the IP space of the backup ISP directly to our backup ISP. Or in a picture:        -> normal ISP   -> backup ISP   -> LAN A   -> LAN B

What happens when a packet comes in for It gets forwarded to the LAN A. What happens when a packet for comes in? It gets forwarded to the LAN B. And what happens when a packet for comes in? The network is not in the routing table, so it takes the next smallest one: And the packet goes happily on its way to the backup ISP. But then, it gets send back to us, because the backup ISP knows that is on our network. It keeps bouncing between the backup ISP and us until its TTL has expired. Each other bounce is charged to us...

The solution is to add an entry for all our networks in the routing table of one of the machines which gets null-routed: routed into a "network"-device which just discards all packets. Don't go playing with firewall rules, that will only cause problems later when the spare IP space gets used and things suddenly don't work anymore and nobody knows why.

On FreeBSD, the discard device is called disc(4). Just kldload if_disc and you can ifconfig ds0. An IP address is not necessary (trying to add one on FreeBSD 4.7 causes the machine to panic, but with 4.10 it worked). In your /boot/loader.conf, add a line with if_disc_load="YES". In your /etc/rc.conf, add a line with cloned_interfaces="ds0". And as the last one, add a line to your /etc/rc.conf with route_discard=" -interface ds0".

From that moment, your routing table will look like:        -> normal ISP   -> backup ISP   -> ds0   -> LAN A   -> LAN B

and there will be no more billing for unwanted traffic from the backup ISP!

No comments | Share on Facebook | Share on Twitter