4 ms·
1) Why in the world are you exposing your router control planes to the outside world? That should be ACL'd off (in stateless firewall rules and routing engine)
by scurvy 11y ago
1) Why in the world are you exposing your router control planes to the outside world? That should be ACL'd off (in stateless firewall rules and routing engine) to only allow access from a few IP's.
2) Your transit providers should be defending their infrastructure. I've never seen a transit provider allow an attacker to take out their /30 serials or IX addresses. This is their network after all. If attackers try to hit the serial between customer and provider, you just readdress the serial to RFC1918 space. You don't really need a routable address there other than to make traceroutes easy to read. If they attack farther upstream in the provider's network, you just add ACL's at the provider edge. Nothing external will ever need to reach a provider's core. This is basic, basic stuff.
Next time, don't only run your network on house bandwidth (HE, TelX, etc). Or in other words, caveat emptor.
- adamzoz 11y agoI want to cut Linode some slack they have been great but those were my thoughts when the employee above divulged that info. It all seems a little like using cold fusion to run your whole shop.. People dont need to jump ship they need plans in place to deal with problems like this, even just a rsync.net account.
- scurvy 11y agoJudging by the downvotes I got, there are people on HN that must think you should expose your router's control plane to the Internet. That or they expect transit providers to not protect their network. There's no intelligent discussion left here. It's devolved into a sympathy vote. "You said something mean about Linode. I love Linode. Downvotes for you." If Linode had posted the update to NANOG, it would have been more productive. I don't often say that.
- alexforster 11y agoYou may want to go pinging around some of your own tier 1 crossconnects. I bet you'll be surprised.
- scurvy 11y agoThey all respond because I asked them for it. About half didn't upon turn up. It's super trivial for them to null route them or readdress in rfc 1918/4193 space. Or are you referring to xconnects inside their network? That's up to them to work out and I've never seen a provider just abandon their network while under attack.
- alexforster 11y agoYou may want to reconsider. CoPP only goes so far, as we've learned the hard way.
- scurvy 11y agoI don't run Cisco, but thanks for worrying about that. Also, stateless ACL's should protect against overrunning the control plane.