6 ms·

This is nothing new. A few years back, I implemented a very basic firewall rule: if I received a TCP packet with SYN=1 and ACK=0 to destination port 22, the sou

This is nothing new. A few years back, I implemented a very basic firewall rule: if I received a TCP packet with SYN=1 and ACK=0 to destination port 22, the source IP would get blacklisted for a day. But then I started getting complaints about certain sites and services not working. It turned out that every few days, I'd receive such packets from IPs like 8.8.8.8 or 1.1.1.1, as well as from Steam, Roblox, Microsoft, and all kinds of popular servers—Facebook, Instagram, and various chat services. Of course, these were all spoofed packets, which eventually led me to adjust my firewall rules to require a bit more validation. So, I can assure you this is quite common. As a personal note, I know I’m a bit of an exception for operating multiple IP addresses, but I need the flexibility to send packets with any of my source addresses through any of my ISPs. That’s critical for me, and if an ISP filters based on source, it’s a deal-breaker—I’ll switch to a different ISP.

pixl97 2y ago
>I’ll switch to a different ISP. I mean, technically those ISPs would be in violation too. You need your own ASN.
jcalvinowens 2y ago
> but I need the flexibility to send packets with any of my source addresses through any of my ISPs As someone who always enables rp_filter everywhere... I'm very curious why?
Jerrrrrrry 2y ago
>As a personal note, I know I’m a bit of an exception ...That’s critical for me, and if an ISP filters based on source, it’s a deal-breaker—I’ll switch to a different ISP. "...and obviously, Pennywise, I must spoof ingress and egress..." "Of course, Agent Bond."
- immibis 2y ago
  If it's your real IP, it's not spoofing, even if you send the packet through a different ISP than the one which gave you the IP. If you think about it: if you got an IP directly from ARIN you wouldn't have to send your packets through ARIN to make them legitimate.
  - Jerrrrrrry 2y ago
    un-validated spoofed egress causes problems when everyone tests their egress-effectiveness at once. there is no "ingress," just a firewall of bad peers.
    - immibis 2y ago
      What? It's not spoofing because it's their real IP.
      - Jerrrrrrry 2y ago
        >If you think about it: I genuinely stopped reading there somehow subconsciously, and have a lil read to do, thank you.
wolrah 2y ago
> As a personal note, I know I’m a bit of an exception for operating multiple IP addresses, but I need the flexibility to send packets with any of my source addresses through any of my ISPs. That’s critical for me, and if an ISP filters based on source, it’s a deal-breaker—I’ll switch to a different ISP. If you actually have your own IP addresses this is normal and expected, but if you're able to use ISP A's IP addresses through ISP B or vice versa that has always been a bug that you are wrong to use. If you are doing the latter this is firmly in the "reenable spacebar heating" category and I hope your ISPs fix their broken networks.
- sulandor 2y ago
  maybe spacebar heating is a reasonable requirement after all and the joke was just that it's easy to get it wrong
- ninju 2y ago
  https://xkcd.com/1172/ https://xkcd.com/1172/ for those that need more context regarding the "reenable spacebar heating" comment
rvnx 2y ago
Is IPv6 fixing such cases by design or it's not changing anything ?
- toast0 2y ago
  Not really. Early IPv6 documentation kind of assumed that the vast address space would lead towards hierarchical addressing and that a multi-homed user would use addresses assigned by all of their ISPs, but at least in my experience, that doesn't really pan out --- if you have router advertisements from two different ISP prefixes, automatic configuration on common OSes (windows, linux, freebsd) will lead towards often sending traffic with ISP A through the router from ISP B, which doesn't really work well, especially if either or both ISPs run prefix filters. There's probably ways to make that style of multihoming work, but it's not fun. Turns out, most multiphomed IPv6 users need provider indepdent addresses, just like with IPv4. And then you need to make sure your all your ISPs allow you to use all your prefixes. On the plus side, it's much more likely to get an IPv6 allocation that's contiguous and that you won't outgrow; so probably you only need one v6 prefix, and you may not need to change it as often as with v4.
  - ianburrell 2y ago
    The advantage of IPv6 is that can multiple addresses. This means that good way to organize network is to have machines use local provider addresses to access the Internet. Then have ULA addresses for internal network. Those will be routed with tunnels and VPNs. That separates accessing the internet from internal network, and means that don't need to have routable address space. The only people who would need own address space have data centers and routers.
    - cyberax 2y ago
      > Then have ULA addresses for internal network Except that ULAs don't really work. They are less prioritized than GUAs.
  - the8472 2y ago
    Yeah, there are ways to make it work, for example by specifying source addresses or nets on the the routes. In openwrt it's a checkbox to tick on the upstream interfaces.
Habgdnv 2y ago
Okay, looks like I will reply to a few of the comments to clarify things. I’ll give a concrete, real example. I worked at a company that hosted some web assets on-prem in one of their branches. They had a 1Gbps connection there. However, at HQ, we had multiple 10G connections and a pretty good data center. So, we moved the web VM to HQ but kept the assigned IP address (a public static from ISP-A). We routed it through a VPN to HQ. The server used our default GW and sent responses with source IP (ISP-A) via ISP-B (10G). That way, we utilized 10G outbound, even though the inbound was limited to 1G. It was only for GET requests anyway. I know this wasn’t the most optimal setup, and we eventually changed the IP, but it seems like a valid use case. Scenario 2: We had two connections from two different ISPs (our own ASN, our own /23 addresses). We wanted to load balance some traffic and sent half of our IPs through ISP-A and the other half through ISP-B. It worked fine, but when we tried to mix the balance a bit, we found an interesting glitch. We announced the first /24 to ISP-A and the second /24 to ISP-B, but ISP-A had RP filtering. So, we had to announce all the IPs to them. The way the RP filter works, as you may guess, means we cannot prepend or anything. All traffic must come through them. If they see a better route for that prefix, they will filter it. For a few months, they refused to fix this, citing security. There’s no shame in security best practices, so I might as well name the ISP—Virgin Media. Note that the internet with rp_filter is not $20/month. It was more like 5K+/month!! And we did not change it due to lack of alternatives there. But otherwise guess who loses the contract :)
- Stefan-H 2y ago
  In your first scenario, any connections established through the ISP-A's IP address would be routed back through the VPN connection that they came in on. If that server were to establish it's own connections to external resources, it would feasibly be able to use the 10g connection from ISP-B. It would not be able to dictate what source address was used with connections coming from ISP-B.
  - jcalvinowens 2y ago
    It could work the way OP described if they routed all outbound traffic via ISP-A regardless of source address, and ISP-A allowed spoofing. I think that's what they meant.
cowboylowrez 2y ago
>That’s critical for me, and if an ISP filters based on source, it’s a deal-breaker—I’ll switch to a different ISP. don't we want source based filtering tho? sounds like the problem is a LACK of source based filtering.

pixl97 2y ago

>I’ll switch to a different ISP. I mean, technically those ISPs would be in violation too. You need your own ASN.

jcalvinowens 2y ago

> but I need the flexibility to send packets with any of my source addresses through any of my ISPs As someone who always enables rp_filter everywhere... I'm very curious why?

Jerrrrrrry 2y ago

>As a personal note, I know I’m a bit of an exception ...That’s critical for me, and if an ISP filters based on source, it’s a deal-breaker—I’ll switch to a different ISP. "...and obviously, Pennywise, I must spoof ingress and egress..." "Of course, Agent Bond."

immibis 2y ago
If it's your real IP, it's not spoofing, even if you send the packet through a different ISP than the one which gave you the IP. If you think about it: if you got an IP directly from ARIN you wouldn't have to send your packets through ARIN to make them legitimate.
- Jerrrrrrry 2y ago
  un-validated spoofed egress causes problems when everyone tests their egress-effectiveness at once. there is no "ingress," just a firewall of bad peers.
  - immibis 2y ago
    What? It's not spoofing because it's their real IP.
    - Jerrrrrrry 2y ago
      >If you think about it: I genuinely stopped reading there somehow subconsciously, and have a lil read to do, thank you.

wolrah 2y ago

> As a personal note, I know I’m a bit of an exception for operating multiple IP addresses, but I need the flexibility to send packets with any of my source addresses through any of my ISPs. That’s critical for me, and if an ISP filters based on source, it’s a deal-breaker—I’ll switch to a different ISP. If you actually have your own IP addresses this is normal and expected, but if you're able to use ISP A's IP addresses through ISP B or vice versa that has always been a bug that you are wrong to use. If you are doing the latter this is firmly in the "reenable spacebar heating" category and I hope your ISPs fix their broken networks.

sulandor 2y ago
maybe spacebar heating is a reasonable requirement after all and the joke was just that it's easy to get it wrong
ninju 2y ago
https://xkcd.com/1172/ https://xkcd.com/1172/ for those that need more context regarding the "reenable spacebar heating" comment

rvnx 2y ago

Is IPv6 fixing such cases by design or it's not changing anything ?

toast0 2y ago
Not really. Early IPv6 documentation kind of assumed that the vast address space would lead towards hierarchical addressing and that a multi-homed user would use addresses assigned by all of their ISPs, but at least in my experience, that doesn't really pan out --- if you have router advertisements from two different ISP prefixes, automatic configuration on common OSes (windows, linux, freebsd) will lead towards often sending traffic with ISP A through the router from ISP B, which doesn't really work well, especially if either or both ISPs run prefix filters. There's probably ways to make that style of multihoming work, but it's not fun. Turns out, most multiphomed IPv6 users need provider indepdent addresses, just like with IPv4. And then you need to make sure your all your ISPs allow you to use all your prefixes. On the plus side, it's much more likely to get an IPv6 allocation that's contiguous and that you won't outgrow; so probably you only need one v6 prefix, and you may not need to change it as often as with v4.
- ianburrell 2y ago
  The advantage of IPv6 is that can multiple addresses. This means that good way to organize network is to have machines use local provider addresses to access the Internet. Then have ULA addresses for internal network. Those will be routed with tunnels and VPNs. That separates accessing the internet from internal network, and means that don't need to have routable address space. The only people who would need own address space have data centers and routers.
  - cyberax 2y ago
    > Then have ULA addresses for internal network Except that ULAs don't really work. They are less prioritized than GUAs.
- the8472 2y ago
  Yeah, there are ways to make it work, for example by specifying source addresses or nets on the the routes. In openwrt it's a checkbox to tick on the upstream interfaces.

Habgdnv 2y ago

Okay, looks like I will reply to a few of the comments to clarify things. I’ll give a concrete, real example. I worked at a company that hosted some web assets on-prem in one of their branches. They had a 1Gbps connection there. However, at HQ, we had multiple 10G connections and a pretty good data center. So, we moved the web VM to HQ but kept the assigned IP address (a public static from ISP-A). We routed it through a VPN to HQ. The server used our default GW and sent responses with source IP (ISP-A) via ISP-B (10G). That way, we utilized 10G outbound, even though the inbound was limited to 1G. It was only for GET requests anyway. I know this wasn’t the most optimal setup, and we eventually changed the IP, but it seems like a valid use case. Scenario 2: We had two connections from two different ISPs (our own ASN, our own /23 addresses). We wanted to load balance some traffic and sent half of our IPs through ISP-A and the other half through ISP-B. It worked fine, but when we tried to mix the balance a bit, we found an interesting glitch. We announced the first /24 to ISP-A and the second /24 to ISP-B, but ISP-A had RP filtering. So, we had to announce all the IPs to them. The way the RP filter works, as you may guess, means we cannot prepend or anything. All traffic must come through them. If they see a better route for that prefix, they will filter it. For a few months, they refused to fix this, citing security. There’s no shame in security best practices, so I might as well name the ISP—Virgin Media. Note that the internet with rp_filter is not $20/month. It was more like 5K+/month!! And we did not change it due to lack of alternatives there. But otherwise guess who loses the contract :)

Stefan-H 2y ago
In your first scenario, any connections established through the ISP-A's IP address would be routed back through the VPN connection that they came in on. If that server were to establish it's own connections to external resources, it would feasibly be able to use the 10g connection from ISP-B. It would not be able to dictate what source address was used with connections coming from ISP-B.
- jcalvinowens 2y ago
  It could work the way OP described if they routed all outbound traffic via ISP-A regardless of source address, and ISP-A allowed spoofing. I think that's what they meant.

cowboylowrez 2y ago

>That’s critical for me, and if an ISP filters based on source, it’s a deal-breaker—I’ll switch to a different ISP. don't we want source based filtering tho? sounds like the problem is a LACK of source based filtering.