| 2.3 |  | Securing the Perimeter Router |
| 2.3.4 |  | Traffic filtering |

| Figure contains a theoretical network that will be referenced in this section. First, there should not be any inbound packets from the internet with a private address range. This is called RFC 1918 filtering. This rule should also be applied to other non-valid addresses called bogons. Likewise, there should not be any inbound packets from the Internet with the same internal source address or network. This is called RFC 2827 filtering. The example in Figure shows access list 150 for router R2. In this example, any packets containing the following IP addresses in their source field will be denied:

- Denies any addresses from the internal 16.2.1.0 network.
- Denies any local host addresses (127.0.0.0/8).
- Denies any reserved private addresses (RFC 1918).
- Denies any addresses from the 192.0.2.0/24 network (not shown in figure).
- Denies any addresses from the 169.254.0.0/16 network (not shown in figure).
- Denies any addresses in the IP multicast address range (224.0.0.0/4).

This access list is applied to the Ethernet 0/0 interface of router R2.

As a rule, you should not allow any outbound IP packets with a source address other than a valid IP address of the internal network. The example in Figure shows access list 105 for router R2. This access list permits only those packets that contain source addresses from the 16.2.1.0/24 network and denies all others. This access list is applied to the inside interface (e0/1) of router R2.

Denial of Service (DoS) attacks are some of the most common and potentially destructive types of network attacks. The following items explain how a common DoS attack works, and how a router can be configured to resist the attack. Cisco routers running IOS version 12.0 may use IP unicast reverse-path forwarding verification as an alternative IP address spoof mitigation mechanism. Bogon addresses are IP addresses which should not appear in a routing table. As a rule, bogon prefix addresses should not be allowed through the routers. A packet routed over the public Internet should never have a source address in a bogon range. These are commonly found as the source addresses of Distributed Denial of Service (DDoS) attacks.

DoS SYN-flooding attack
TCP SYN attacks involve sending large amounts of packets (with only their SYN flags set) from the external network, into the internal network flooding the connection queues of the receiving nodes. The access list in Figure is designed to prevent inbound packets, with only the SYN flag set, from traversing the router. It does allow responses from the outside network for requests that originated on the inside network. It also denies any connection from the outside network from initiating a TCP connection.

TCP intercept
TCP intercept is a very efficient tool for protecting internal network hosts from external TCP SYN attacks. The access list in the figure blocks packets from unreachable hosts by allowing only reachable external hosts to initiate TCP connections to internal hosts .

Using TCP intercept, the router examines each inbound TCP connection attempt to determine if the source address is from an external reachable host. If the host is reachable, the connection is allowed. If the host is unreachable, the connection attempt is dropped. Because it examines every TCP connection attempt, TCP intercept can impose a performance burden on your routers. Always test for any performance problems before using TCP intercept in a production environment.

DoS mitigation
Land attacks consist of packets sent to a target router with the same IP address in both the source and destination fields, and with the same port number in both the source and destination port fields. The intent of this type of attack is to degrade router performance and ultimately create a DoS situation. The access list shown in Figure prevents this type of attack for router R2.

Smurf attacks consist of large numbers of ICMP echo packets sent to a router subnet broadcast address using a spoofed IP address from that same subnet. Most routers are configured to forward these broadcasts to other routers in the protected network, causing degraded performance. The access list shown in the figure is used to prevent this forwarding from occurring and halting the smurf attack. The access list in Figure blocks all IP packets originating from any host destined for the broadcast and subnetwork
addresses specified (16.2.1.255 and 16.2.1.0).

DDoS mitigation
Generally, routers cannot prevent all DDoS attacks, but they can help reduce the number of occurrences by building access lists that filter known attack ports. Some of the DDoS agents which can be prevented include TRIN00, Stacheldraht, TrinityV3, and Subseven. Figure shows an example of blocking the TRIN00 attack by blocking traffic on TCP port 27665 and UDP ports 31335 and 27444. Figure shows an example of blocking the Stacheldraht attack by blocking traffic on TCP ports and 16660 and 65000. Figure shows an example of blocking the TrinityV3 attack by blocking traffic on TCP ports 33270 and 39168. Figure shows an example of blocking the Subseven attack by blocking traffic on TCP ports 2222, 6711 – 6712, 6776, 6669, and 7000.

| Web Links Bogon Reference Page http://www.cymru.com/Bogons/ RFC 1918 http://www.faqs.org/rfcs/rfc1918.html

RFC 2827
http://www.faqs.org/rfcs/rfc2827.html