search

pavel-odintsov / fastnetmon

FastNetMon - very fast DDoS sensor with sFlow/Netflow/IPFIX/SPAN support
https://fastnetmon.com
GNU General Public License v2.0
3.41k stars 567 forks source link

Exabgp integration for announce blackholed IP's with BGP #96

Closed pavel-odintsov closed 9 years ago

pavel-odintsov commented 9 years ago

Subject

It's more standard and reliable way to ban IPs.

franklouwers commented 9 years ago

could be done via for instance exabgp monitor feature, or via bird (which can learn from kernel routing tables: I have a setup on a honeypot search where fail2ban adds bad hosts to unreachable kernel routing table, and birds picks those up and blackholes them via bgp). Let me know if you need feedback/input/.. :)

pavel-odintsov commented 9 years ago

Could you share your experience with exabgp monitor feature? It's looks very interesting!

pavel-odintsov commented 9 years ago

Well, we could implement it on top of PIPE feature of exabgp: https://github.com/Exa-Networks/exabgp/issues/244

pavel-odintsov commented 9 years ago

Btw, we could add ability to specify community number for announce.

s4m4n commented 9 years ago

Best bet would be adding a bgp community to the ip and advertise it to the router. On the router configuration it's easy to set a policy that blackhole or null-route any received route with the community $x .

pavel-odintsov commented 9 years ago

Yep, so good idea. I need some time for deploying test env with Quagga.

pavel-odintsov commented 9 years ago

I found awesome guide for this task https://www.m00nie.com/2014/01/bgp-rtbh-setup-using-exabgp/

pavel-odintsov commented 9 years ago

Well, my test env have just deployed: http://www.stableit.ru/2015/04/quagga-bgp-and-exabgp-work-together-for.html

I will start my work for integration shortly.

pavel-odintsov commented 9 years ago

Implemented:) Testers are welcome! Reference guide here: https://github.com/FastVPSEestiOu/fastnetmon/blob/master/docs/EXABGP_INTEGRATION.md