Protecting the Router Itself: Control-Plane Policing and Management-Plane Filters, with a Linux Example
Disclosure up front: I run IPYE, a company that leases IP space. It gets one short paragraph at the end; the rest is plain networking. A router has two jobs that share one CPU: forwarding transit traffic, which hardware or the fast path usually does, and running software that speaks protocols, answers management requests, and makes decisions. That second part, the control plane and management…
Control-plane protection on a router involves controlling traffic that directly reaches the router's software, such as routing protocols and management interfaces. This is crucial because the control plane handles software processes and can be overwhelmed by a flood or mistake. Control-plane policing (CoPP) and management-plane protection are key practices to maintain router stability under stress.
Two main classes of traffic are addressed: routing protocols and management interfaces. Routing protocols like BGP are accepted from known neighbours and never rate-limited, while management interfaces like SSH, SNMP, and NTP are restricted to the management network. Other traffic, including scans and floods, is dropped.
On a Linux router, the control plane is managed through the firewall's input hook. The policy table specifies rules for various traffic classes, such as neighbour discovery, ICMP echo, and management protocols. The table uses nftables, a packet filtering framework, to set up these rules. For instance, ICMPv6 neighbour discovery is allowed without rate-limiting, while routing protocols are matched by source address.
The policy also includes logging and counting dropped traffic, providing visibility into potential attacks. Separating management from transit traffic, such as using a separate VRF or out-of-band network, further enhances security. Disabling unused services, authenticating and encrypting management protocols, and monitoring drop rule counters are additional protective measures.
Testing is essential to ensure the policy functions as intended. A virtual lab should be used for validation, with syntax checks, rollback capabilities, and tests to confirm that routing remains stable under controlled floods. The provided rules focus on blocking management and routing traffic from unauthorized sources, with additional measures like BGP session-level protections and management-plane authentication enhancing security.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
