Blackhole and Static Route Hygiene for a Free /48 You Originate

When announcing a free IPv6 /48 from IPYE, proper blackhole and static route hygiene is crucial. A blackhole route for the entire /48 helps prevent looped traffic and provides protection during attacks. Any more-specific routes will win based on the longest match, ensuring real traffic is delivered. Setting up a blackhole for the complete /48 keeps unused space from looping and protects your service during attacks.

On Linux, there are three types of routes that drop traffic: blackhole, unreachable, and prohibit. Blackhole is the preferred option for dropping attack traffic, while unreachable and prohibit generate ICMPv6 errors, which can cause additional load during floods.

It is recommended to use a blackhole route for the entire /48. This can be done by adding `ip -6 route add blackhole 2001:db8:100::/48` to your Linux configuration. The BGP daemon needs a route to advertise, and the blackhole provides one. More specific routes, such as connected /64 or WireGuard peer ranges, will win and deliver real traffic.

To ensure safety, avoid redistributing static routes on the BGP process. Every static route can become a candidate for export, including the /64 blackholes added during attacks. Instead, use network statements and filter them explicitly with prefix-lists and route-map configurations. This approach helps prevent any single mistake from leaking.

When implementing blackholes, use a combination of local and remote discard techniques. Local blackholes stop traffic at your router, while remote-triggered blackholing (RTBH) asks the upstream to drop the traffic before it reaches you. Ask your upstream if they support RTBH, test it on an unused /128 address, and label every manual route with a tag for easy identification and removal.