{
  "id": 17166834,
  "title": "Protecting the Router Itself: Control-Plane Policing and Management-Plane Filters, with a Linux Example",
  "url": "https://urgent.news/2026/10/30/protecting-the-router-itself-control-plane-policing-and-management",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-30T03:19:05.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/ipye_com/protecting-the-router-itself-control-plane-policing-and-management-plane-filters-with-a-linux-30b5"
  },
  "original_language": "en",
  "account": "Control-plane protection on a router involves controlling traffic that directly reaches the router's software, such as routing protocols and management interfaces. This is crucial because the control plane handles software processes and can be overwhelmed by a flood or mistake. Control-plane policing (CoPP) and management-plane protection are key practices to maintain router stability under stress.\n\nTwo main classes of traffic are addressed: routing protocols and management interfaces. Routing protocols like BGP are accepted from known neighbours and never rate-limited, while management interfaces like SSH, SNMP, and NTP are restricted to the management network. Other traffic, including scans and floods, is dropped.\n\nOn a Linux router, the control plane is managed through the firewall's input hook. The policy table specifies rules for various traffic classes, such as neighbour discovery, ICMP echo, and management protocols. The table uses nftables, a packet filtering framework, to set up these rules. For instance, ICMPv6 neighbour discovery is allowed without rate-limiting, while routing protocols are matched by source address.\n\nThe policy also includes logging and counting dropped traffic, providing visibility into potential attacks. Separating management from transit traffic, such as using a separate VRF or out-of-band network, further enhances security. Disabling unused services, authenticating and encrypting management protocols, and monitoring drop rule counters are additional protective measures.\n\nTesting is essential to ensure the policy functions as intended. A virtual lab should be used for validation, with syntax checks, rollback capabilities, and tests to confirm that routing remains stable under controlled floods. The provided rules focus on blocking management and routing traffic from unauthorized sources, with additional measures like BGP session-level protections and management-plane authentication enhancing security.",
  "summary": "Disclosure up front: I run IPYE, a company that leases IP space. It gets one short paragraph at the end; the rest is plain networking. A router has two jobs that share one CPU: forwarding transit traffic, which hardware or the fast path usually does, and running software that speaks protocols, answers management requests, and makes decisions. That second part, the control plane and management…",
  "key_points": [
    "Control-plane protection crucial for router stability",
    "CoPP and management-plane filters address routing protocols and management interfaces",
    "Linux firewall uses nftables to manage control-plane traffic"
  ],
  "editors_take": "Implementing strict control-plane policing and management-plane filters transforms the router from a vulnerable target into a resilient node by isolating critical software processes from potentially overwhelming or malicious traffic floods.",
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}