{
  "id": 19278028,
  "title": "Blackhole and Static Route Hygiene for a Free /48 You Originate",
  "url": "https://urgent.news/2026/11/10/blackhole-and-static-route-hygiene-for-a-free-48-you-originate",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-11-10T03:55:24.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/ipye_com/blackhole-and-static-route-hygiene-for-a-free-48-you-originate-183j"
  },
  "original_language": "en",
  "account": "When announcing a free IPv6 /48 from IPYE, proper blackhole and static route hygiene is crucial. A blackhole route for the entire /48 helps prevent looped traffic and provides protection during attacks. Any more-specific routes will win based on the longest match, ensuring real traffic is delivered. Setting up a blackhole for the complete /48 keeps unused space from looping and protects your service during attacks.\n\nOn Linux, there are three types of routes that drop traffic: blackhole, unreachable, and prohibit. Blackhole is the preferred option for dropping attack traffic, while unreachable and prohibit generate ICMPv6 errors, which can cause additional load during floods.\n\nIt is recommended to use a blackhole route for the entire /48. This can be done by adding `ip -6 route add blackhole 2001:db8:100::/48` to your Linux configuration. The BGP daemon needs a route to advertise, and the blackhole provides one. More specific routes, such as connected /64 or WireGuard peer ranges, will win and deliver real traffic.\n\nTo ensure safety, avoid redistributing static routes on the BGP process. Every static route can become a candidate for export, including the /64 blackholes added during attacks. Instead, use network statements and filter them explicitly with prefix-lists and route-map configurations. This approach helps prevent any single mistake from leaking.\n\nWhen implementing blackholes, use a combination of local and remote discard techniques. Local blackholes stop traffic at your router, while remote-triggered blackholing (RTBH) asks the upstream to drop the traffic before it reaches you. Ask your upstream if they support RTBH, test it on an unused /128 address, and label every manual route with a tag for easy identification and removal.",
  "summary": "Disclosure up front: I run IPYE, a company that leases IP space. Most of this article is practical how-to; IPYE appears where a free /48, LOA, or ROA helps you try the work, with a short call to action at the end. Blackhole routes and static routes are small, sharp tools. On an edge that originates a prefix, a correct blackhole keeps unused space from looping and protects you during attacks. A…",
  "key_points": [
    "Blackhole route for entire /48 prevents looped traffic and protects against attacks",
    "Use blackhole route on Linux with command: ip -6 route add blackhole 2001:db8:100::/48",
    "Avoid redistributing static routes; use network statements and filter with prefix-lists"
  ],
  "editors_take": "Implementing blackhole routes and strict filtering for IPv6 prefixes shifts the burden of traffic mitigation from the host to the network edge to prevent routing loops and resource exhaustion.",
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}