Team Cymru BOGON Filter

Block traffic from routers that should never appear in the internet routing table

BOGONS are defined by Team Crymru as follows: “A bogon prefix is a route that should never appear in the Internet routing table. A packet routed over the public Internet (not including over VPNs or other tunnels) should never have an address in a bogon range. These are commonly found as the source addresses of DDoS attacks.” RemoteWinBox allows you to enable and receive updates to this list through a simple toggle button in our app.

Considerations #

• The BOGON FILTER implementation is in partnership with Team Cymru using their Bogon reference list.
  • A bogon prefix is a route that should never appear in the Internet routing table.
  • RemoteWinBox applies the Team Cymru list and updates on a daily basis.
  • Subnets auto-detected and exluded if in use on this router: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 100.64.0.0/10, 198.18.0.0/15
  • OSPF routers will exclude 224.0.0.0/4.
  • Broadcast BOGON 240.0.0.0/4 will not be filtered so that VRRP and broadcast traffic will be allowed.
  • Do not use on multicast routers, RWB will block multicast routing.
  • RWB will attempt to add BOGON filters safely and will undo BOGON filtering if the router goes offline to RWB.

How to Enable #

1. Sign into your RemoteWinBox dashboard and navigate to the Security Tab of the Router List page
2. Click on the toggle under the “TC BOGON FILTER” column to enable the BOGON Filter on that router

How to Disable #

1. Sign into your RemoteWinBox dashboard and navigate to the Security Tab of the Router List page
2. Click on the toggle under the “TC BOGON FILTER” column to disable the BOGON Filter on that router

BOGON FILTER Logic #

1. We add a schedule to prevent locking access out for this router that will get removed at the end
2. Query the router for all IP addresses so that we won’t block IPs this router uses
3. Skip any BOGON prefix that is used in (2) (and skip broadcast subnet)
4. Apply the rest of the BOGONs not skipped
5. Add the firewall at the top of filters that references the BOGON list
6. Trigger a discovery for the router
7. If discovery is successful, unset the safe schedule from (1)
   • else discovery failed, the schedule will disable BOGON blocking

BOGON Filter is blocking legit traffic of my IP’s #

To skip subnets that your network uses, add a loopback interface (/interface bridge add) an assign a dummy IP to it with the prefixes/subnets that you would like BOGON processing to skip. As long as an IP exists on the router, we will skill that entry in the BOGON Processing, as described above.