Quantcast
Viewing all articles
Browse latest Browse all 20028

Null routing vs. Firewall rules - which has better performance?

I have a standard network group that I filter traffic entering my networks from that should not be routed on the internet (from various RFCs) including RFC1918 (which I am using internally).

 

Is there any performance reason to null route all these prefixes instead of adding them as a firewall rule? I'm guessing it would need benchmarks, but I'm curious if anyone has done this and can share.

 

Null routing 10.0.0.0/8 (for example) wouldn't matter to me, because most specific prefix wins, and my directly connected (or learned via routing protocol) networks are definitely more specific than a /8

 

So this (simplified, removed all but RFC1918):

firewall {
    group {
        network-group IPv4_BOGONS {
            network 10.0.0.0/8
            network 172.16.0.0/12
            network 192.168.0.0/16

        }
    }
    name WAN_IN {
        default-action drop
        description "WAN to internal"
        rule 5 {
            action drop
            description "Drop bogons inbound"
            source {
                group {
                    network-group IPv4_BOGONS
                }
            }
        }

 

vs. this:

protocols {
    static {
        route 10.0.0.0/8 {
            blackhole {
            }
        }
        route 172.16.0.0/12 {
            blackhole {
            }
        }
        route 192.168.0.0/16 {
            blackhole {
            }
        }
    }
}

  


Viewing all articles
Browse latest Browse all 20028

Trending Articles