2

Reverse Path Filters are generally used to disable asymmetric routing where an application has a different incoming and outgoing routes. So idea is to prevent packet entering from one interface leaving via the other. But there is a conflict of opinion regarding security risk of disabling reverse path filtering. My question is if disable reverse path filtering then what are the security risk and how can a malware exploit this.

3

Reverse path filtering (or forwarding) has nothing to do with an application. Applications have no knowledge of the underlying network topology, RPF is done at a lower level.

Most attacks that take advantage of systems that do not check their routing information base before forwarding packets are denial of service attacks, or reflection attacks. Here's how it works: An attacker outside your network sends a packet to an internet facing server with a source IP that is actually inside your network. The server receives it, crafts a response, then sends it back to the source IP address, which is a system in your network. Bingo, the attacker just penetrated your perimeter. If your server had checked the reverse path it would have seen that the address didn't match the interface it should have come from, and discarded it before it reached the application.

As for how useful it is depends on your network topology, it can create more problems than it solves as you have to ensure that all routing paths are synchronous, which can be very difficult to accomplish. In some cases asynchronous traffic can work well and be beneficial in terms of resiliency, load balancing, etc. In simple networks where you can rigidly control all your paths to make sure return traffic goes back through the same interface it came in it may add some security. In complex networks the benefit of implementing it is greatly outweighed by the design and administration overhead required to make it work, even if it is feasible to do so.

Perhaps the greatest argument against it is that if you have your house remotely in order you simply don't need it. A basic perimeter firewall ruleset will block all incoming traffic with internally used IP addresses, and all private addressing. Essentially, if you ever have a situation where reverse path filtering would have been beneficial whomever manages your firewall rules should try a new line of work.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.