Null routes and blackholing
A null route throws traffic for an address away before it reaches anything. It is a blunt instrument and sometimes the only one that works.
What it does
Traffic destined for an address is discarded at the router rather than carried to the server. The address becomes unreachable — which is the point when the alternative is a flood that takes out the link everyone shares.
The uncomfortable part: during a large attack, null-routing the target is completing the attack on that address, in order to protect the hundreds of other customers behind the same link. That is why it is a last resort and not a first response.
When we use one
- An attack large enough to threaten the link, which our DDoS filtering has not been able to absorb selectively
- Traffic actively leaving your machine and damaging others — an outbound flood from a compromised server, where we act first and tell you immediately afterwards. See the AUP in plain English.
In both cases you are told, with the address and the reason. A null route for an attack is lifted when the attack stops; one for outbound abuse is lifted when the cause is fixed.
RTBH, if you run BGP with us
Remotely triggered blackholing lets you ask us to discard traffic for a specific address of yours, by announcing it with an agreed BGP community. The announcement reaches our edge and the traffic stops there instead of crossing our network to you.
Useful when you have one address under attack and would rather sacrifice it than have the flood arrive. Normally a /32 or /128. Ask us for the community value — see running BGP with us and multihoming.
On your own machine
You can discard traffic locally, which protects your application but not your link — the packets still arrive:
ip route add blackhole 203.0.113.5
Usually a firewall rule is the better tool, because it can be specific about ports and rates:
nft add rule inet filter input ip saddr 203.0.113.5 drop
See firewalling your server and what you can do about DDoS, which covers the application-layer attacks that no amount of blackholing addresses.
Blackholing your own outbound traffic
There is a legitimate use that has nothing to do with attacks: if your machine must never reach a particular network, a blackhole route is a simple, fast way to enforce it, and it is cheaper than a firewall rule for a large set of prefixes.
Getting out of one
If an address of yours has been null-routed, the route is removed when the reason is gone. For an attack, that is when it subsides. For abuse, it is when you have found and fixed the cause — and a reply saying what you found is what moves it along. See a compromised server and what to do with an abuse notice.
If you have several addresses, keep the important services on separate ones. A null route is per address, so an attack on a single customer's address need not take your whole machine offline with it — see planning your address space.
Still stuck? Mail support@novogara.com — an engineer answers, at any hour. Back to the knowledge base