Reverse-path forwarding

Multicast routing technique to minimize loops and enhance security

Reverse path forwarding (RPF) is a technique used in modern routers for the purposes of ensuring loop free forwarding of multicast packets in multicast routing and to help prevent IP address spoofing in unicast routing. In standard unicast IP routing, the router forwards the packet away from the source to make progress along the distribution tree and prevent routing loops. In contrast, the router's multicast forwarding state runs more logically by organizing tables based on the reverse path, from the receiver back to the root of the distribution tree at the source of the multicast. This approach is known as reverse path forwarding.

Unicast RPF (uRPF), as defined in RFC 3704, is an evolution of the concept that traffic from known invalid networks should not be accepted on interfaces from which it should never have originated. The original idea as seen in RFC 2827 was to block traffic on an interface if it is sourced from forged IP addresses. It is a reasonable assumption for many organizations to simply disallow propagation of private addresses on their networks unless they are explicitly in use. This is a great benefit to the Internet backbone as blocking packets from obviously bogus source addresses helps to cut down on IP address spoofing which is commonly used in DoS, DDoS, and network scanning to obfuscate the source of the scan. uRPF extends this idea by utilizing the knowledge all routers must have in their routing information base (RIB) or forwarding information base (FIB) to do their primary job, to help further restrict the possible source addresses that should be seen on an interface. Packets are only forwarded if they come from a router's best route to the source of a packet. Packets coming into an interface come from valid subnetworks, as indicated by the corresponding entry in the routing table are forwarded. Packets with source addresses that could not be reached via the input interface can be dropped without disruption to normal use, as they are probably from a misconfigured or malicious source. In cases of symmetric routing, routing where packets flow both directions through the same path, and terminal networks connected via a single link, this is a safe assumption and uRPF can be implemented without many anticipated problems. Using uRPF as close as possible to the real source of traffic also stops spoofed traffic before it has any chance of using bandwidth or reaching a router that is not configured for RPF and thus inappropriately forwarded. Unfortunately, it is often the case on the larger Internet backbone that routing is asymmetric and the routing tables cannot be relied upon to point to the best route for a source to get to a router. Routing tables specify the best forward path and only in the symmetric case does that equate to the best reverse path. It is important when implementing uRPF to be aware of the potential for asymmetry to prevent accidental filtering of legitimate traffic. RFC 3704 gives more details on how to extend strict reverse path forwarding to include some more relaxed cases that can still be of benefit while allowing for at least some asymmetry.

In strict mode, each incoming packet is tested against the FIB and, if the incoming interface is not the best reverse path, the packet check will fail. By default failed packets are discarded.

In feasible mode, the FIB maintains alternate routes to a given IP address. If the incoming interface matches with any of the routes associated with the IP address, then the packet is forwarded. Otherwise, the packet is dropped.

In loose mode each incoming packet's source address is tested against the FIB. The packet is dropped only if the source address is not reachable via any interface on that router.

RPF is often interpreted as reverse path filtering, particularly when it comes to unicast routing. This is an understandable alternate interpretation of the acronym in that when RPF is used with unicast routing as in RFC 3704, traffic is either permitted or denied based upon the RPF check passing or failing. The thought being that traffic is denied if it fails the RPF check and is therefore filtered. While uRPF is used as an ingress filtering mechanism, it is affected by reverse path forwarding. Reverse path filters are typically used to disable asymmetric routing where an IP application has a different incoming and outgoing routing path. Its intent is to prevent a packet entering one interface from leaving via the other interfaces. Reverse path Filtering is a feature of the Linux Kernel.