1

I need to set some rules to block network traffic, both IPv4 and IPv6. The routes should be a blackhole or unrecheable depending on the case. In Linux and MacOSX seems simple, there are specific keywords/flags when adding a route ("blackhole", "unreachable" in linux, and the flag "B" or "R" in MacOSX). My problem is Windows.

I found a solution for Blackhole, that you can see here for example, just to mention one website. Basically sending the traffic to the loopback interface. That is for IPv4. For IPv6 I use a similar trick, using the loopback interface, but pointing to 0100::1, a discard prefix, citing:

"0100::/64 as a Discard-Only Prefix in the "Internet Protocol Version 6 Address Space""

Then, my questions are:

  • are the solution I have written the "standar way"? is there a better way to achieve this?
  • how can I achieve a "unreachable" route in Windows and not a "blackhole"?
  • [WRONG, see edit] I could also use the firewall, that sometimes I read is the best solution in Windows. For example, I can put a filter with a FWP_ACTION_BLOCK action, see FWPM_ACTION0 structure. But this roule will act as blackhole? or as unreachable?

Thanks everyone.

EDIT:

It seems a firewall rule is the wrong solution. I tested that while using a route to 0100::1 through the loopback interface, if a try to ping using IPv6, I get a General failure error, while doing it using a blocking firewall rule, I get a timeout (that is exactly what I do NOT want). But I am still not able to get a Route Unreachable error as in MacOSX and Linux...

Improve this question
9
  • What's the difference for you between a blackhole and a unreachable route? You could just drop the traffic you don't want.
    – Seth
    Feb 20, 2019 at 11:59
  • The unreachable route will send back a message specifying that the route is unreachable. Blackhole route just does not say anything. With the blackhole route, the sender could be blocked waiting till a timeout expires, with the unreachable the sender knows that the route is not good and does not wait.
    – n3mo
    Feb 20, 2019 at 12:50
  • So you want to send the proper ICMP messages. By just setting a rule to block that should be happening. It would generate an unreachable message unless you block ICMP as well.
    – Seth
    Feb 20, 2019 at 12:57
  • by "setting a rule to block" you mean a rule in the firewall returning the FWP_ACTION_BLOCK action?
    – n3mo
    Feb 20, 2019 at 12:59
  • 1
    ah ok, I understand your doubt now. I did not specified it in the question, sorry :) Yes, I already have a C++ application, indeed this rule should be added automatically by it.
    – n3mo
    Feb 20, 2019 at 15:15

1 Answer 1

Reset to default
-1

You can do what you want using an unallocated local IP address (192.168.1.100 in the example). Note that in both cases you run the commands from cmd. Let's assume you want to null-route 8.8.4.4:

For Windows XP, Server 2003

route add 8.8.4.4 mask 255.255.255.255 192.168.1.100 metric 1 -p

Windows 7, Server 2008

route add 8.8.4.4 mask 255.255.255.255 192.168.1.100 if 1 -p

The route can be removed if needed with route delete command.

Improve this answer
4
  • Hi @Overmind, thanks for your answer, but my question is a bit more specific: what does that route look like? as a blackhole route or as an unreachable route? I suppose this is a blackhole, then how can I achieve a unreachable?
    – n3mo
    Feb 25, 2019 at 9:33
  • It's basically the same thing. The unreachable response depends on your configuration. For example on CISCO equipment if you null /BH a route, you will get unreachable response and if you don't want that response you must manually add "no ip unreachables" in your configuration, just like in BSD you use -reject instead of -blackhole.
    – Overmind
    Feb 25, 2019 at 10:41
  • Understand, but how can I modify this behaviour (blackhole/unreachable) in Windows? Is there some sort of flag? I am open to netsh solution or to program API solutiaon as well...
    – n3mo
    Feb 25, 2019 at 10:43
  • They asked for IPv4 and IPv6.
    – glenviewjeff
    Sep 12 at 2:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .