make a router invisible

[sjamison]

For lack of better wording, how do I make a router invisible?

I see the carriers do it all the time. When a tracert happens, I want no IP to show up but continue on so that it will eventually get to its destination.

[Nicholas Vigil]

I know you can use an access list on a router to control the types of icmp messgaes that are allowed. For example:

access-list 110 deny icmp any any echo-reply

I hope this helps.

[sjamison]

Hmmm... so this would be assigned to the T1 or ATM interface?

That seems to easy... thats it? I guess I was under the impression that a trace route kind of worked a little differently than a ping. I know it pings back, but its got to figure out the hops. I thought there was a way to some how disable that so that a tracert couldnt find the hop, but normal traffic would still go through it.

If this is all thats needed, thats a very simple fix for me!

[Nicholas Vigil]

Here are some further examples:

access-list 110 deny icmp any any echo

access-list 110 deny icmp any any echo-reply

access-list 110 deny icmp any any packet-too-big

access-list 110 deny icmp any any source-quench

access-list 110 deny icmp any any time-exceeded

I hope this helps.

If this helps you please rate my post, thanks.

[gschertz]

trace route uses ping or icmp packets to work. basicly it pings each hop in the routing path. So the access lists will work by not allowing the router to accept or respond to ping requests. One word of caution, it also means you can not ping the routers in question unless you specificly allow ping from your location.

Gene

[sjamison]

I dont want to block them all together. I just dont want the router to respond to PINGS. If I apply this access list then all pings will get blocked then. I need to specifically write an access-list to not allow pings from that interface correct sourcing from itself right?

[Nicholas Vigil]

Yes, you need to create a custom access list for your environment that prevents the router itself from processing icmp messages. For example:

access-list 110 deny icmp any host x.x.x.x

where x.x.x.x is your router's interface

Then apply the acl to the interface.

If this post helps please rate my post, thanks.

[MIKE DOUGLAS]

I think the command you're looking for is 'no icmp unreachables". I believe that will supress the ttl exceeded icmp message used by traceroute.

Traceroute works by sending some packet (some use udp, other use icmp) with an initial ttl of 1. Each subsequent packet goes out with the ttl incremented by one. The effect of this is that at each router hop where the ttl is decremented by one, an icmp ttl exceeded error is sourced by that router back to the sender. Thus a record is created of each hop traversed between a source and destination.

Obviously asymetric routing is another issue.

[sjamison]

Well I have the no icmp unreachables on the interface. Thats always been part of my config for my routers. So I built an access list to deny the pings. Weird thing is if you do a ping to the router interface it comes back as unreachable. But if you do a tracert it sees the IP. There has to be something that disables this.

C:\WINDOWS\system32>tracert server

Tracing route to server [10.200.148.11]

over a maximum of 30 hops:

1 <1 ms <1 ms <1 ms 10.200.81.251

2 1 ms 1 ms <1 ms 10.200.100.1

3 6 ms 5 ms 9 ms 10.200.90.34

4 6 ms 9 ms 9 ms 10.200.91.6

5 5 ms 9 ms 5 ms 10.200.148.11

Trace complete.

C:\WINDOWS\system32>ping 10.200.91.6

Pinging 10.200.91.6 with 32 bytes of data:

Request timed out.

Request timed out.

Request timed out.

access-list 110 deny icmp host 10.200.91.6 any

access-list 110 deny icmp any host 10.200.91.6

access-list 110 permit ip any any

interface FA0/0

ip address 10.200.91.6 255.255.255.252

no ip redirects

no ip unreachables

no ip proxy-arp

ip route-cache flow

duplex auto

speed auto

no cdp enable

no mop enabled

[vashdevt]

If end to end router in your administration you can using some sort of tunneling like GRE which will hide all router in between

Vash

[Richard Burts]

I have 2 corrections to things that have been said in this discussion.

- the statement that traceroute uses ping may be true and may be not true, depending on what is issuing the traceroute. If a Windows system uses the tracert command then the traceroute will use ping. But if a Cisco router or Unix system issue the traceroute command then it will use UDP packets for the traceroute. So trying to solve this with access lists is problematic (how do you know what UDP port number would be used for a particular traceroute - since the port number increments for each hop along the path).

- Mike was on the right track about how to make the router not respond to traceroute, but got the syntax slightly off. It is not no icmp unreachable but is no ip reachable (which gets configured on the interface).

HTH

Rick

[vettrock]

Rick is correct in the way that traceroute works. It sends udp or icmp packet which are set to expire. However the no ip unreachables command stops the router from sending unreachable messages, however I at least on the IOS we are running, it stop icmp host unreachable, icmp network unreachable, and icmp administratively prohibited, and probably a few others. The icmp message sent by the trace back to the destination is an icmp time-exceeded message. If you put in your access-list deny icmp time-exceeded, it should stop the replies to the traceroute probes, effectively making your router "invisible."

Regarding the comment that you see carriers do it all the time, most of the time that is because they are running an MPLS core, and have the customer routes only on the edge routers. This means that the packet will go into an MPLS tunnel through there network until it exits on the other side of their network. Their core routers use the mpls tag to determine where to forward the packet, rather than the destination ip address. Therefore when a packet's TTL expires in mid transit, it does not have a route back to the source, and the router drops the packet.

[Richard Burts]

But there is a flaw in that approach. An outbound access list will not filter pacekts originated by the router. So you could put statements in the outbound access list to deny icmp time-exceeded, but it would not stop the router from generating and sending the responses. It can stop packets going through the router but not packets originated by the router.

I believe that if you want the router to be invisible it must be really invisible (no host unreachable, no network unreachable, not just no time-exceeded).

HTH

Rick

[vettrock]

The router on the edge of your network will still send the icmp time-exceeded message because outbound access-lists do not apply to traffic generated by the router as you said, but that is as far into your network as they will get. Setting no ip unreachables on every interface is a good thing, in that it stops the router from generating the various unreachable message, however, it does not stop the time exceeded message. We have no ip unreachables turned on every interface in our network, but you can still run a traceroute through our network.

And as you can see in the poster's config, he already has it set on his interface, but traceroute still responds.

[sjamison]

I dont see a command for the commands you guys were talking about unless its a sub command somewhere...

What commands to do I need to enable?