Allow and Block Lists

info

Connected filter devices must be running RIOS 6.2.0 or higher to use global block/allow list and all block list exception functionality.

RioRey filter devices use algorithms and analysis to detect and drop attack traffic. While an effective technique, there will be cases where manually allowing or blocking traffic are more suitable. This page discusses allow lists, block lists, and block list exceptions, and how they may be used to supplement your algorithmic protection. These techniques will be more familiar for users accustomed to creating ACLs in standard firewall devices.

Precedence

There are two types of entries: local and global. Local entries are set in the zone containing their destination prefixes, and global entries are set in the Default Zone. Global entries will apply across all zones, unless overridden by zone specific settings.

Any allow lists entry takes precedence over a block list or a block list exception entry. If a prefix is source or destination allow listed appropriately, it will always be forwarded regardless of the other lists.

Between block lists and block list exceptions, entries with more specific prefixes take precedence (e.g. a /28 entry overrides a /24 entry). When the same prefix is used for global and local, local list entries take precedence over global entries. When checking list behavior, start with the zone that contains the destination prefix, then check the Default Zone for global entries.

Because the Default Zone is used for global entries, you cannot have both a local and a global entry of the same prefix within the Default Zone. All zones are restricted to one block list or block list exception entry per address/prefix (i.e. it would not make any sense to both block and make an exception for the same prefix).

Allow Lists

Allow Lists represent IP addresses that should always contain known good traffic. They can be set by either source or destination IP prefix/Autonomous System Number/Country Code. Allow listed traffic is automatically forwarded without further examination.

Source allow lists can be set in any zone, and will only be automatically allowed for destinations matched by that zone. If you allow lsit traffic within a zone, but it is bound for a destination IP covered in a different, more specific zone, the traffic will not be automatically allowed through, but instead subject to the rules of the more specific zone.

Global source allow list entries can only be set in the Default Zone. Traffic from these sources will be allowed through, no matter what zone contains the destination prefix.

Destination allow lists must match the associated assigned prefixes for the zone. Once set, all traffic to the destination is allow listed. There are no global destination allow lists.

Valid allow list entries override both block list and block list exception entries, meaning allow listed traffic is allowed through under all circumstances.

There are cases where an attacker can take advantage of allow listed addresses. If you have a source allow list entry, an attacker could spoof large amounts of traffic from that source in a flood attack, and this traffic would be automatically forwarded because the source address matches your allow list entry.

Block Lists

Block lists represent IP addresses that should always be dropped. They are set by source IP prefix/Autonomous System Number/Country Code, and can either be local or global entries.

Local entries are set using AT63 in their desired zone. Traffic for destination within those zones will be blocked if their source matches a block listed address.

Global entries are set using AT63 within the Default Zone. Any traffic from a global source block list entry will be dropped, no matter what zone contains the destination prefix.

Valid block list entries will be overridden by allow list entries. If both an allow list and a block list match, the allow list will take precedence and the traffic will be allowed through.

Block List Exceptions

Block list exceptions represent acceptable source ranges for traffic that should not be affected by a block list. They are only meaningful in terms of block lists; a block list exception entry by itself with no accompanying block list entries will not have any effect on traffic. They are set by source IP prefix/Autonomous System Number/Country Code, and can either be local or global entries.

Local entries are set using AT63 in their desired zone. When the zone has both block list and block list exception entries, if the most specific source address match is a block list exception entry, it will not be dropped but instead tested according to the zone's mitigation settings. For example, if you block list a /24 within a zone, and within that there is a /28 block list exception entry, traffic from that /28 will not be blocked, but instead subject to normal filtering.

Global entries are set using AT63 within the Default Zone. Global block list exception entries are applied to all zones, and will take effect if they are more specific than any enclosing zone or global block list entries.

Block list exception entries will always be overridden by appropriate allow list entries; traffic to or from allow listed addresses will always be immediately forwarded. 

Example

Let's assume you are a network operator providing DDoS filtering to your customer base, with a few larger enterprise customers who are allowed to manage their own network filtering settings. You have different Groups set aside for these customers, with the appropriate permissions.

Let's also assume you've had a particularly high volume of bad traffic from another network operator, and you've identified their AS (Bad Autonomous System A) as being responsible for a large number of network issues and spam.

In the Default Zone, you set a global block list for the bad AS. This has the effect of dropping all traffic from them, no matter which zone is receiving the traffic. You also inform your larger customers that you are making this change.

One of your enterprise customers (Customer 1) responds that they are doing business with an entity (Business B) that happens to be hosted within the problematic AS. In order to continue protecting your larger network, you help this customer set up a block list exception for the particular set of addresses used by the business entity. 

In an unfortunate turn of events, Business B has one server that has been completely riddled with viruses and spambots (Corrupted Server C), and so you help Customer 1 configure a block list for this address. At this point, your larger configuration will look like this:

• Default Group
  • Default Zone
    • Global block list entry for A (Bad AS)
• Customer 1 Group
  • Customer 1 Zone
    • Local block list exception entry for B (Business Entity Prefix, a /24)
    • Local block list entry for C (Corrupted Server, a /32)
• Customer 2 Group
  • Customer 2 Zone (No entries)

The following table shows what will happen to the traffic, based on its most specific source and destination:

Destination	Traffic from AS A	Traffic from Business B	Traffic from Corrupted Server C
Default Zone	Dropped (Global Block List for A)	Dropped (Global Block List for A)	Dropped (Global Block List for A)
Customer 1 Zone	Dropped (Global Block List for A)	Analyzed per zone settings (Local Block List Exception for B)	Dropped (Local Block List for C)
Customer 2 Zone	Dropped (Global Block List for A)	Dropped (Global Block List for A)	Dropped (Global Block List for A)