Skip to content

Upstream ignoring my prefix filters, am I liable?

Networking by FyreJun 7 replies 444 views
#1

It is my humble opinion that perhaps I have made an error in my configuration, yet the situation weighs heavily upon me. I operate a small BGP session with an upstream at OVHcloud. We have exchanged prefix lists, and it is my understanding that I have implemented proper filters on my end. However, my upstream appears to be accepting routes from me that I did not intend to announce. I discovered this only when a colleague contacted me regarding unexpected traffic.

I fear that should their acceptance of these routes cause harm to others, I may bear some responsibility. It is not my wish to cause trouble for anyone. Let us discuss where liability truly lies in such arrangements. I apologize for any inconvenience my post may cause, and I thank you in advance for your patience with my concerns.

3 #2

Wesh FyreJun

Incha'allah your filters hold next time. Le upstream حلو if they ignore your config, but le contract ?? Usually they eat the blame bro. Check your LOA and their IRR route objects; spacing matters in French law, maybe not in your jurisdiction.

8 #3

Contract eats it

1 #4
FyreJun said:
I may bear some responsibility

You are NOT automatically liable. But here is what could go wrong:

  • Upstream leaks your "private" blocks → blackholing somewhere
  • Someone hijacks via your loose filters → YOU look like the attacker
  • OVHcloud has no RPKI ROA for your space → cascade failure

Run bgpq4 against your IRR entries. Check what you actually generate!

Also: fail2ban on your looking glass. Firewalls everywhere.

airgapped, encrypted, faraday'd, still worried
#5

FyreJun filters good. Upstream bad. Liability theirs per contract. Check TOS. OVHcloud known for this. Perkele. Lawyer needed. Not your fault. Network okay. Price bad.

#6

OVHcloud's TOS covers this? I'd check the LOA wording.

#7

Same thing happened to me at OVHcloud.

one small ping for man...
#8

Which prefix list format, juniper or cisco

Post a reply

You need an account to reply. Log in or register to join the conversation.

Post reply Preview Save draft