Null0 Routes and Route Filtering

A Null0 route is a static route pointing to the Null0 interface. The Null0 interface is a virtual interface on Cisco routers that acts as a packet sink — any packet routed to Null0 is immediately discarded without any processing or error message. The router does not generate an ICMP unreachable message; the packet simply disappears. This is different from an ACL deny, which also drops packets but may generate an ICMP unreachable depending on configuration. Null0 routes are used primarily for two purposes: blackholing unwanted traffic (e.g., DDoS mitigation) and preventing routing loops.

Consider a router that has a default route (0.0.0.0/0) pointing to a next-hop, and also receives a more specific route for a prefix via a dynamic routing protocol. If that dynamic route is withdrawn, the router will fall back to the default route. But if the default route points back to the same router that learned the prefix (e.g., in a hub-and-spoke topology), a routing loop can occur. To prevent this, network engineers often configure a static Null0 route for the summary prefix that aggregates the more specific routes. For example, if you have routes for 10.1.1.0/24, 10.1.2.0/24, etc., you can configure ip route 10.1.0.0 255.255.255.0 Null0 to ensure that any traffic for the summary range that doesn't match a more specific route is dropped rather than looping.

Route filtering is the process of controlling which routes are installed in the routing table (inbound filtering) or advertised to neighbors (outbound filtering). The primary tools in Cisco IOS are: - Distribute lists: Apply an ACL or prefix list to filter routes in or out of a routing protocol process. - Prefix lists: A more efficient and flexible alternative to ACLs for matching routes based on prefix and length. - Route maps: Complex conditional logic that can match routes based on multiple criteria and set attributes.

A distribute list is configured under the routing protocol process using the distribute-list command. It can reference an ACL or a prefix list. The ACL matches routes based on the source IP address (the network address of the route) and, for standard ACLs, only the network portion. Extended ACLs can match more granularly but are rarely used. Example:

access-list 10 permit 192.168.1.0 0.0.0.255
router eigrp 100
 distribute-list 10 in

This filters inbound EIGRP updates, only allowing routes with network 192.168.1.0/24 (or any /24 within that range) to be installed. For outbound filtering, the out keyword is used, and the ACL matches routes that are allowed to be advertised.

Prefix lists are more precise than ACLs because they can match both the prefix and the prefix length. The syntax is:

ip prefix-list NAME [seq number] {permit|deny} network/length [ge ge-length] [le le-length]

Route maps are like if-then statements for routes. They can match on prefix list, metric, tag, next-hop, etc., and then set attributes like metric, tag, or next-hop. They are used in redistribution, policy-based routing, and BGP. Example:

route-map SET_METRIC permit 10
 match ip address prefix-list SPECIAL
 set metric 100

This matches routes permitted by the prefix list SPECIAL and sets their metric to 100.

Example output for show ip route with a Null0 route:

10.0.0.0/8 is variably subnetted, 2 subnets, 2 masks
C        10.0.0.0/8 is directly connected, Null0
S        10.1.1.0/24 [1/0] via 192.168.1.1

The 'C' next to the Null0 route indicates it is directly connected (even though it's a static route). This is a common trap: a static route to Null0 appears as a connected route because the router treats Null0 as a local interface.

Null0 routes can be redistributed into dynamic routing protocols, but this is rarely done because it can cause blackholing of traffic on other routers. Typically, Null0 routes are configured locally and not advertised. Route filtering, however, directly controls what is advertised or accepted, preventing unwanted prefixes from propagating.

In enterprise networks, Null0 routes are commonly used for DDoS mitigation. When a specific IP address is targeted by an attack, the network engineer can quickly inject a static Null0 route for that address (or a larger block) to drop all traffic to it, protecting internal infrastructure. This is often automated via BGP Flowspec or RTBH (Remotely Triggered Black Hole) routing. For example, a service provider might configure a trigger router that, upon detecting an attack, announces a /32 route with a next-hop of Null0 to its peers. The peers then install that route and drop traffic.

Route filtering is ubiquitous in redistribution scenarios. Consider a company that uses OSPF internally and EIGRP for a DMVPN network. Without filtering, OSPF routes could be redistributed into EIGRP and vice versa, potentially causing suboptimal routing or loops. A route map with prefix lists ensures only specific prefixes are exchanged. For example, only the corporate subnets (10.0.0.0/8) are allowed into EIGRP, while the DMVPN tunnels (192.168.0.0/16) are blocked from OSPF.

Another common use is filtering private IP addresses (RFC 1918) from being advertised to the internet. Service providers use prefix lists to deny 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16 from customer BGP announcements. This prevents private traffic from leaking onto the public internet. Misconfiguration here can cause major outages — for example, accidentally permitting a private prefix could cause that traffic to be routed incorrectly, or a missing deny could allow a customer to hijack a prefix.

Performance considerations: Prefix lists are processed in hardware on modern routers, so they are very efficient even with thousands of entries. ACLs, especially extended ACLs, are more CPU-intensive. Therefore, prefix lists are preferred for route filtering. Null0 routes have minimal performance impact because the drop happens at the forwarding plane. However, if a Null0 route is used for a large prefix (e.g., a /8), it can cause all traffic to that entire block to be dropped, which might be too aggressive in some scenarios.