How to Configure Blackhole, Prohibit, and Unreachable Routes in Linux Using ip route

In high-throughput Linux network routing and server administration, managing unsolicited, malicious, or unroutable traffic requires more than basic packet filtering. While stateful firewalls such as Netfilter and nftables excel at packet inspection, handling millions of illegitimate packets at layer 4 can exhaust connection tracking tables and consume critical CPU cycles. The Linux kernel routing subsystem provides built-in special routing types—specifically blackhole, prohibit, and unreachable—that allow the kernel to discard or reject network traffic directly at the routing table lookup stage with negligible overhead.

Configuring these route types using the modern ip route utility allows network engineers to mitigate denial-of-service floods, neutralize hostile subnets, eliminate routing loops, and manage private autonomous systems effectively. Understanding the functional differences between these route types and their integration with persistent configuration managers ensures robust network resilience.

Understanding Linux Special Route Types

When the Linux kernel evaluates an inbound or outbound IP packet against its Routing Information Base (RIB), standard routes direct the traffic towards a network interface or next-hop gateway. Special route types alter this forwarding path immediately:

• blackhole: Discards packets silently without sending any Internet Control Message Protocol (ICMP) notifications back to the sender. This route type provides maximum efficiency during volumetric Distributed Denial of Service (DDoS) mitigation because the kernel expends zero CPU cycles generating return packets.
• unreachable: Drops the packet and immediately generates an ICMP “Destination Unreachable / Host Unreachable” error message (ICMP type 3, code 1 for IPv4; ICMPv6 type 1, code 3 for IPv6) back to the originating host.
• prohibit: Drops the packet and generates an ICMP “Destination Unreachable / Communication Administratively Prohibited” error (ICMP type 3, code 13 for IPv4; ICMPv6 type 1, code 1 for IPv6). This explicitly informs legitimate remote clients that administrative security policy prevents access.

Configuring Temporary Special Routes with ip route

Special routing rules can be provisioned instantly using the ip route add command. These routes take effect immediately in the kernel routing cache without requiring service restarts.

1. Adding a Blackhole Route

To silently discard all incoming and outgoing traffic destined for a specific abusive IP address or subnet, append the blackhole keyword before the target network prefix:

sudo ip route add blackhole 203.0.113.45/32

To drop an entire CIDR network block exhibiting distributed malicious scanning activity:

sudo ip route add blackhole 198.51.100.0/24

For IPv6 networks, the exact same syntax applies using native 6-byte hexadecimal addressing:

sudo ip -6 route add blackhole 2001:db8:ffff::/48

2. Adding an Unreachable Route

When deprecating internal server subnets or debugging internal routing tables where client software needs immediate feedback rather than connection timeout delays, implement an unreachable route:

sudo ip route add unreachable 10.240.0.0/16

Remote clients attempting to establish a TCP or UDP handshake with an IP address within this subnet immediately receive an ICMP Host Unreachable packet, terminating application retries instantly.

3. Adding a Prohibit Route

To enforce administrative boundary segmentation and notify remote peers that security policies restrict communication, create a prohibit route:

sudo ip route add prohibit 192.0.2.128/26

Network scanners or clients probing this range will record an administrative filtering code, distinguishing administrative denial from transient network timeouts.

Verifying and Inspecting Special Routes

To confirm that special routes are active within the kernel routing table, query the routing table using ip route show:

ip route show

The output explicitly labels the special routing rules alongside standard device routes:

blackhole 198.51.100.0/24 proto boot
blackhole 203.0.113.45 proto boot
unreachable 10.240.0.0/16 proto boot
prohibit 192.0.2.128/26 proto boot
default via 192.168.1.1 dev eth0 proto dhcp src 192.168.1.50 metric 100

To test how the Linux kernel routes a specific IP address without sending physical packets, use the ip route get simulation command:

ip route get 203.0.113.45

The terminal confirms the blackhole evaluation:

RTNETLINK answers: Invalid argument

Testing an unreachable route reveals the ICMP response mechanism:

ip route get 10.240.5.12

RTNETLINK answers: No route to host

Deleting Special Routes

When threat mitigation concludes or IP blocklists require modification, delete the assigned route by replacing add with del:

sudo ip route del blackhole 203.0.113.45/32
sudo ip route del unreachable 10.240.0.0/16
sudo ip route del prohibit 192.0.2.128/26

Persisting Special Routes Across Reboots

Routes created directly via the ip command reside in kernel memory and disappear after a system reboot. To make these rules permanent on modern Linux distributions, integrate them into the system network configuration.

1. Persisting via Netplan (Ubuntu, Debian, and Derivatives)

Modern Ubuntu installations utilise Netplan. Open the primary Netplan configuration file located within /etc/netplan/:

sudo nano /etc/netplan/01-netcfg.yaml

Add a routes block under the primary interface, specifying the route type:

network:
  version: 2
  renderer: networkd
  ethernets:
    eth0:
      dhcp4: true
      routes:
        - to: 198.51.100.0/24
          type: blackhole
        - to: 10.240.0.0/16
          type: unreachable

Apply and validate the new configuration:

sudo netplan try
sudo netplan apply

2. Persisting via systemd-networkd

On standalone Linux servers managed directly by systemd-networkd, configure the network definition file under /etc/systemd/network/ (for example, 10-eth0.network):

[Route]
Destination=198.51.100.0/24
Type=blackhole

[Route]
Destination=10.240.0.0/16
Type=unreachable

Reload network configurations:

sudo networkctl reload

Integrating blackhole and unreachable routes into the kernel routing table provides high-performance packet discarding capable of handling line-rate denial-of-service traffic without exhausting host CPU resources.