Unicast RPF (uRPF)

Each packet that reaches your router asks one question: where do I send this?
To answer this, your router looks up the destination address in its routing table.

Traditional IP Routing

A packet arrives on G0/0 from your LAN, headed for 203.0.113.50 on the Internet.

Figure 1 – Only the destination is looked up

Your router will check its routing table to find a route that matches this destination.
You can use the following command:

R1# show ip route 203.0.113.50
Routing entry for 203.0.113.0/24
  Known via "static", distance 1, metric 0
  Routing Descriptor Blocks:
  * 10.0.1.2, via GigabitEthernet0/1
      Route metric is 0, traffic share count is 1

There it is.

203.0.113.0/24 is reachable via G0/1, so your router forwards the packet out of that interface.

Figure 2 – Forwarded out of G0/1

That is the whole process.

The Source Is Never Checked

Now, notice what did not happen.
Your router never asked whether 192.168.1.10 was a plausible source address.

Nothing stops a host on your LAN from writing any source address it wants.
This is IP spoofing!

Figure 3 – A forged source, forwarded anyway

Put yourself in your router's place.
No protection mechanism is enabled on it, so it does exactly what it did before: it looks up the destination in its routing table.

R1# show ip route 203.0.113.50
Routing entry for 203.0.113.0/24
  Known via "static", distance 1, metric 0
  Routing Descriptor Blocks:
  * 10.0.1.2, via GigabitEthernet0/1
      Route metric is 0, traffic share count is 1

Your router forwards them all, without ever questioning that address.
What does that buy an attacker?

A host that lies about its source address can:

• hide where the traffic really comes from

• send the replies to a victim instead of itself

• slip past your filters that trust internal addresses

Turning uRPF On

Now, let's configure uRPF.
It cannot run without CEF, so that one goes on first:

R1# conf t
Enter configuration commands, one per line.  End with CNTL/Z.
R1(config)# ip cef
R1(config)# interface g0/0
R1(config-if)# ip verify unicast source reachable-via rx
R1(config-if)# end

One line on your interface, and every packet arriving on G0/0 now gets its source address checked.
Now, a malicious host sends a packet with a source address of 192.0.2.99.

Your router checks whether that source address exists in its routing table.
If no route matches it, your router drops the packet.

Figure 4 – No route to the source, packet dropped

Let's simulate that scenario and forge a packet with the source address 192.0.2.99.

R2 sits on your LAN, and its Loopback 1 carries the forged address. Send five packets from it:

R2# ping 203.0.113.50 source loopback 1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 203.0.113.50, timeout is 2 seconds:
Packet sent with a source address of 192.0.2.99
.....
Success rate is 0 percent (0/5)

Five dots, not one reply.
Go and look on R1:

R1# show ip interface g0/0 | include verif
  IP verify source reachable-via RX
  5 verification drops
  0 suppressed verification drops
  0 verification drop-rate

Five spoofed packets, five drops.

You saw uRPF drop a packet. Here is what actually happened inside your router.
It comes down to one extra lookup, and the order in which it runs.

Source Lookup

With uRPF running on your G0/0, the packet now triggers two lookups.

Figure 5 – uRPF adds a source lookup

The source lookup comes first.
If it fails, your router drops the packet and the destination lookup never happens.

A Valid Packet

192.168.1.0/24 is reachable via G0/0.
That is exactly where the packet arrived, so the source is valid.