Auto BlackHoling

RouterOS Forwarding Protocols
1

Hello, I have a system that detects attacks (DDOS) on the CCR and by BGP sends to my main router an IP address in the prefix / 32 which is being attacked.
How can I send such an IP address with a changed community to my upstreamers to cut the address? An example from BIRD:

        if  ((XXX,666) ~ bgp_community ) then  {
        bgp_community = -empty-;
        bgp_community.add((1234,666));
        accept;
        }

So if it detects / 32 from community XXX, 666 changes it to 1234,666 and sends it to upstremers.

2

hello,
which system do you use for detect dddos ?

3

The question will rely on your upstream provider - so you will need to know what they expect so you can tag the route specifically. They will likely accept routes down to /32 with community :666 so they know to add as blackhole. Adjust your filters to look for routes with your own blackhole community and add the upstreams blackhole community on export.