# Problem with adding prohibit routes in /etc/conf.d/net

## ahoogerhuis

I've been having issues getting /etc/conf.d/net to add routes of type "prohibit, such as:

routes_bond0_928=(

        "prohibit 1.2.3.0/24 # Blackhole this

)

Basically the docs i can find on /etc/conf.d/net says whatever goes between the quotes is what gets appended to "ip route add", i.e. this construct should work (but doesn't).

Anyone know how to solve this?

-A

----------

## Bones McCracker

Why do you have a single quote symbol preceding the keyword prohibit with no matching quote?  I don't recall the /etc/conf.d/net syntax off-hand, but maybe it should be:

```
routes_bond0_928=(

     "prohibit 1.2.3.0/24"                 # blackhole this

)
```

If that's not it, then you'd have to trace the networking script (I suppose you'd trace the initscript by starting it using 'bash -x /etc/init.d/net.bond0_928' or such) to find out what's going wrong.  Or you could manually walk though the scripts and figure out where the 'ip' command is being executed and diagnose it.  Or you could file a bug.

If you are using baselayout2, it is my understanding that use of /etc/conf.d/net (i.e., the old gentoo networking scripts) is actually deprecated, and they are supposed to go away at some point.  You could simply put it in /etc/conf.d/network (which is the file that essentially replaces /etc/conf.d/net):

```
interfaces="bond0"

ifup_bond0_928="ip route prohibit 1.2.3.0/24"
```

----------

## AngelKnight

Next closest thing I can think of [1] is adding to /etc/conf.d/staticroute and adding the staticroute initscript to a runlevel.

Reason being that I think the "routes_${INTF}" pragma tries to add "dev ${INTF}", which the iproute2 tools won't accept for a blackhole, throw or prohibit route entry.

[1] Problem is, the staticroute script is deprecated and going away RSN.

----------

## Bones McCracker

Yes, apparently since the time I posted that a year ago, we are no longer going to replace /etc/conf.d/net with /etc/conf.d/network and friends, which itself is now deprecated in favor of the old networking /etc/conf.d/net scripts.   :Laughing: 

----------

