Skip to content

FHRP takeover (VRRP/HSRP)

1. Context & stakes

Seize the master role of a redundant gateway.

FHRP protocols like VRRP and HSRP present a virtual gateway IP shared by redundant routers, electing a master by priority. With weak or default authentication an attacker advertises the highest priority, becomes master, and every host sends its off-subnet traffic through them. That is a clean gateway MITM; strong FHRP authentication and control-plane ACLs are the countermeasures.

2. Theory

VRRP/HSRP give a subnet a virtual gateway IP shared by several routers; the highest-priority router is master and answers for the virtual IP/MAC. An attacker joining with a higher priority (VRRP is unauthenticated by default) becomes master and receives the segment's outbound traffic - a gateway takeover.

3. Attack (PoC)

netlab-vrrp-hsrp attack --i-own-this-network --iface veth-host
  1. Advertise a higher VRRP/HSRP priority
  2. Become master -> MITM

4. Detection

netlab-vrrp-hsrp detect --iface veth-host

Indicators to watch, and the associated IDS rule (see netlab-ids).

5. Defense

  • FHRP authentication
  • Priority hardening

6. Exercise

Reproduce in the isolated lab (netns/veth): see lab setup.

7. Further reading