RPKI Invalid Route Filtering by Public Cloud Providers in India (August 2025)

I’m working on a project that requires filtering out all BGP routes that are invalid under RPKI (Resource Public Key Infrastructure) validation. Since I do not control the underlying infrastructure myself, I must rely on the configuration and routing security options made available by public cloud providers.

Below is a table summarizing the major public cloud platforms in India, their Autonomous System Numbers (ASNs), IPv6 support, and whether they enforce filtering of BGP routes that are marked as RPKI-invalid (routes for which there is no valid Route Origin Authorization [ROA]):

Disclaimer: This data was collected in August 2025. Cloud providers may update their BGP filtering policies, Always verify these details yourself before talking infrastructure decisions.

How I Evaluated Route Filtering

For networks with RIPE Atlas probes, I utilized those probes to perform a traceroute measurement targeting invalid.rpki.isbgpsafeyet.com. link

For cloud providers without RIPE Atlas probes, I deployed a server and executed the following command:

curl https://invalid.rpki.isbgpsafeyet.com

A failed connection suggests the provider is properly filtering invalid routes. A successful connection indicates the provider is not filtering invalid BGP routes.

root@hyd:~$ curl https://invalid.rpki.isbgpsafeyet.com
{"status":"valid","asn":31898,"name":"Oracle Cloud Infrastructure","blackholed":false}
root@hyd:~$

During testing, I observed that Contabo’s AS141995 (Asia) and AS40021 (US) are not filtering invalid routes, while AS51167 (EU) is filtering them correctly. This example highlights the importance of testing route filtering across all regions you plan to use.

* This post is licensed under CC BY-SA 4.0