O'Reilly logo

JUNOS Cookbook by Aviva Garrett

Stay ahead with the world's most comprehensive technology and business learning platform.

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, tutorials, and more.

Start Free Trial

No credit card required

9.11. Filtering Traffic Transiting the Router

Problem

For traffic transiting through the router, you want to accept packets only from trusted hosts and routers.

Solution

Create a firewall filter for all incoming traffic to the router that will be used on interfaces facing the Internet. The filter contains a number of terms for different types of packets and for specific addresses.

The first term discards unwanted traffic from specific addresses:

	[edit firewall incoming-to-me]
	aviva@RouterF# set term reject-addresses from source-address 172.68.0.0/16
	aviva@RouterF# set term reject-addresses from source-address 192.168.0.0/24
	aviva@RouterF# set term reject-addresses then discard

The second term accepts traffic from BGP peers:

	[edit firewall filter incoming-to-me]
	aviva@RouterF# set term bgp-peers from destination-address 10.0.31.0/24
	aviva@RouterF# set term bgp-peers from protocol tcp
	aviva@RouterF# set term bgp-peers from port bgp
	aviva@RouterF# set term bgp-peers from tcp-established
	aviva@RouterF# set term bgp-peers then accept

The third term accepts all ICMP traffic:

	[edit firewall filter incoming-to-me]
	aviva@RouterF# set term icmp from protocol icmp
	aviva@RouterF# set term icmp then accept

The last term accepts all other packets:

	[edit firewall filter incoming-to-me]
	aviva@RouterF# set term final-accept then accept

For the filter to take effect, apply it to an Internet-facing interface:

	[edit interfaces t1-0/0/3]
	aviva@RouterF# set unit 0 family inet filter input incoming-to-me

Discussion ...

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, interactive tutorials, and more.

Start Free Trial

No credit card required