Unterstützung von Firewall-Filtern auf der Loopback-Schnittstelle
Eine Loopback-Schnittstelle ist ein Gateway für den gesamten Steuerungsdatenverkehr, der in die Routing-Engine des Routers eingeht. Wenn Sie diesen Steuerungsdatenverkehr überwachen möchten, müssen Sie einen Firewallfilter auf der Loopback-Schnittstelle (lo0) konfigurieren.
Loopback-Firewall-Filter werden nur auf Pakete angewendet, die zur weiteren Verarbeitung an die Routing-Engine gesendet werden. Es werden sowohl Filter der inet- als auch der inet6-Familie unterstützt, und Sie können einen Firewall-Filter in Eingangs- und Ausgangsrichtung auf der lo0-Schnittstelle anwenden. Es werden jedoch nur interface-specific Instanzen des Firewallfilters unterstützt.
Informationen zu den Standardbedingungen für Firewall-Filter finden Sie unter Übereinstimmungsbedingungen für IPv4-Datenverkehr (Router der ACX-Serie).
Der Firewall-Filter auf lo0 behandelt die folgenden Ausnahmepakete in Eingangsrichtung:
-
TTL-Ausnahmepakete
-
Multicast-Pakete mit 224.0.0.x als Ziel-IP-Adresse
-
Broadcast-Pakete
-
IP-Optionspakete
HINWEIS:
Obwohl Policer-Aktionen an Loopback-Filter in Eingangsrichtung angehängt werden können, hängt das genaue Verhalten von den CPU-RX-Warteschlangenkonfigurationen ab. Beispielsweise erfolgt die Ratenbegrenzung in Eingangsrichtung (über die Policer-Konfiguration) nach allen CPU-Ratenbegrenzern.
Im Folgenden finden Sie eine Beispielkonfiguration für das Anhängen einer Firewall an die Loopback-Schnittstelle:
[edit interfaces]
lo0 {
unit 0 {
family <inet | inet6> {
filter {
input f1;
}
}
}
}
family <inet | inet6>{
filter f1 {
interface-specific; >> Mandatory Field.
term t1 {
from {
protocol ospf;
}
then {
count c1;
discard;
}
}
term t2 {
then {
count c2;
accept;
}
}
}
}
Ein Loopback-Firewall-Filter kann auch so konfiguriert werden, dass er mit häufig verwendeten Protokollen wie BGP, OSPF, SSH, Telnet, ICMP, SNMP usw. übereinstimmt. Eine Beispielkonfiguration sieht wie folgt aus:
set firewall family inet filter LoTest interface-specific set firewall family inet filter LoTest term tc1-ospfv2 from source-address 10.1.1.3/32 set firewall family inet filter LoTest term tc1-ospfv2 from protocol ospf set firewall family inet filter LoTest term tc1-ospfv2 then count LoCount set firewall family inet filter LoTest term tc1-ospfv2 then accept set firewall family inet filter LoTest term tc1-bgp4 from source-address 10.1.1.3/32 set firewall family inet filter LoTest term tc1-bgp4 from protocol tcp set firewall family inet filter LoTest term tc1-bgp4 from destination-port bgp set firewall family inet filter LoTest term tc1-bgp4 then count LoCount set firewall family inet filter LoTest term tc1-bgp4 then accept set firewall family inet filter LoTest term tc3-icmp from source-address 10.1.1.5/32 set firewall family inet filter LoTest term tc3-icmp from protocol icmp set firewall family inet filter LoTest term tc3-icmp from icmp-type 11 set firewall family inet filter LoTest term tc3-icmp from icmp-code 1 set firewall family inet filter LoTest term tc3-icmp then count LoCount set firewall family inet filter LoTest term tc3-icmp then accept set firewall family inet filter LoTest term tc5-tcpSyn from source-address 10.1.1.7/32 set firewall family inet filter LoTest term tc5-tcpSyn from protocol tcp set firewall family inet filter LoTest term tc5-tcpSyn from tcp-flags syn set firewall family inet filter LoTest term tc5-tcpSyn then policer LoPolicer set firewall family inet filter LoTest term tc5-tcpSyn then count LoCount set firewall family inet filter LoTest term tc5-tcpSyn then accept set firewall family inet filter LoTest term tc6-snmp from source-address 10.1.1.8/32 set firewall family inet filter LoTest term tc6-snmp from protocol udp set firewall family inet filter LoTest term tc6-snmp from destination-port snmp set firewall family inet filter LoTest term tc6-snmp then count LoCount set firewall family inet filter LoTest term tc6-snmp then accept set firewall family inet filter LoTest term tc6-ntp from source-address 10.1.1.8/32 set firewall family inet filter LoTest term tc6-ntp from protocol udp set firewall family inet filter LoTest term tc6-ntp from destination-port ntp set firewall family inet filter LoTest term tc6-ntp then count LoCount set firewall family inet filter LoTest term tc6-ntp then accept set firewall family inet filter LoTest term tc6-dns from source-address 10.1.1.8/32 set firewall family inet filter LoTest term tc6-dns from protocol udp set firewall family inet filter LoTest term tc6-dns from destination-port domain set firewall family inet filter LoTest term tc6-dns then count LoCount set firewall family inet filter LoTest term tc6-dns then accept set firewall family inet filter LoTest term tc8-ipOptions from source-address 10.1.1.10/32 set firewall family inet filter LoTest term tc8-ipOptions from ip-options router-alert set firewall family inet filter LoTest term tc8-ipOptions then count LoCount set firewall family inet filter LoTest term tc8-ipOptions then accept set firewall family inet filter LoTest term tc9-icmp from source-address 10.1.1.11/32 set firewall family inet filter LoTest term tc9-icmp from protocol icmp set firewall family inet filter LoTest term tc9-icmp from icmp-type 11 set firewall family inet filter LoTest term tc9-icmp from icmp-code 1 set firewall family inet filter LoTest term tc9-icmp then policer LoPolicer set firewall family inet filter LoTest term tc9-icmp then count LoCount set firewall family inet filter LoTest term tc9-icmp then accept set firewall family inet filter LoTest term tc12-ospfv2 from source-address 10.1.1.13/32 set firewall family inet filter LoTest term tc12-ospfv2 from protocol ospf set firewall family inet filter LoTest term tc12-ospfv2 then count LoCount set firewall family inet filter LoTest term tc12-ospfv2 then accept set firewall family inet filter LoTest term tc13-ssh from source-address 10.1.1.14/32 set firewall family inet filter LoTest term tc13-ssh from protocol tcp set firewall family inet filter LoTest term tc13-ssh from destination-port ssh set firewall family inet filter LoTest term tc13-ssh then count LoCount set firewall family inet filter LoTest term tc13-ssh then discard set firewall family inet filter LoTest term tc14-pl from source-address 10.1.1.15/32 set firewall family inet filter LoTest term tc14-pl from packet-length 4000-9000 set firewall family inet filter LoTest term tc14-pl from protocol ospf set firewall family inet filter LoTest term tc14-pl then count LoCount set firewall family inet filter LoTest term tc14-pl then accept set firewall family inet filter LoTest term tc16-pl from source-address 10.1.1.17/32 set firewall family inet filter LoTest term tc16-pl from fragment-flags more-fragments set firewall family inet filter LoTest term tc16-pl from protocol ospf set firewall family inet filter LoTest term tc16-pl then count LoCount set firewall family inet filter LoTest term tc16-pl then discard set firewall family inet filter LoTest term tc17-ssh from source-address 10.1.1.18/32 set firewall family inet filter LoTest term tc17-ssh from destination-address 10.216.66.30/32 set firewall family inet filter LoTest term tc17-ssh from protocol tcp set firewall family inet filter LoTest term tc17-ssh from destination-port ssh set firewall family inet filter LoTest term tc17-ssh then count LoCount set firewall family inet filter LoTest term tc17-ssh then accept set firewall family inet filter LoTest term all then accept set firewall family inet6 filter LoTest6 interface-specific set firewall family inet6 filter LoTest6 term tc2-ospfv3 from source-address 2001:db8:4136:e378:8000:63bf:3fff:fdd2 set firewall family inet6 filter LoTest6 term tc2-ospfv3 from next-header ospf set firewall family inet6 filter LoTest6 term tc2-ospfv3 then count LoCount6 set firewall family inet6 filter LoTest6 term tc2-ospfv3 then accept set firewall family inet6 filter LoTest6 term tc2-bgp4plus from source-address 2001:db8:4136:e378:8000:63bf:3fff:fdd2 set firewall family inet6 filter LoTest6 term tc2-bgp4plus from next-header tcp set firewall family inet6 filter LoTest6 term tc2-bgp4plus from destination-port bgp set firewall family inet6 filter LoTest6 term tc2-bgp4plus then count LoCount6 set firewall family inet6 filter LoTest6 term tc2-bgp4plus then accept set firewall family inet6 filter LoTest6 term tc4-icmpv6 from source-address 2001:db8:4136:e378:8000:63bf:3fff:fdd3 set firewall family inet6 filter LoTest6 term tc4-icmpv6 from next-header icmp6 set firewall family inet6 filter LoTest6 term tc4-icmpv6 from icmp-type 1 set firewall family inet6 filter LoTest6 term tc4-icmpv6 from icmp-code 0 set firewall family inet6 filter LoTest6 term tc4-icmpv6 then count LoCount6 set firewall family inet6 filter LoTest6 term tc4-icmpv6 then accept set firewall family inet6 filter LoTest6 term tc7-snmp from next-header udp set firewall family inet6 filter LoTest6 term tc7-snmp from destination-port snmp set firewall family inet6 filter LoTest6 term tc7-snmp then count LoCount6 set firewall family inet6 filter LoTest6 term tc7-snmp then accept set firewall family inet6 filter LoTest6 term tc7-ntp from next-header udp set firewall family inet6 filter LoTest6 term tc7-ntp from destination-port ntp set firewall family inet6 filter LoTest6 term tc7-ntp then count LoCount6 set firewall family inet6 filter LoTest6 term tc7-ntp then accept set firewall family inet6 filter LoTest6 term tc7-dns from next-header udp set firewall family inet6 filter LoTest6 term tc7-dns from destination-port domain set firewall family inet6 filter LoTest6 term tc7-dns then count LoCount6 set firewall family inet6 filter LoTest6 term tc7-dns then accept set firewall family inet6 filter LoTest6 term tc10-icmp from source-address 2001:db8:4136:e378:8000:63bf:3fff:fdd4 set firewall family inet6 filter LoTest6 term tc10-icmp from next-header icmp6 set firewall family inet6 filter LoTest6 term tc10-icmp from icmp-type 1 set firewall family inet6 filter LoTest6 term tc10-icmp from icmp-code 0 set firewall family inet6 filter LoTest6 term tc10-icmp then policer LoPolicer set firewall family inet6 filter LoTest6 term tc10-icmp then count LoCount6 set firewall family inet6 filter LoTest6 term tc10-icmp then accept set firewall family inet6 filter LoTest6 term all then accept set firewall policer LoPolicer if-exceeding bandwidth-limit 22k set firewall policer LoPolicer if-exceeding burst-size-limit 20k set firewall policer LoPolicer then discard