Stateless Firewall Filter Overview
Packet Flow Control
To influence which packets are allowed to transit the system and to apply special actions to packets as necessary, you can configure stateless firewall filters. A stateless firewall specifies a sequence of one or more packet-filtering rules, called filter terms. A filter term specifies match conditions to use to determine a match and actions to take on a matched packet. A stateless firewall filter enables you to manipulate any packet of a particular protocol family, including fragmented packets, based on evaluation of Layer 3 and Layer 4 header fields. You typically apply a stateless firewall filter to one or more interfaces that have been configured with protocol family features. You can apply a stateless firewall filter to an ingress interface, an egress interface, or both.
Data Packet Flow Control
To control the flow of data packets transiting the device as the packets are being forwarded from a source to a destination, you can apply stateless firewall filters to the input or output of the router’s or switch’s physical interfaces.
To enforce a specified bandwidth and maximum burst size for traffic sent or received on an interface, you can configure policers. Policers are a specialized type of stateless firewall filter and a primary component of the Junos OS class-of-service (CoS).
Local Packet Flow Control
To control the flow of local packets between
the physical interfaces and the Routing Engine,
you can apply stateless firewall filters to the
input or output of the loopback interface.
The loopback interface (lo0) is
the interface to the Routing Engine and carries no
data packets.
Junos OS Evolved Local Packet Flow Control
In Junos OS Evolved, you can have two different filters: one for network control traffic (loopback traffic) and one for management traffic (management interface). With two filters, you have more flexibility. For example, you can configure a stricter filter on management interface traffic than on network control traffic.
On Junos OS and Junos OS Evolved, network control traffic firewall filters or loopback firewall filters (Lo0/Lo6) behave the same and there is no difference. You configure a Lo0/Lo6 firewall filter at INET or INET6 firewall filter hierarchy of the Lo0/Lo6 interface. To provide filtering capability for the packet egressing on Lo0 interface, firewall filter is implemented in the software kernel by way of Juniper's Netfilters. Netfilters is installed in the linux kernel and no hardware is involved on this.
The following is a sample configuration for Lo0 firewall filters.
set firewall family inet filter finet interface-specific set firewall family inet filter finet term t1 from source-address 10.0.0.2/32 set firewall family inet filter finet term t1 from destination-address 10.0.0.1/32 set firewall family inet filter finet term t1 from protocol tcp set firewall family inet filter finet term t1 from source-port ssh set firewall family inet filter finet term t1 from destination-port ssh set firewall family inet filter finet term t1 then count c1 set firewall family inet filter finet term t1 then log set interfaces lo0 unit 0 family inet filter input finet
Table 1, Table 2, Table 3, and Table 4 show the supported match conditions and actions for Lo0/Lo6 firewall filter family in Junos OS Evolved.
|
Firewall Filter Match Condition |
Lo0 |
Lo6 |
|---|---|---|
|
ip-destination-address |
Yes |
Yes |
|
ip-source-address |
Yes |
Yes |
|
destination-prefix-list |
Yes |
Yes |
|
source-prefix-list |
Yes |
Yes |
|
destination-port |
Yes |
Yes |
|
source-port |
Yes |
Yes |
|
ip-protocol |
Yes |
Yes |
|
first-fragment |
Yes |
No |
|
is-fragment |
Yes |
No |
|
tcp-flags |
Yes |
Yes |
|
ttl |
Yes |
No |
|
dscp |
Yes |
No |
|
Firewall Filter Match Condition |
Lo0 |
Lo6 |
|---|---|---|
|
ip-destination-address |
No |
Yes |
|
ip-source-address |
No |
Yes |
|
destination-prefix-list |
No |
Yes |
|
source-prefix-list |
No |
Yes |
|
destination-port |
No |
Yes |
|
Action |
Lo0 |
Lo6 |
|---|---|---|
|
count |
Yes |
Yes |
|
discard |
Yes |
Yes |
|
policer |
Yes |
Yes |
|
three-color-policer |
Yes |
Yes |
|
Action |
Lo0 |
Lo6 |
|---|---|---|
|
count |
Yes |
Yes |
|
discard |
Yes |
Yes |
|
policer |
Yes |
Yes |
|
three-color-policer |
Yes |
Yes |
Management filtering uses Routing Engine filters based on netfilters, a framework provided by the Linux kernel. This difference results in only certain matches and actions being supported. In Routing Engine Firewall Filters to some key differences are listed between Junos OS and Junos OS Evolved.
You must explicitly add the filter on the management interface as for Junos OS Evolved, the lo0 filter no longer applies on the management traffic, as is the case for Junos OS.
To configure in management interface filter, the filter has to be configured at family INET or INET6 firewall filter hierarchy of management interface. The following a sample configuration for configuring firewall filter one the management interface.
set firewall family inet filter f1 interface-specific set firewall family inet filter f1 term t1 from protocol tcp set firewall family inet filter f1 term t1 then count c1 set firewall family inet filter f1 term t1 then accept set firewall family inet filter f1 term t2 from protocol icmp set firewall family inet filter f1 term t2 then count c3 set firewall family inet filter f1 term dft then count dft_cnt set firewall family inet filter f1 term dft then accept set interfaces re0:mgmt-0 unit 0 family inet filter input f1
Table 5, and Table 6, and Table 7 show the supported firewall filter match conditions and actions on management interfaces.
|
Firewall Filter Match Condition |
Supported |
|---|---|
|
address |
Yes |
|
destination-address |
Yes |
|
destination-port |
Yes |
|
destination-port-except |
Yes |
|
destination-prefix-list |
Yes |
|
icmp-code |
Yes |
|
icmp-code-except |
Yes |
|
icmp-type |
Yes |
|
icmp-type-except |
Yes |
|
next-header |
Yes |
|
next-header-except |
Yes |
|
packet-length |
Yes |
|
packet-length-except |
Yes |
|
payload-protocol |
Yes |
|
payload-protocol-except |
Yes |
|
port |
Yes |
|
port-except |
Yes |
|
prefix-list |
Yes |
|
source-address |
Yes |
|
source-port |
Yes |
|
source-port-except |
Yes |
|
source-prefix-list |
Yes |
|
tcp-established |
Yes |
|
tcp-flags |
Yes |
|
tcp-initial |
Yes |
|
traffic-class |
Yes |
|
traffic-class-except |
Yes |
|
Firewall Filter Match Condition |
Supported |
|---|---|
|
dscp |
Yes |
|
dscp-except |
Yes |
|
precedence |
Yes |
|
precedence-except |
Yes |
|
protocol |
Yes |
|
protocol-except |
Yes |
|
ttl |
Yes |
|
ttl-except |
Yes |
|
Firewall filter action |
IPv4 |
IPv6 |
|---|---|---|
|
accept |
Yes |
Yes |
|
count |
Yes |
Yes |
|
forwarding-class |
Yes |
Yes |
|
loss-priority |
Yes |
Yes |
|
policer |
Yes |
Yes |
|
reject |
Yes |
Yes |
|
syslog |
Yes |
Yes |
Stateless and Stateful Firewall Filters
A stateless firewall filter, also known as an access control list (ACL), does not statefully inspect traffic. Instead, it evaluates packet contents statically and does not keep track of the state of network connections. In contrast, a stateful firewall filter uses connection state information derived from other applications and past communications in the data flow to make dynamic control decisions.
The Routing Policies, Firewall Filters, and Traffic Policers User Guide describes stateless firewall filters.
Purpose of Stateless Firewall Filters
The basic purpose of a stateless firewall filter is to enhance security through the use of packet filtering. Packet filtering enables you to inspect the components of incoming or outgoing packets and then perform the actions you specify on packets that match the criteria you specify. The typical use of a stateless firewall filter is to protect the Routing Engine processes and resources from malicious or untrusted packets.