ON THIS PAGE
Example: Configuring a Filter to Accept DHCP Packets Based on Address
This example shows how to configure a standard stateless firewall filter to accept packets from a trusted source.
Requirements
This example is supported only on MX Series routers and EX Series switches.
Overview
In this example, you create a filter (rpf_dhcp) that accepts DHCP packets
with a source address of 0.0.0.0 and a destination address of 255.255.255.255.
Configuration
The following example requires you to navigate various levels in the configuration hierarchy. For information about navigating the CLI, see Use the CLI Editor in Configuration Mode.
- CLI Quick Configuration
- Configure the Stateless Firewall Filter
- Apply the Firewall Filter to the Loopback Interface
- Confirm and Commit Your Candidate Configuration
CLI Quick Configuration
To quickly configure this example, copy the following configuration commands
into a text file, remove any line breaks, and then paste the commands into the CLI at the [edit] hierarchy level.
set firewall family inet filter rpf_dhcp term dhcp_term from source-address 0.0.0.0/32 set firewall family inet filter rpf_dhcp term dhcp_term from destination-address 255.255.255.255/32 set firewall family inet filter rpf_dhcp term dhcp_term then accept set interfaces ge-0/0/1 unit 0 family inet address 10.1.2.3/30 set interfaces ge-0/0/1 unit 0 family inet filter input sam
Configure the Stateless Firewall Filter
Step-by-Step Procedure
To configure the stateless firewall filter:
Create the stateless firewall filter
rpf_dhcp.[edit] user@host# edit firewall family inet filter rpf_dhcp
Configure the term to match packets with a source address of
0.0.0.0and a destination address of255.255.255.255.[edit firewall family inet filter rpf_dhcp] user@host# set term dhcp_term from source-address 0.0.0.0/32 user@host# set term dhcp_term from destination-address 255.255.255.255/32
Configure the term to accept packets that match the specified conditions.
[edit firewall family inet filter rpf_dhcp] set term dhcp_term then accept
Apply the Firewall Filter to the Loopback Interface
Step-by-Step Procedure
To apply the filter to the input at the loopback interface:
Apply the
rpf_dhcpfilter if packets are not arriving on an expected path.[edit] user@host# set interfaces lo0 unit 0 family inet rpf-check fail-filter rpf_dhcp
Configure an address for the loopback interface.
[edit] user@host# set interfaces lo0 unit 0 family inet address 127.0.0.1/32
Confirm and Commit Your Candidate Configuration
Step-by-Step Procedure
To confirm and then commit your candidate configuration:
Confirm the configuration of the stateless firewall filter by entering the
show firewallconfiguration mode command. If the command output does not display the intended configuration, repeat the instructions in this example to correct the configuration.[edit] user@host# show firewall family inet { filter rpf_dhcp { term dhcp_term { from { source-address { 0.0.0.0/32; } destination-address { 255.255.255.255/32; } } then accept; } } }Confirm the configuration of the interface by entering the
show interfacesconfiguration mode command. If the command output does not display the intended configuration, repeat the instructions in this example to correct the configuration.[edit] user@host# show interfaces lo0 { unit 0 { family inet { filter { rpf-check { fail-filter rpf_dhcp; mode loose; } } address 127.0.0.1/32; } } }When you are done configuring the device, commit your candidate configuration.
[edit] user@host# commit
Verification
To confirm that the configuration is working properly, enter the show firewall operational mode command.