Home g33k Handy Internet Interface JUNOS Firewall Filters

Handy Internet Interface JUNOS Firewall Filters

g33k cooperlees · 2011-09-25 · 8 Comments

Here are two handy firewall filters to apply to any internet facing interface on your JUNOS network device.

BOGON List
- Apply as input on Internet facing interface
- You should also add any Public Address space that you have inside your network

[plain]
set firewall family inet filter BOGON-DENY term discard-bogon-net from source-address 10.0.0.0/8
set firewall family inet filter BOGON-DENY term discard-bogon-net from source-address 127.0.0.0/8
set firewall family inet filter BOGON-DENY term discard-bogon-net from source-address 169.254.0.0/16
set firewall family inet filter BOGON-DENY term discard-bogon-net from source-address 172.16.0.0/12
set firewall family inet filter BOGON-DENY term discard-bogon-net from source-address 192.0.0.0/24
set firewall family inet filter BOGON-DENY term discard-bogon-net from source-address 192.0.2.0/24
set firewall family inet filter BOGON-DENY term discard-bogon-net from source-address 192.168.0.0/16
set firewall family inet filter BOGON-DENY term discard-bogon-net from source-address 198.18.0.0/15
set firewall family inet filter BOGON-DENY term discard-bogon-net from source-address 198.51.100.0/24
set firewall family inet filter BOGON-DENY term discard-bogon-net from source-address 203.0.113.0/24
set firewall family inet filter BOGON-DENY term discard-bogon-net from source-address 224.0.0.0/3
set firewall family inet filter BOGON-DENY term discard-bogon-net then count BOGONS
set firewall family inet filter BOGON-DENY term discard-bogon-net then discard
set firewall family inet filter BOGON-DENY term allow-everything-else then accept
[/plain]

Private Address Reject
- Apply as output on Internet facing interface

[plain]
set firewall family inet filter PRIVATE-REJECT term reject-rfc-1918 from destination-address 10.0.0.0/8
set firewall family inet filter PRIVATE-REJECT term reject-rfc-1918 from destination-address 172.16.0.0/12
set firewall family inet filter PRIVATE-REJECT term reject-rfc-1918 from destination-address 192.168.0.0/16
set firewall family inet filter PRIVATE-REJECT term reject-rfc-1918 then count RFC-1918
set firewall family inet filter PRIVATE-REJECT term reject-rfc-1918 then reject
set firewall family inet filter PRIVATE-REJECT term allow-everything-else then accept
[/plain]

cooperlees

This Post Has 8 Comments

Akilah says:

2011-10-01 at 01:32

Greetings I discovered your webpage by mistake when i was searching Msn for this subject, I must say your site is quite helpful I also love the layout, it is great!

Reply
Internet Filter says:

2011-10-01 at 21:32

Thanks for sharing handy firewall filters to apply to any internet facing interface on your network device…. Grate Post!!

Reply
Josiah Tassinari says:

2012-04-17 at 04:01

Considerably like another individual documented exactly what a this superb weblog.

Reply
Khadijah Liebsch says:

2012-05-17 at 19:24

Thanks a whole lot People, your personal submit helped us to get a number of exceptional issues that is really brilliant.

Reply
Joseph Aiava says:

2012-07-17 at 22:20

Your producing style has turn into astonished me. Thanks a good deal, extremely wonderful post. Recruiters flash Jobs & Resumes

Reply
Alysha Whelihan says:

2012-07-30 at 18:01

I appreciate any person spending some time to speak about all of them with us all.

Reply
Tesha Shelkoff says:

2012-08-23 at 12:50

I am seeking someone that want much more info Sewer

Reply
how social media has affected commerce says:

2012-09-02 at 14:22

It doesn’t assist make any sense. You do possess a good option involving what’s going on

Reply