firewall.conf

/* Template for an Internet border router */
interfaces <*> {
    unit <*> {
        family <*> {
            filter {
                /* external-facing */
                input-list [ measurement-v? border-policy-v? ratelimit-?e-v? allow-any-v? ];
                /* internal-facing, TODO: measurement */
                input-list [ measurement-v? irl-policy-v? allow-any-v? ]
                /* external facing */
                output antispoof-v?
            }
        }
    }
}

policy-options {
    prefix-list bgp-neighbors-v4 {
        127.0.0.0/8;
        apply-path "protocols bgp group <*> neighbor <*.*.*.*>";
    }
    prefix-list bgp-local-v4 {
        127.0.0.0/8;
        apply-path "protocols bgp group <*> neighbor <*> local-address <*.*.*.*>";
    }
    prefix-list bgp-neighbors-v6 {
        ::1/128;
        apply-path "protocols bgp group <*> neighbor <*:*:*>";
    }
    prefix-list bgp-local-v6 {
        ::1/128;
        apply-path "protocols bgp group <*> neighbor <*> local-address <*:*:*>";
    }
    /* XXX: hack needed when multihop peers arrive through the back door */
    prefix-list multihop-peers-v4 {
        127.0.0.0/8;
        /* ## REMOVED ## */
    }
    /* XXX: hack needed when multihop peers arrive through the back door */
    prefix-list multihop-peers-v6 {
        ::1/128;
        /* ## REMOVED ## */
    }
    /* https://www.iana.org/assignments/ipv4-address-space/ipv4-address-space.xhtml */
    prefix-list bogons-v4 {
        0.0.0.0/8;
        10.0.0.0/8;                         
        100.64.0.0/10;                      
        127.0.0.0/8;                        
        169.254.0.0/16;                     
        172.16.0.0/12;                      
        192.0.2.0/24;                       
        192.18.0.0/15;                      
        192.88.99.0/24;
        192.168.0.0/16;                     
        198.51.100.0/24;                    
        203.0.113.0/24;                     
        224.0.0.0/3;                        
    }
    /* https://tools.ietf.org/html/rfc6890 */
    /* https://www.iana.org/assignments/ipv6-unicast-address-assignments/ipv6-unicast-address-assignments.xhtml */
    /* https://www.iana.org/assignments/iana-ipv6-special-registry/iana-ipv6-special-registry.xhtml */
    prefix-list bogons-v6 {                 
        ::/128;                             
        ::1/128;                            
        ::ffff:0:0/96;                      
        64:ff9b:1::/48;                     
        100::/64;                           
        2001::/32;
        2001:2::/48;                        
        2001:db8::/32;                      
        2002::/16;
    }
}

firewall {
    policer ge-5percent {
        if-exceeding {                  
            bandwidth-limit 50m;        
            burst-size-limit 500k;        
        }                               
        then discard;                   
    }
    policer ge-50percent {
        if-exceeding {
            bandwidth-limit 500m;
            burst-size-limit 50m;
        }
        then discard;
    }
    policer xe-5percent {
        if-exceeding {
            bandwith-limit 500m;
            burst-size-limit 5m;
        }
        then discard;
    }
    policer xe-50percent {
        if-exceeding {
            bandwith-limit 5g;
            burst-size-limit 500m ;
        }
        then discard;
    }
    family inet {
        filter measurement-v4 {
            interface-specific;
            term tcp {
                from {
                    protocol tcp;
                }
                then {
                    count tcp;
                    next term;
                }
            }
            term tcp-syn {
                from {
                    protocol tcp;
                    tcp-flags syn;
                }
                then {
                    count tcp-syn;
                    next term;
                }
            }
            term udp {
                from {
                    protocol udp;
                }                                   
                then {                              
                    count udp;                      
                    next term;                      
                }                                   
            }                                       
            term icmp {                             
                from {                              
                    protocol icmp;                  
                }                                   
                then {                              
                    count icmp;                     
                    next term;                      
                }                                   
            }                                       
            term other-prototocols {                
                from {                              
                    protocol-except [ icmp tcp udp ];
                }                                   
                then {                              
                    count other-protocols;          
                    next term;                      
                }
            }
            term default {
                then {
                    count packets;
                    sample;
                    next term;
                }
            }
        }
        filter border-policy-v4 {
            interface-specific;
            term bogons {
                from {
                    source-prefix-list {
                        bogons-v4;
                    }
                }
                then {
                    count bogons;
                    discard;
                }
            }
            term depaul {
                from {
                    source-prefix-list {
                        depaul-v4;
                        bgp-neighbors-v4 except;
                    }
                }
                then {
                    count depaul;
                    discard;
                }
            }
            term misdirected {
                from {
                    destination-address {
                        0.0.0.0/0;
                        224.0.0.0/4 except;
                        255.255.255.255/32 except;
                    }
                    destination-prefix-list {
                        depaul-v4 except;
                        bgp-local-v4 except;
                    }
                then {
                    count misdirected;
                    discard;
                }
            }
            term icmp {
                from {
                    protocol icmp;
                    icmp-type [ info-reply info-request mask-reply mask-request redirect router-advertisement router-solicit source-quench timestamp timestamp-reply ];
                }
                then {
                    count icmp;
                    discard;
                }
            }
            term ip-protocols {
                from {
                    protocol [ igmp ospf pim ];
                }
                then {
                    count ip-protocols;
                    discard;
                }
            }
            term default {
                then next term;
            }
        }
        filter ratelimit-ge-v4 {
            interface-specific;
            term udp {
                from {
                    protocol udp;
                }
                then {
                    policer ge-50percent;
                    next term;
                }
            }
            term icmp {
                from {
                    protocol icmp;
                }
                then {
                    policier ge-5percent;
                    next term;
                }
            }
            term default {
                then next term;
            }
        }
        filter ratelimit-xe-v4 {
            interface-specific;
            term udp {
                from {
                    protocol udp;
                }
                then {
                    policer xe-50percent;
                    next term;
                }
            }
            term icmp {
                from {
                    protocol icmp;
                }
                then {
                    policier xe-5percent;
                    next term;
                }
            }
            term default {
                then next term;
            }
        }
        filter allow-any-v4 {
            term default {
                then accept;
            }
        }
        filter antispoof-v4 {
            interface-specific;
            term valid-sources {
                from {
                    source-prefix-list {
                        depaul-v4;
                        bgp-local-v4;
                    }
                }
                then {
                    count valid-sources;
                    accept;
                }
            }
            /* Packets to neighbor assigned local address may have come via another border */
            term asymmetric-routing {
                from {
                    destination-prefix-list {
                        bgp-neighbors-v4;
                    }
                }
                then {
                    count asymmetric-routing;
                    accept;
                }
            } 
            term default-deny {
                then {
                    count default-deny;
                    discard;
                }
            }
        }
        filter irl-policy-v4 {
            interface-specific;
            term icmp {
                from {
                    protocol icmp;
                    icmp-type [ info-reply info-request mask-reply mask-request redirect router-advertisement router-solicit source-quench timestamp timestamp-reply ];
                }
                then {
                    count icmp;
                    discard;
                }
            }
            term multicast {
                from {
                    destination-address {
                        224.0.0.0/4;
                    }
                    protocol-except [ udp ospf pim igmp ];
                }
                then {
                    count multicast;
                    discard;
                }
            }
            term default {
                then next term;
            }
        }
    }
    family inet6 {
        filter measurement-v6 {
            interface-specific;
            term tcp {
                from {
                    payload-protocol tcp;
                }
                then {
                    count tcp;
                    next term;
                }
            }
            term tcp-syn {
                from {
                    payload-protocol tcp;
                    tcp-flags syn;
                }
                then {
                    count tcp-syn;
                    next term;
                }
            }
            term udp {
                from {
                    payload-protocol udp;
                }
                then {
                    count udp;
                    next term;
                }
            }
            term icmp6 {
                from {
                    payload-protocol icmp6; 
                }
                then {
                    count icmp6;
                    next term;
                }
            }
            term other-protocols {
                from {
                    payload-protocol-except [ icmp6 tcp udp ];
                }
                then {
                    count other-protocols;
                    next term;
                }
            }
            term default {
                then {
                    count packets;
                    sample;
                    next term;
                }
            }
        }
        filter border-policy-v6 {
            interface-specific;
            term bogons {
                from {
                    source-prefix-list {
                        bogons-v6;
                    }
                }
                then {
                    count bogons;
                    discard;
                }
            }
            term depaul {
                from {
                    source-prefix-list {
                        depaul-v6;
                        bgp-neighbors-v6 except;
                    }
                }
                then {
                    count depaul;
                    discard;
                }
            }
            term misdirected {
                from {
                    destination-address {
                        ::/0;
                        fe80::/10 except;
                        ff00::/8 except;
                    }
                    destination-prefix-list {
                        depaul-v6 except;
                        bgp-local-v6 except;
                    }
                then {
                    count misdirected;
                    discard;
                }
            }
            term icmp6 {
                from {
                    payload-protocol icmp6;
                    icmp6-type [ inverse-neighbor-discovery-advertisement inverse-neighbor-discovery-solicitation node-information-reply node-information-request redirect ];
                }
                then {
                    count icmp6;
                    discard;
                }
            }
            term ip-protocols {
                from {
                    payload-protocol [ hop-by-hop ospf pim routing ];
                }
                then {
                    count ip-protocols;
                    discard;
                }
            }
            term default {
                then next term;
            }
        } 
        filter ratelimit-ge-v6 {
            interface-specific;
            term udp {
                from {
                    payload-protocol udp;
                }
                then {
                    policer ge-50percent;
                    next term;
                }
            }
            term icmp {
                from {
                    payload-protocol icmp;
                }
                then {
                    policier ge-5percent;
                    next term;
                }
            }
            term default {
                then next term;
            }
        }
        filter ratelimit-xe-v6 {
            interface-specific;
            term udp {
                from {
                    payload-protocol udp;
                }
                then {
                    policer xe-50percent;
                    next term;
                }
            }
            term icmp {
                from {
                    payload-protocol icmp;
                }
                then {
                    policier xe-5percent;
                    next term;
                }
            }
            term default {
                then next term;
            }
        }
        filter allow-any-v6 {
            term default {
                then accept;
            }
        }
        filter antispoof-v6 {
            interface-specific;
            term valid-sources {
                from {
                    source-address {
                        fe80::/10;
                    }
                    source-prefix-list {
                        depaul-v6;
                        bgp-local-v6;
                    }
                }
                then {
                    count valid-sources;
                    accept;
                }
            }
            /* Packets to neighbor assigned local address may have come via another border */
            term asymmetric-routing {
                from {
                    destination-prefix-list {
                        bgp-neighbors-v6;
                    }
                }
                then {
                    count asymmetric-routing;
                    accept;
                }
            } 
            term default-deny {
                then {
                    count default-deny;
                    discard;
                }
            }
        }
        filter irl-policy-v6 {
            interface-specific;
            term icmp6 {
                from {
                    payload-protocol icmp6;
                    icmp-type [ inverse-neighbor-discovery-advertisement inverse-neighbor-discovery-solicitation node-information-reply node-information-request redirect ]
;
                }
                then {
                    count icmp6;
                    discard;
                }
            }
            term multicast {
                from {
                    destination-address {
                        ff00::/8;
                    }
                    payload-protocol-except [ icmp6 ospf pim udp ];
                }
                then {
                    count multicast;
                    discard;
                }
            }
            term default {
                then next term;
            }
        }
    }
}