BGP Filter

• Everyone is free to filter on his AS as he wishes, however it is recommended to deny the default route¹⁾, inbound and outbound.
• It is also recommended that you don't advertise IPv4 prefixes longer than 28 bits and IPv6 prefixes longer than 60 bits. Of course there are exceptions:
  • Non-RFC1918 addresses reachable via GLaNET.
  • GLaNET services addresses (/32s from 192.168.248.0/22 and /128s from fd00:6b64:f3b0::/48).

ip prefix-list glanet-in description BGP IPv4 import filter
! Deny default route and too large prefixes
ip prefix-list glanet-in seq 10 deny 0.0.0.0/0 le 7
! Deny prefixes with high risk of collision within GLaNET range
ip prefix-list glanet-in seq 20 deny 192.168.0.0/22 le 32
ip prefix-list glanet-in seq 21 deny 192.168.8.0/22 le 32
ip prefix-list glanet-in seq 22 deny 192.168.100.0/22 le 32
ip prefix-list glanet-in seq 23 deny 192.168.200.0/22 le 32
ip prefix-list glanet-in seq 24 deny 192.168.252.0/22 le 32
! Deny other RFC1918 prefixes
ip prefix-list glanet-in seq 30 deny 10.0.0.0/8 le 32
ip prefix-list glanet-in seq 31 deny 172.16.0.0/12 le 32
! Deny shared address space
ip prefix-list glanet-in seq 40 deny 100.64.0.0/10 le 32
! Deny link-local
ip prefix-list glanet-in seq 50 deny 169.254.0.0/16 le 32
! Deny multicast
ip prefix-list glanet-in seq 60 deny 224.0.0.0/4 le 32
! Deny former class E
ip prefix-list glanet-in seq 70 deny 240.0.0.0/4 le 32
! Allow everything
ip prefix-list glanet-in seq 1000 permit 0.0.0.0/0 le 32

function net_martian()
{       
  return net ~ [ 169.254.0.0/16+, 172.16.0.0/12+, 192.168.0.0/22+,
                 192.168.8.0/22+, 192.168.100.0/22+, 192.168.200.0/22+,
                 192.168.252.0/22+, 10.0.0.0/8+, 100.64.0.0/10+,
                 172.16.0.0/12+, 224.0.0.0/4+, 240.0.0.0/4+, 0.0.0.0/32-,
                 0.0.0.0/0{0,7} ];
}

filter martians {
  if net_martian() then
    reject;
  else
    accept;
}

policy-options {
    prefix-list bogons {
        /* Non-GLaNET RFC1918 prefix */
        10.0.0.0/8;
        /* Shared address space */
        100.64.0.0/10;
        /* Link local */
        169.254.0.0/16;
        /* Non-GLaNET RFC1918 prefix */
        172.16.0.0/12;
        /* High risk of collision within GLaNET */
        192.168.0.0/22;
        /* High risk of collision within GLaNET */
        192.168.8.0/22;
        /* High risk of collision within GLaNET */
        192.168.100.0/22;
        /* High risk of collision within GLaNET */
        192.168.200.0/22;
        /* High risk of collision within GLaNET */
        192.168.252.0/22;
        /* Multicast */
        224.0.0.0/4;
        /* Former class E */
        240.0.0.0/4;
    }
    policy-statement bgp-import-generic {
        term set-default {
            then default-action accept;
        }
        term default-route {
            from {
                route-filter 0.0.0.0/0 upto /7 reject;
            }
        }
        term bogons {
            from {
                prefix-list-filter bogons orlonger;
            }
            then reject;
        }
    }
}

! Deny default route and too large prefixes
ipv6 prefix-list glanet6-in deny 0::/0 le 15
! Deny 6bone prefix (not used anymore)
ipv6 prefix-list glanet6-in deny 3ffe::/16 le 128
! Deny documentation prefix
ipv6 prefix-list glanet6-in deny 2001:db8::/32 le 128
! Teredo prefix must be exactly 32-bit long
ipv6 prefix-list glanet6-in permit 2001::/32
ipv6 prefix-list glanet6-in deny 2001::/32 le 128
! 6to4 prefix must be exactly 16-bit long
ipv6 prefix-list glanet6-in permit 2002::/16
ipv6 prefix-list glanet6-in deny 2002::/16 le 128
! Deny loopback/unspecified/v4-mapped prefix
ipv6 prefix-list glanet6-in deny 0000::/8 le 128
! Deny multicast prefixes
ipv6 prefix-list glanet6-in deny ff00::/8 le 128
! Permit everything else but small prefixes
ipv6 prefix-list glanet6-in permit 0::/0 le 64

function net_martian()
{
  return net ~ [ 3ffe::/16+, 2001:db8::/32+, 2001::/33+, 2002::/17+, 0000::/8+,
                 fe00::/8+,  ::/128-, ::/0{0,15}, ::/0{65,128} ];
}

filter martians {
  if net_martian() then
    reject;
  else
    accept;
}