Block/Discard Traffic IP Addresses on Juniper in JunOS Firewall Using Prefixes Filters and SpamHaus

In dealing with a lot of nefarious traffic on the internet lately, I needed a quick and easy solution for dropping this traffic at my edge. Most of the documentation out there is horribly dry with few examples.

The following example worked great in our MX240's and older M7i's. This will also work in SRX's but I have no way to affirm this.

1) Create the Prefix-Lists inside 'policy-options'

edit policy-options prefix-list block-Manual
set a.b.c.d/CIDR
up
annotate prefix-list block-Manual "Manual Block List"

edit policy-options prefix-list block-spamhaus-edrop
set a.b.c.d/CIDR
[...]
set w.x.y.z/CIDR
up
annotate prefix-list block-spamhaus-edrop "http://www.spamhaus.org/drop/edrop.txt"

You'll need to add the nets you want to block to each prefix list (I've created separate lists on purpose) but this should roughly give you:

[edit policy-options]
/* Manual Block List */
prefix-list block-Manual {
    set a.b.c.d/CIDR;
}
/* http://www.spamhaus.org/drop/edrop.txt */
prefix-list block-spamhaus-edrop {
    a.b.c.d/CIDR;
    w.x.y.z/CIDR;
}

I'm also using the drop list from SpamHaus but at 500+ lines felt it was of no use in this article, however simply create another prefix list, annotate it according and fill it with the contents of http://www.spamhaus.org/drop/drop.txt

2) Create a filter in the firewall

set firewall family inet filter blocked-IP term 1 from prefix-list block-Manual
set firewall family inet filter blocked-IP term 1 then discard
set firewall family inet filter blocked-IP term 2 from prefix-list block-spamhaus-edrop
set firewall family inet filter blocked-IP term 2 then discard
set firewall family inet filter blocked-IP term 99 then accept

...and this gives you:

filter blocked-IP {
    term 1 {
        from {
            prefix-list {
                block-Manual;
            }
        }
        then {
            discard;
        }
    }
    term 2 {
        from {
            prefix-list {
                block-spamhaus-edrop;
            }
        }
        then {
            discard;
        }
    }
    term 99 {
        then accept;
    }
}

3) Apply to an interface

       family inet {
            filter {
                input blocked-IP;
                output blocked-IP;
            }
       }

...and thats all there is to it. Just keep adding new prefix lists (if you want to keep them logically separate) and then add them as terms to the filter ensuring term 99 (accepting traffic) is always last.

Create Setup BGP Blackhole Community In Juniper Junos

Before you start, you'll want to have spoken with your upstreams and ensured you are enrolled in their BGP Blackhole program and that your BGP session(s) are currently given access to the communities.

The first thing you'll need to do is log into your Juniper and hop into edit mode.

Next, you need to create a new policy-statement inside your policy options:

edit policy-options
set policy-statement provider_blackhole 
edit policy-statement provider_blackhole 
set term match_666 from protocol static
set term match_666 from tag 666
set term match_666 then origin igp
set term match_666 then community set provider_blackhole
set term match_666 then accept

To check your work, type show and you should see:

policy-statement provider_blackhole {
    term match_666 {
        from {
            protocol static;
            tag 666;
        }
        then {
            origin igp;
            community set provider_blackhole;
            accept;
        }
    }
}

Now we have to create that actual community:

edit policy-options
set community provider_blackhole members AS###:COM###;

...replace AS### with the providers ASN number, and replace COM### with the community tag your provider gave you for the BGP blackhole.

Next we have to update the BGP group for this provider so we are announcing the community:

edit protocols bgp group provider
set export provider_blackhole

...one VERY important thing to note is that export ordering MATTERS. The most specific routes are announced left to right, so always ensure your blackhole export is listed first.

The very last thing to do is actually route IP's to this blackhole:

edit routing-options static
set route a.b.c.d/cidr discard
set route a.b.c.d/cidr tag 666

...that's it.

So what we've done here is:
1) Added a static route that is discarded and tagged "666"
2) Our policy-statement then grabs all static routes with a tag of "666" and then assigns them to the BGP blackhole community.
3) Our BGP group announces that community within the BGP session to the provder
4) The provider then drops all traffic to the IP's announced in that community.

You can use whatever "tag" number you want so long as it's being used consistently.

You can also have multiple policy-statements for multiple providers matching the tag and pushing to multiple communities (you may even want to condense them down into one policy-statement by setting multiple communities)