graffen/ix-bird-config
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity

Organising filters a bit

Browse source
This commit is contained in:
Jesper Hess 2018-10-13 20:28:29 +02:00
parent 564c32b2b6
commit ca50385f87
Signed by: graffen
GPG key ID: 351A89E40D763F0F
2 changed files with 33 additions and 26 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

36
bgp4.conf
View file

@ -5,8 +5,14 @@ template bgp dnpeers {
# metric is the number of hops between us and the peer
path metric 1;
import all;
export all;
import where dnpeers_import_policy();
export filter {
# here we export the whole net
if is_valid_network() then {
accept;
}
reject;
};
};
template bgp iBGP_Peer {
@ -30,32 +36,10 @@ template pipe iBGP_Pipe {
export all;
}
roa table dn42_roa {
include "/var/lib/bird/bird_roa_dn42.conf";
};
protocol pipe {
table master;
peer table T_BGP;
import filter {
if (roa_check(dn42_roa, net, bgp_path.last) = ROA_INVALID) then {
print "[dn42] ROA check failed for ", net, " ASN ", bgp_path.last;
reject;
}
# accept every subnet, except our own advertised subnet
# filtering is important, because some guys try to advertise routes like 0.0.0$
if is_valid_network() && !is_self_net() then {
accept;
}
reject;
};
export filter {
# here we export the whole net
if is_valid_network() then {
accept;
}
reject;
import all;
export all;
};
};

23
filter4.conf
View file

@ -15,3 +15,26 @@ function is_valid_network() {
];
}
roa table dn42_roa {
include "/var/lib/bird/bird_roa_dn42.conf";
};
function check_roa() {
if (roa_check(dn42_roa, net, bgp_path.last) = ROA_INVALID) then {
print "[dn42] ROA check failed for ", net, " ASN ", bgp_path.last;
return false;
}
return true:
}
function import_filter_networks() {
if is_valid_network() && !is_self_net() then {
return true;
}
return false;
}
function dnpeers_import_policy() {
if(!check_roa()) return false;
if(!import_filter_networks()) return false:
}