{"id":16,"date":"2025-11-04T02:14:18","date_gmt":"2025-11-04T02:14:18","guid":{"rendered":"https:\/\/vyos.web.id\/?p=16"},"modified":"2025-11-04T05:51:06","modified_gmt":"2025-11-04T05:51:06","slug":"bgp-routing-filter","status":"publish","type":"post","link":"https:\/\/vyos.web.id\/?p=16","title":{"rendered":"BGP Routing Filter on Vyos"},"content":{"rendered":"\n

I. Outbound Filter Based on BGP Prefix<\/strong><\/h3>\n\n\n\n

Before starting, make sure that the BGP session is already established<\/strong>.<\/p>\n\n\n\n

SUMMARY STEPS:<\/strong><\/p>\n\n\n\n

    \n
  1. configure<\/code><\/li>\n\n\n\n
  2. set policy prefix-list [prefix name] rule [rule number] action [permit\/deny]<\/code><\/li>\n\n\n\n
  3. set policy prefix-list [prefix name] rule [rule number] le (less than or equal)<\/code><\/li>\n\n\n\n
  4. set policy prefix-list [prefix name] rule [rule number] ge (greater than or equal)<\/code><\/li>\n\n\n\n
  5. set policy prefix-list [prefix name] rule [rule number] prefix [prefix match]<\/code><\/li>\n<\/ol>\n\n\n\n

    EXAMPLE:<\/strong><\/p>\n\n\n\n

    set policy prefix-list bogon-ip rule 10 action permit\nset policy prefix-list bogon-ip rule 10 le 32\nset policy prefix-list bogon-ip rule 10 prefix 172.16.0.0\/12\n<\/code><\/pre>\n\n\n\n
    Explanation of the rule above:<\/strong>
    A prefix-list rule named bogon-ip<\/strong> is created with rule number 10<\/strong> and action permit<\/strong> for prefix 172.16.0.0\/12<\/strong>, allowing prefixes up to length \/32<\/strong> or shorter.<\/p>\n\n\n\n
    \n\n\n\n
    Example of BGP Prefix-Based Outbound Route Filtering<\/strong><\/h3>\n\n\n\n
    Goal:<\/strong>
    We will block all bogon IPs<\/strong> and only advertise public IPs<\/strong> belonging to Skyline and STI<\/strong> from Router A<\/strong>, with a minimum prefix length of \/32.<\/p>\n\n\n\n
    \n\n\n\n
    Router A (SENDER):<\/strong><\/h4>\n\n\n\n
    # show protocols bgp [Your ASN] neighbor [IP Neighbour]\n address-family {\n     ipv4-unicast {\n         nexthop-self\n         prefix-list {\n             export deny.default.route\n         }\n         route-map {\n             export rule.out\n             import rule.in\n         }\n     }\n }\n description ROUTER A\n remote-as [ ASN ROUTER B ]\n<\/code><\/pre>\n\n\n\n
    \n\n\n\n
    # show policy route-map rule.out \n rule 10 {\n     action deny\n     match {\n         ip {\n             address {\n                 prefix-list bogon-ip\n             }\n         }\n     }\n }\n rule 11 {\n     action permit\n     match {\n         ip {\n             address {\n                 prefix-list own-pref.core\n             }\n         }\n     }\n }\n<\/code><\/pre>\n\n\n\n
    \n\n\n\n
    # show policy prefix-list bogon-ip \n rule 10 {\n     action permit\n     le 32\n     prefix 172.16.0.0\/12\n }\n rule 11 {\n     action permit\n     le 32\n     prefix 10.0.0.0\/8\n }\n rule 12 {\n     action permit\n     le 32\n     prefix 192.168.0.0\/16\n }\n rule 13 {\n     action permit\n     le 32\n     prefix 169.254.0.0\/16\n }\n<\/code><\/pre>\n\n\n\n
    \n\n\n\n
    # show policy prefix-list own-pref.core \n rule 10 {\n     action permit\n     le 32\n     prefix [your prefix\/]\n }\n \n rule 99 {\n     action deny\n     prefix 0.0.0.0\/0\n }\n<\/code><\/pre>\n\n\n\n
    \n\n\n\n
    II. BGP AS-PATH FILTERING<\/strong><\/h3>\n\n\n\n
    Before starting, make sure that the BGP session is already established<\/strong>.<\/p>\n\n\n\n
    SUMMARY STEPS:<\/strong><\/p>\n\n\n\n
      \n
    1. configure<\/code><\/li>\n\n\n\n
    2. set policy as-path-list [as-path name] rule [rule number] action [permit\/deny]<\/code><\/li>\n\n\n\n
    3. set policy as-path-list [as-path name] rule [rule number] regex (BGP regular expression)<\/code><\/li>\n<\/ol>\n\n\n\n
      \n\n\n\n
      Commonly Used Regex Patterns:<\/strong><\/h4>\n\n\n\n
      No<\/th>Regex<\/th>Meaning<\/th>Example<\/th><\/tr><\/thead>
      1<\/td>^<\/code><\/td>Starts with<\/td>^55653<\/code> \u2192 starts with AS 55653<\/td><\/tr>
      2<\/td>$<\/code><\/td>Ends with<\/td>^55653$<\/code> \u2192 starts and ends with AS 55653, no other ASN in between<\/td><\/tr>
      3<\/td>_<\/code><\/td>Any occurrence<\/td>_55653$<\/code> \u2192 ends with AS 55653, regardless of previous ASNs (originated ASN is 55653)<\/td><\/tr>
      4<\/td>( )<\/code><\/td>Grouping<\/td>`_(55653<\/td><\/tr>
      5<\/td>.+<\/code><\/td>Anything<\/td>Matches any AS path (usually used at the end to allow or deny everything)<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
      \n\n\n\n
      Operators:<\/strong><\/h4>\n\n\n\n
      Operator<\/th>Definition<\/th><\/tr><\/thead>
      {m,n}<\/code><\/td>At least m<\/em> and at most n<\/em> repetitions of the term<\/td><\/tr>
      {m}<\/code><\/td>Exactly m<\/em> repetitions<\/td><\/tr>
      {m,}<\/code><\/td>m<\/em> or more repetitions<\/td><\/tr>
      *<\/code><\/td>Zero or more repetitions (same as {0,}<\/code>)<\/td><\/tr>
      +<\/code><\/td>One or more repetitions (same as {1,}<\/code>)<\/td><\/tr>
      ?<\/code><\/td>Zero or one repetition (same as {0,1}<\/code>)<\/td><\/tr>
      `<\/td>`<\/td><\/tr>
      \u2013<\/code><\/td>Inclusive range between start and end<\/td><\/tr>
      ^<\/code><\/td>Character at the beginning (implicitly added)<\/td><\/tr>
      $<\/code><\/td>Character at the end (implicitly added)<\/td><\/tr>
      ( )<\/code><\/td>Group of terms, no space inside<\/td><\/tr>
      [ ]<\/code><\/td>Set or range of AS numbers; can use ^<\/code> inside to exclude a number<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
      \n\n\n\n
      EXAMPLE:<\/strong>
      We only want to allow ASN 133803<\/strong>.<\/p>\n\n\n\n
       rule 10 {\n     action permit\n     description BLABLABLA\n     regex ^133803$\n }\n rule 11 {\n     action deny\n     regex .+\n }\n<\/code><\/pre>\n\n\n\n
      \n\n\n\n
      III. ROUTE MAP<\/strong><\/h3>\n\n\n\n
      Before starting, make sure that BGP is already established<\/strong>.<\/p>\n\n\n\n
      SUMMARY STEPS:<\/strong><\/p>\n\n\n\n
        \n
      1. configure<\/code><\/li>\n\n\n\n
      2. set policy route-map [route-map name] rule [rule number] action [deny\/permit]<\/code><\/li>\n\n\n\n
      3. set policy route-map [route-map name] rule [rule number] match ip address [access-list\/prefix-list] [number or name]<\/code><\/li>\n\n\n\n
      4. set policy route-map [route-map name] rule [rule number] set [aggregator\/as-path-exclude\/as-path-prepend\/atomic-aggregate\/bgp-extcommunity-rt\/comm-list\/community\/ip-next-hop\/local-preference\/originator-id\/weight]<\/code><\/li>\n<\/ol>\n\n\n\n
        \n\n\n\n
        EXAMPLE:<\/strong><\/p>\n\n\n\n
        rule 10 {\n     action deny\n     match {\n         ip {\n             address {\n                 prefix-list bogon-ip\n             }\n         }\n     }\n }\n rule 11 {\n     action permit\n     match {\n         ip {\n             address {\n                 prefix-list own-pref.core\n             }\n         }\n     }\n }<\/code><\/pre>\n","protected":false},"excerpt":{"rendered":"
        I. Outbound Filter Based on BGP Prefix Before starting, make sure that the BGP session is already established. SUMMARY STEPS: EXAMPLE: Explanation of the rule above:A prefix-list rule named bogon-ip is created with rule number 10 and action permit for prefix 172.16.0.0\/12, allowing prefixes up to length \/32 or shorter. Example of BGP Prefix-Based Outbound […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5],"tags":[],"class_list":["post-16","post","type-post","status-publish","format-standard","hentry","category-vyos"],"_links":{"self":[{"href":"https:\/\/vyos.web.id\/index.php?rest_route=\/wp\/v2\/posts\/16","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/vyos.web.id\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/vyos.web.id\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/vyos.web.id\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/vyos.web.id\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=16"}],"version-history":[{"count":3,"href":"https:\/\/vyos.web.id\/index.php?rest_route=\/wp\/v2\/posts\/16\/revisions"}],"predecessor-version":[{"id":26,"href":"https:\/\/vyos.web.id\/index.php?rest_route=\/wp\/v2\/posts\/16\/revisions\/26"}],"wp:attachment":[{"href":"https:\/\/vyos.web.id\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=16"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/vyos.web.id\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=16"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/vyos.web.id\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=16"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}