sample_juniper_loopback.pol

header {
  comment:: "Sample Juniper lookback filter"
  target:: juniper LOOPBACK
}

term accept-icmp {
  protocol:: icmp
  counter:: icmp-loopback
  policer:: rate-limit-icmp
  action:: accept
}

term accept-traceroute {
  comment:: "Allow inbound traceroute from any source."
  destination-port:: TRACEROUTE
  protocol:: udp
  counter:: inbound-traceroute
  policer:: rate-limit-to-router
  action:: accept
  expiration:: 2001-12-31
  owner:: jeff
}

term accept-bgp-requests {
  comment:: "Allow BGP requests from peers."
  source-prefix:: configured-neighbors-only
  destination-port:: BGP
  protocol:: tcp
  counter:: bgp-requests
  action:: accept
}

term accept-bgp-replies {
  comment:: "Allow inbound replies to BGP requests."
  source-prefix:: configured-neighbors-only
  source-port:: BGP
  protocol:: tcp
  option:: tcp-established
  counter:: bgp-replies
  action:: accept
}

term accept-ospf {
  comment:: "Allow outbound OSPF traffic from other RFC1918 routers."
  source-address:: INTERNAL
  protocol:: ospf
  counter:: ospf
  action:: accept
}

term allow-vrrp {
  protocol:: vrrp
  counter:: vrrp
  action:: accept
}

term accept-ike {
  source-port:: IKE
  destination-port:: IKE
  protocol:: udp
  counter:: ipsec-ike
  action:: accept
}

term accept-ipsec {
  protocol:: esp
  counter:: ipsec-esp
  action:: accept
}
term accept-pim {
  source-address:: INTERNAL
  protocol:: pim
  action:: accept
}

term accept-igmp {
  source-address:: INTERNAL
  protocol:: igmp
  action:: accept
}

term accept-ssh-requests {
  source-address:: INTERNAL
  destination-port:: SSH
  protocol:: tcp
  counter:: ssh
  action:: accept
}

term accept-ssh-replies {
  source-port:: SSH
  protocol:: tcp
  option:: tcp-established
  counter:: ssh-replies
  action:: accept
}

term accept-snmp-requests {
  source-address:: INTERNAL
  destination-address:: INTERNAL
  destination-port:: SNMP
  protocol:: udp
  action:: accept
}

term accept-dns-replies {
  source-address:: INTERNAL
  destination-address:: INTERNAL
  source-port:: DNS
  protocol:: udp
  option:: established
  counter:: dns-replies
  action:: accept
}

term allow-ntp-request {
  source-address:: NTP_SERVERS
  destination-address:: INTERNAL
  destination-port:: NTP
  protocol:: udp
  counter:: ntp-request
  action:: accept
}

term allow-ntp-replies {
  source-address:: INTERNAL
  destination-address:: NTP_SERVERS
  source-port:: NTP
  protocol:: udp
  option:: established
  counter:: ntp-replies
  action:: accept
}

term allow-radius-replies {
  source-address:: INTERNAL
  destination-address:: INTERNAL
  source-port:: RADIUS
  protocol:: udp
  counter:: radius-replies
  action:: accept
}

term allow-tacacs-requests {
  source-address:: INTERNAL
  destination-address:: TACACS_SERVERS
  destination-port:: TACACS
  protocol:: tcp
  counter:: tacacs-requests
  action:: accept
}

term allow-tacacs-replies {
  source-address:: TACACS_SERVERS
  destination-address:: INTERNAL
  source-port:: TACACS
  protocol:: tcp
  option:: tcp-established
  counter:: tacacs-replies
  action:: accept
}

term allow-dns-fragments {
  source-address:: ANY
  source-exclude:: PUBLIC_NAT
  destination-address:: GOOGLE_DNS
  destination-port:: DNS
  protocol:: tcp udp
  option:: is-fragment
  action:: accept
}

term ratelimit-large-dns {
  destination-address:: GOOGLE_DNS
  destination-port:: DNS
  protocol:: udp
  packet-length:: 500-5000
  counter:: large-dns-counter
  policer:: large-dns-policer
  option:: sample
  action:: next
}

term reject-large-dns {
  destination-address:: GOOGLE_DNS
  destination-port:: DNS
  protocol:: udp
  packet-length:: 500-5000
  action:: reject
}

term reject-imap-requests {
  destination-address:: MAIL_SERVERS
  destination-port:: IMAP
  protocol:: tcp
  action:: reject-with-tcp-rst
}

term next-filter {
  filter-term:: my-next-filter
}

term af-mismatch {
  comment:: "Will not be generated as target is inet"
  comment:: "but address_family is inet6"
  destination-address:: INTERNAL
  restrict-address-family:: inet6
  action:: reject
}

term discard-default {
  counter:: discard-default
  action:: deny
}