Filter Syntax

The routing filter rule implements script-like syntax. The example below is a quick demonstration of a routing filter that matches prefixes with a prefix length greater than 24 from subnet 192.168.1.0/24 and increments default distance by 1. If there is no match then subtract default distance by one.

/routing filter rule 
  add chain=myChain 
  rule="if (dst==192.168.1.0/24 && dst-len>24) {set distance +1; accept} else {set distance -1; accept}"

Filter rule may consist of multiple matchers and actions:

if ( [matchers] ) { [actions] } else { [actions] }

There are two types of properties:

• only readable - ones that value is only readable and cannot be rewritten, these properties can be used only by matchers
• readable/writable - ones that value is readable and writeable, used by filter actions and also can be used by matchers

Readable properties can be matched by other readable properties (for numeric properties only) or constant values using boolean operators. 

[matchers]:
[prop readable] [bool operator] [prop readable]

[actions]:
[action] [prop writeable] [value]

The boolean operator is not used if there is only one possible operation.

Example without boolean operator:

if ( protocol connected ) { accept }

Example with boolean operator:

if ( bgp-med < 30 ) { accept }

With readable flag properties, matcher is used without specified boolean operator and without value

if ( ospf-dn ) { reject }

Only Readable Properties

Writeable Properties

Commands

Operators

Matcher Operators

Num Prop Operators

Prefix Operators

BGP Community Operators

String Operators

AS-PATH Regexp Matching

AS Path is the sequence of autonomous system numbers (ASNs), for example AS Path 123 456 789 would indicate, that route originated from AS with number 789, and to reach the destination, the packet would need to travel through two autonomous systems: 456 and 789. To apply specific routing policies administrator might want to match specific AS numbers or set of numbers in the AS Path (for example, reject prefixes that travel through AS 456), which can be achieved using regular expression (regexp).

There are two common ways how to operate with AS Path data:

• convert whole AS path to string and let regexp operate on the string (ROS v6 or Cisco style)
• let regexp operate on each entry in the AS path as a number (ROS v7, Juniper style)

Basically first method is performing the match per character, the second method is performing match per whole AS number. As you would imagine the latter method is much faster and less resource-intensive than the string matching approach.

This change would require administrators to implement new Regex strategies. Old Regex patterns from RouterOS v6 cannot be directly copy/pasted as they will result either in syntax error or unexpected result.

Lets take a very basic AS Path filter rule.

/routing/filter/rule/add 
chain=myChain rule="if (bgp-as-path .1234.) {accept}"

In ROS v7 this Regex pattern will match ASN 1234 anywhere in the middle of the AS-path, the same pattern in ROS v6 would match any AS path than contains ASN consisting of at least 6 characters and contains string of "1234".  Obviously if we directly copy/paste Regex pattern from one implementation to another it will lead to unexpected/dangerous results. Equivalent pattern in ROS v6 would look something like this: "._1234_.".

Let's take another example from ROS v6, say we have a pattern "1234[5-9]" what it does is it matches 12345 to 12349 anywhere in the string, which means that valid matches are AS-path "12345 3434", "11 9123467 22" and so on. If you enter the same pattern in ROS v7 it will match AS path containing exact ASN 1234 followed by ASN in range from 5 to 9 (matching AS-paths would be "1234 7 111", "111 1234 5 222" etc., i twill not match "12345 3434").

Regex Testing Tool

RouterOS now has built in regex checking tool to simplify hard life of the administrators. This tool supports also num-sets so now exact regex can be tested against any as path before applying it to the routing filters.

/routing/filter/num-set add name=test range=100-1500
/routing/filter/test-as-path-regexp regexp="[[:test:]]5678\$" as-path="1234,5678"

Supported Operators

Property Reference

/routing/filter/chain

Dynamic list of filter rule chains that can be referenced in BGP/OSPF configuration.

Read-only properties:

/routing/filter/community-ext-set

Allows configuring sets of extended communities to be easily reused in multiple filter configurations. Community sets can be used for both matching and appending/setting.

/routing/filter/community-large-set

Allows to configure sets of large communities to be easily reused in multiple filter configurations. Community sets can be used for both matching and appending/setting.

/routing/filter/community-set

Allows to configure sets of communities to be easily reused in multiple filter configurations. Community sets can be used for both matching and appending/setting.

/routing/filter/num-set

Set of integer numbers that can be reused for number matching between multiple filter rules.

/routing/filter/rule

xx.

/routing/filter/select-chain

Dynamic list of filter select chains that can be referenced in BGP/OSPF configuration.

Read-only properties:

/routing/filter/select-rule

xx.