The routing filter rule implements script-like syntax. The example below is a quick demonstration of a routing filter that matches prefixes with a prefix length greater than 24 from subnet 192.168.1.0/24 and increments default distance by 1. If there is no match then subtract default distance by one.
/routing filter rule add chain=myChain rule="if (dst==192.168.1.0/24 && dst-len>24) {set distance +1; accept} else {set distance -1; accept}" |
Filter rule may consist of multiple matchers and actions:
if ( [matchers] ) { [actions] } else { [actions] } |
There are two types of properties:
Readable properties can be matched by other readable properties (for numeric properties only) or constant values using boolean operators.
[matchers]: [prop readable] [bool operator] [prop readable] [actions]: [action] [prop writeable] [value] |
The boolean operator is not used if there is only one possible operation.
Example without boolean operator:
if ( protocol connected ) { accept } |
Example with boolean operator:
if ( bgp-med < 30 ) { accept } |
With readable flag properties, matcher is used without specified boolean operator and without value
if ( ospf-dn ) { reject } |
Property | Type | Description |
---|---|---|
Numeric properties | ||
dst-len | Destination prefix length | |
bgp-path-len | The current length of the BGP AS-PATH | |
bgp-input-local-as | AS number of the local peer to which the prefix was sent | |
bgp-input-remote-as | AS number of the remote peer from which the prefix was received | |
bgp-output-local-as | AS number of the peer that will advertise the prefix | |
bgp-output-remote-as | AS number of the peer to which the prefix will be advertised | |
ospf-metric | Current OSPF metric | |
ospf-tag | Current OSPF tag | |
rip-metric | Current RIP metric | |
rip-tag | Current RIP tag | |
Flag properties | ||
active | indicates whether the route is active | |
bgp-atomic-aggregate | ||
bgp-communities-empty | indicates if the BGP Communities attribute is empty | |
bgp-ext-communities-empty | indicates if the BGP Extended Communities attribute is empty | |
bgp-large-communities-empty | indicates if the BGP Large Communities attribute is empty | |
bgp-network | Indicates if the prefix is originated from BGP networks | |
ospf-dn | Indicates if the OSPF route has DN bit set. | |
Prefix properties | ||
dst | Destination | |
ospf-fwd | Current OSPF forwarding address | |
bgp-input-local-addr | The IP address of the local peer to which the prefix was sent | |
bgp-input-remote-addr | The IP address of the remote peer from which the prefix was received | |
bgp-output-local-addr | The IP address of the peer that will advertise the prefix | |
bgp-output-remote-addr | The IP address of the peer to which the prefix will be advertised | |
Other Properties | ||
afi | ipv4 | ipv6 | l2vpn | l2vpn-cisco | vpnv4 | vpnv6 | The address family of the route. |
bgp-as-path | numeric_regexp | AS path matcher, read more>> |
chain | chain_name | |
ospf-type | ext1 | ext2 | inter | intra | nssa1 | nssa2 | Type of the OSPF route:
|
protocol | bgp | connected | dhcp | fantasy | modem | ospf | rip | static | vpn | Protocol type from which the route was imported. |
rpki | invalid | unknown | valid | RPKI validation status of the prefix |
rtab | routing_table_name | Name of the routing table the route was imported from |
vrf | vrf_name | Name of the VRF the route was imported from |
Property | Type | Description |
---|---|---|
Numeric properties | ||
distance | route distance | |
scope | ||
scope-target | target scope | |
bgp-weight | BGP WEIGHT attribute | |
bgp-med | BGP MED attribute local to the router. | |
bgp-out-med | BGP MED attribute to be sent to a remote peer. Should be used in the output chain | |
bgp-local-pref | BGP LOCALPREF attribute | |
bgp-igp-metric | BGP IGP METRIC | |
bgp-path-peer-prepend | Prepend last received remote peers ASN. If the prefix is originated from the router, then this parameter will not do anything on the router's output, because ASN does not exist yet. If used as a matcher in BGP input, it is possible to filter prefixes exceeding a certain number of prepends. For example, if remote peer prepends its ASN 5 times, but we want to allow max 4 times prepended ASN, then we can use: " This parameter also overrides any prepends received from the remote peer, for example, if the remote peer prepended its AS 3 times, we can remove this prepend by setting " | |
bgp-path-prepend | Prepend routers ASN, should be used in BGP output. | |
ospf-ext-metric | OSPF External route metric | |
ospf-ext-tag | OSPF external route tag | |
rip-ext-metric | RIP External route metric | |
rip-ext-tag | RIP External route tag | |
Flag properties | ||
ospf-ext-dn | DN bit for external OSPF routes | |
blackhole | ||
use-te-nexthop | ||
Other properties | ||
gw | ipv4/6 address | |
gw-interface | interface_name | |
gw-check | none|arp|icmp|bfd|bfd-mh | |
pref-src | ipv4/6 address | |
bgp-origin | igp|egp|incomplete | |
ospf-ext-fwd | ipv4/6 address | |
ospf-ext-type | type1|type2 | |
comment | string | |
bgp-communites | inline_community_set | set_name | |
bgp-ext-communities | ||
bgp-large-communities |
Command | Params | Description |
---|---|---|
accept | accept matched prefix | |
reject | reject matched prefix, the prefix will be stored in the memory as "filtered" and will not be the candidate to be selected as the best path. | |
return | return to the parent chain | |
jump | jump chain_name | jump to a specified chain |
unset | unset prop_name | used to unset the value of the following properties:pref-src|bgp-med|bgp-out-med|bgp-local-pref |
append | append at the end of the list or string. Following property values can be appended: bgp-communities, bgp-ext-communities, bgp-large-communities, comment | |
filter | Values of the following properties can be filtered: bgp-communities, bgp-ext-communities, bgp-large-communities | |
delete | Delete the value of the specified property. Values of the following properties can be deleted: bgp-communities, bgp-ext-communities, bgp-large-communities | |
set | set prop_writeable value | The command is used to set a new value to writeable properties. Value can be set from other readable properties of matching types. For numeric properties, it is possible to prefix the value with +/- which will increment or decrement the current property value by a given amount. For example, "set pref-src +1 " will increment current pref-src by one, or extract value from other readable num property, "set distance +ospf-ext-metric " |
rpki-verify | rpki-verify rpki_group_name | Enable RPKI verification in the current chain from the specified RPKI group. |
Operator | Description | Example |
---|---|---|
&& | Logical AND operator | if (dst == 192.168.0.0/16 && dst-len in 16-32) {reject;} |
|| | Logical OR operator | |
not | Logical NOT operator | if ( not bgp-network) {reject; } |
Operator | Description |
---|---|
in | return true if the value is in provided numeric range. Numeric range can be written in following formats: {int..int}, {int-int} |
== | return true if numeric values are equal |
!= | return true if numeric values are not equal |
> | return true if the left numeric value is greater than the right numeric value |
< | return true if the left numeric value is less than the right numeric value |
>= | return true if the left numeric value is greater than or equal to the right numeric value |
<= | return true if the left numeric value is less than or equal to the right numeric value |
Operator | Description |
---|---|
in | Return true if the prefix is the subnet of the provided network |
!= | Return true if the prefix is not equal to the provided value |
== | Return true if the prefix is equal to the provided value |
Operator | Description | Example |
---|---|---|
equal | return true if provided communities is equal to the property value | |
equal-set | ||
any | ||
any-set | ||
includes | ||
includes-set | ||
subset | ||
subset-set | ||
any-regexp | ||
subset-regexp |
Operator | Description |
---|---|
find | Check if provided substring is the part of the property value |
regexp | Match string regexp of the property value |
[matcher] (all can be prefixed with 'not' to negate bgp-communities|bgp-communities-ext|bgp-communities-large equal|any|includes|subset {inline set} equal-set|any-set|includes-set|subset-set {set name} any-regexp|subset-regexp {regexp} comment text|find|regexp {string} chain {chain name} vrf {vrf} rtab {rtab} gw-interface {interface} gw-check none|arp|icmp|bfd|bfd-mh afi ipv4|ipv6|l2vpn|l2vpn-cisco|vpnv4|vpnv6 ,... protocol connected|static|bgp|ospf|rip|dhcp|fantasy|modem|vpn ,... bpg-origin igp|egp|incomplete ,... bgp-as-path {regexp} rpki valid|invalid|unknown ospf-type intra|inter|ext1|ext2|nssa1|nssa2 ospf-ext-type type1|type2 [num prop readable] in {int..int}|{int-int} ==|!=|<=|>=|<|> {int} [num prop readable] [prfx prop readable] !=|==|in {address 46/} [flag prop readable] [block] if ([matcher] &&/|| ...) { [block] } [ else {[block]} ] accept|reject|return jump {chain name} unset pref-src|bgp-med|bgp-out-med|bgp-local-pref append comment {string} bgp-communities|bgp-communities-ext|bgp-communities-large {inline community set}|{set name} filter bgp-communities|bgp-communities-ext|bgp-communities-large regexp {regexp} {inline community set}|{set name} delete bgp-communities regexp {regexp} {inline community set}|{set name} wk|other ,... bgp-communities-ext regexp {regexp} {inline community set}|{set name} rt|soo|other ,... bgp-communities-large regexp {regexp} {inline community set}|{set name} all set [num prop writable] [+|-][num prop readable]|[num prop writable] gw {address 46i} gw-interface {interface} gw-check none|arp|icmp|bfd|bfd-mh pref-src {address 46} bgp-origin igp|egp|incomplete ospf-ext-fwd {address 46} ospf-ext-type type1|type2 comment {string} bgp-communities {inline community set}|{set name} bgp-communities-ext {inline community set}|{set name} bgp-communities-large {inline community set}|{set name} rpki-verify {rpki group name} |
/routing/filter/chain
Dynamic list of filter rule chains that can be referenced in BGP/OSPF configuration.
Read-only properties:
Property | Description | |
---|---|---|
dynamic (yes | no) | ||
inactive (yes | no) | ||
name (string) |
/routing/filter/community-ext-set
Allows configuring sets of extended communities to be easily reused in multiple filter configurations. Community sets can be used for both matching and appending/setting.
Property | Description | |
---|---|---|
comment (string; Default: ) | ||
communities (list of ext communities; Default: ) | List of extended communities expressed as raw integer value or in the typed format: "type:value", where type can be:
Value depends on the type, for more info on RT and SoO values ask google. | |
disabled (yes | no) | ||
name (integer [string; Default: ) | Reference name. | |
regexp (string) | Regexp matcher to match communities. The community set with only the regexp parameter cannot be used to append communities. |
/routing/filter/community-large-set
Allows to configure sets of large communities to be easily reused in multiple filter configurations. Community sets can be used for both matching and appending/setting.
Property | Description | |
---|---|---|
comment (string; Default: ) | ||
communities (list of large communities; Default: ) | List of large communities expressed in following format: "admin:value1:value2", where each section can be integer [0..4294967295]. | |
disabled (yes | no) | ||
name (integer [string; Default: ) | Reference name. | |
regexp (string) | Regexp matcher to match communities. The community set with only the regexp parameter cannot be used to append communities. |
/routing/filter/community-set
Allows to configure sets of communities to be easily reused in multiple filter configurations. Community sets can be used for both matching and appending/setting.
Property | Description | |
---|---|---|
comment (string; Default: ) | ||
communities (list of communities; Default: ) | List of communities expressed either as well known name or in the following format: "as:number", where each section can be integer [0..65535]. Accepted well known names: accept-own graceful-shutdown no-advertise no-llgr route-filter-6 | |
disabled (yes | no) | ||
name (integer [string; Default: ) | Reference name. | |
regexp (string) | Regexp matcher to match communities. The community set with only the regexp parameter cannot be used to append communities. |
/routing/filter/num-set
Set of integer numbers that can be reused for number matching between multiple filter rules.
Property | Description | |
---|---|---|
comment (string; Default: ) | ||
disabled (yes | no) | ||
name (integer [string; Default: ) | Reference name. | |
range (start-[end]:: integer[0..4294967295]) | Range of numbers in numset |
/routing/filter/rule
xx.
Property | Description | |
---|---|---|
chain (string; Default: ) | Reference name of the chain | |
comment (string; Default: ) | ||
disabled (yes | no) | ||
rule (string) | Accepts script-like syntax to match and set route attribute and reject or accept prefixes. |
/routing/filter/select-chain
Dynamic list of filter select chains that can be referenced in BGP/OSPF configuration.
Read-only properties:
Property | Description | |
---|---|---|
dynamic (yes | no) | ||
inactive (yes | no) | ||
name (string) |
/routing/filter/select-rule
xx.