In this slide I present about the internet routing filter for ISP. And at the end I have demo on how to implement on MikroTik

1. Dubai, MUM Training-The-Trainer
Prepare By: Teav Sovandara
Date: October 18-20, 2016
Internet Route Filter
1

2. About Me
• My name is Teav Sovandara
• I’m a NOC Manager at MaxBIT ISP
• I started working on MikroTik since 2013
• I got MikroTik certification such as MTCNA, MTCRE, MTCTCE, MTCINE
• I’m also a MikroTik academy trainer and consultant at ITTC
2

3. Agenda
• Introduction to the Internet routing
• Getting start with Route filter
• Route filter implementation in BGP
• LAB
3

4. Introduction to the Internet routing
4

5. Introduction to the Internet routing
5
transit Provider
Here we are

6. Introduction to the Internet routing
• Internet consist of many computer network combine together.
• Each network identify by unique autonomous system number (ASN)
• ISP advertise their prefix to the global network through transit provider.
• ISP also need to receive prefix from their transit provider, or they use default
route.
• There is only one routing protocol called BGP (Border Gateway Protocol) can
handle the Internet route
• No one control the Internet, So Internet is an untruth network
• You can see your transit provider on the diagram here http://bgp.he.net/
6

7. Introduction to the Internet routing
How to secure your network?
7
There are many problem happen on global Internet routing such as, route
hijacking, route leaking and other mistake

8. Introduction to the Internet routing
How to provide a good Internet quality ?
8
Simply, you need to find the
shortest path to the
destination. But for some
reason shortest path is not
always the best one.
For recommendation,
Internet Provider should be
multi-home, so you can do
traffic engineering.

9. Getting start with route filter
• Route filter is in Routing > Filters
• We can use route filter on OSPF,
BGP, RIP …ect
• We can change the attribute to
the route via route filter. Ex: we
set local preference to BGP route.
• With route filter we can manage
which prefix, we accept which
prefix we don’t
• You can filtering route in two
ways, Incoming and outgoing
9

10. Getting start with route filter
• Route filter match from top to bottom follow the sequence number
• Route filter is if and then condition
If
Matcher
then
do action
• There are two filter techniques:
• Permit some deny all
• Deny some permit all
10

11. Getting start with route filter
• Route filter to filter unwanted route. So the prefix that we filtered will
not visible on routing table.
10.1.1.0/24
10.1.2.0/24
10.1.3.0/24
10.1.1.0/24
10.1.2.0/24
10.1.3.0/24
Accept
10.1.4.0/24
Deny
10.1.4.0/24
11

12. Getting start with route filter
• Changing attribute on incoming prefix
12

13. Route filter implementation in BGP
ØOut Policy
Upstream/
Transit
Upstream/
Transit
• Announce only own prefix and
customer prefix to upstream and
peering
ØIn Policy
• Accept default route only you need it
• Do not accept own prefix
• Don’t accept private (rfc1918) and certain special use prefix
• Don’t accept prefix longer then /24
AS132730
Customer
Internet
103.224.30.0/24
103.224.31.0/24
13

14. Route filter implementation in BGP
ØOut Policy
• add action=accept chain=EBGP-OUT prefix=103.224.30.0/24
• add action=accept chain=EBGP-OUT prefix=103.224.31.0/24
• add action=discard chain=EBGP-OUT
ØIn Policy
• add action=discard chain=EBGP-IN prefix=103.224.30.0/24
• add action=discard chain=EBGP-IN prefix=10.0.0.0/8 prefix-length=8-32
• add action=discard chain=EBGP-IN prefix=172.16.0.0/12 prefix-length=12-32
• add action=discard chain=EBGP-IN prefix=192.168.0.0/16 prefix-length=16-32
• add action=discard chain=EBGP-IN prefix=0.0.0.0/0 prefix-length=25-32
• add action=accept chain=EBGP-IN
14
EBGP filter on
transit link

15. Route filter implementation in BGP
ØOut Policy
• add action=discard chain=EBGP-CUS-OUT prefix=103.224.31.0/24
• add action=accept chain=EBGP-CUS-OUT
ØIn Policy
• add action=accept chain=EBGP-IN prefix=103.224.31.0/24
• add action=discard chain=EBGP-IN
15
EBGP filter on
customer link

16. LAB
AS 200
AS 100
1.1.0.0/30
.1 .2
• AS 200 own prefix
• 2.2.0.0/24 Infrastructure
• 2.2.1.0/24 Server Farm
• 2.2.2.0/24 Routed subnet for customer
• 2.2.3.0/24 Customer Point to Point
• AS 100 own prefix
• 1.1.0.0/24 Infrastructure
• 1.1.1.0/24 Server Farm
• 1.1.2.0/24 Routed subnet for customer
• 1.1.3.0/24 Customer Point to Point
BGP Peer
16
Eth1 Eth1

17. LAB
Requirement
1. Setup EBGP Peering between AS 100 and 200
2. Each ISP advertise only their own prefix
3. Do not accept own prefix from remote peering
4. Do not accept default route
5. Do not accept private IP (RFC1918)
6. Only your prefix able to advertise out from your network
17

18. LAB
AS 100
/ip address add address=1.1.0.1/30
interface=ether1 network=1.1.0.0
/routing bgp instance add as=100 client-to-client-
reflection=no name=AS100 router-id=1.1.0.1
/routing bgp peer
add in-filter=EBGP-IN out-filter=EBGP-OUT
instance=AS100 name=EBGP-PEER remote-
address=1.1.0.2 remote-as=200 ttl=default
/routing bgp network
add network=1.1.0.0/22 synchronize=no
add network=1.1.0.0/24 synchronize=no
add network=1.1.1.0/24 synchronize=no
add network=1.1.2.0/24 synchronize=no
add network=1.1.3.0/24 synchronize=no 18
/routing filter
add action=discard chain=EBGP-IN prefix=1.1.0.0/22 prefix-
length=22-24
add action=discard chain=EBGP-IN prefix=0.0.0.0/0
add action=discard chain=EBGP-IN prefix=10.0.0.0/8 prefix-
length=8-32
add action=discard chain=EBGP-IN prefix=172.16.0.0/12
prefix-length=12-32
add action=discard chain=EBGP-IN prefix=192.168.0.0/16
prefix-length=16-32
add action=accept chain=EBGP-IN
add action=accept chain=EBGP-OUT prefix=1.1.0.0/22
prefix-length=22-24
add action=discard chain=EBGP-OUT
Step 3
Step 4
Step 5
Step 1
Step 2
Step 6

19. LAB
AS 200
/ip address add address=1.1.0.2/30
interface=ether1 network=1.1.0.0
/routing bgp instance add as=200 client-to-client-
reflection=no name=AS200 router-id=1.1.0.2
/routing bgp peer
add in-filter=EBGP-IN instance=AS200 name=EBGP-
PEER remote-address=1.1.0.1 remote-as=100
ttl=default
/routing bgp network
add network=2.2.0.0/22 synchronize=no
add network=2.2.0.0/24 synchronize=no
add network=2.2.1.0/24 synchronize=no
add network=2.2.2.0/24 synchronize=no
add network=2.2.3.0/24 synchronize=no
19
/routing filter
add action=discard chain=EBGP-IN prefix=2.2.0.0/22 prefix-
length=22-24
add action=discard chain=EBGP-IN prefix=0.0.0.0/0
add action=discard chain=EBGP-IN prefix=10.0.0.0/8 prefix-
length=8-32
add action=discard chain=EBGP-IN prefix=172.16.0.0/12
prefix-length=12-32
add action=discard chain=EBGP-IN prefix=192.168.0.0/16
prefix-length=16-32
add action=accept chain=EBGP-IN
add action=accept chain=EBGP-OUT prefix=2.2.0.0/22
prefix-length=22-24
add action=discard chain=EBGP-OUT
Step 3
Step 4
Step 5
Step 1
Step 2 Step 6

20. LAB Verification
20
AS 200
AS 100 .1 .2
This is my new prefix
1.1.1.0/24
No no , I don’t
accept it
Try to advertise prefix of AS 100 from AS 200 and check
whether AS 100 receive their own prefix or not

21. Summary
21
• Route filter is the only place you can do Internet routing policy
• Route filter rule read from top to bottom follow the sequence
number
• When you do filter on incoming route, it will affect upload traffic
• When you do filter on outgoing route, it will affect download traffic

22. Thanks you !
22