From http://bgpfilterguide.nlnog.net/
TLDR:
- Reject any v4 prefix larger than /24 (/26 currently)
- Extend the list of Bogon ASN
- Reject everything with 100 similar AS paths
1/ The only advertisement matching the 100 ASN, is:
208.45.214.0/24 *[BGP/170] 00:01:52, MED 0, localpref 250, from 208.80.154.196
AS path: 6939 12083 3450 3450 3450 3450 3450 3450 3450 3450 3450 3450 3450 3450 3450 3450 3450 3450 3450 3450 3450 3450 3450 3450 3450 3450 3450 3450 3450 3450 3450 3450 3450 3450 3450 3450 3450 3450 3450 3450 3450 3450 3450 3450 3450 3450 3450 3450 3450 3450 3450 3450 3450 3450 3450 3450 3450 3450 3450 3450 3450 3450 3450 3450 3450 3450 3450 3450 3450 3450 3450 3450 3450 3450 3450 3450 3450 3450 3450 3450 3450 3450 3450 3450 3450 3450 3450 3450 3450 3450 3450 3450 3450 3450 3450 3450 3450 3450 3450 3450 3450 3450 3450 3450 3450 3450 3450 3450 3450 3450 3450 3450 3450 3450 3450 3450 ?
Ping/mtr shows a routing loop on their network, so I assume it's safe/sane to filter it out.
ping 208.45.214.1
From 160.36.2.98 icmp_seq=1 Time to live exceeded
2/ I didn't apply /* RFC 4893 AS_TRANS */ as-path as_trans ".* 23456 .*"; to the bogon-asns list, as we currently receive one prefix matching this regex (here seen from eqiad):
103.81.245.0/24 *[BGP/170] 11:33:00, MED 100, localpref 250
AS path: 4637 9583 23456 ?
And it's reachable from other networks (current coffee-shop):
$ ping 103.81.245.1
PING 103.81.245.1 (103.81.245.1) 56(84) bytes of data.
64 bytes from 103.81.245.1: icmp_seq=1 ttl=241 time=278 ms
Full diff:
[edit policy-options policy-statement BGP_sanitize_in] - /* reject advertisements that contain private AS numbers. */ - term private-ASN { - from as-path private; - then reject; - } [edit policy-options policy-statement BGP_sanitize_in term prefix-length4 from] route-filter 0.0.0.0/0 exact { ... } + route-filter 0.0.0.0/0 prefix-length-range /25-/32; - route-filter 0.0.0.0/0 prefix-length-range /27-/32; [edit policy-options policy-statement BGP_sanitize_in] term prefix-length6 { ... } + term bogon-asns { + from as-path-group bogon-asns; + then reject; + } + term too-long-aspath { + from as-path too-many-hops; + then reject; + } [edit policy-options] as-path private { ... } + as-path too-many-hops ".{100,}"; [edit policy-options] as-path-group SELECTED-PATHS { ... } + as-path-group bogon-asns { + /* RFC7607 */ + as-path zero ".* 0 .*"; + /* RFC 5398 and documentation/example ASNs */ + as-path examples1 ".* [64496-64511] .*"; + as-path examples2 ".* [65536-65551] .*"; + /* RFC 6996 Private ASNs */ + as-path reserved1 ".* [64512-65534] .*"; + as-path reserved2 ".* [4200000000-4294967294] .*"; + /* RFC 6996 Last 16 and 32 bit ASNs */ + as-path last16 ".* 65535 .*"; + as-path last32 ".* 4294967295 .*"; + /* RFC IANA reserved ASNs*/ + as-path iana-reserved ".* [65552-131071] .*"; + } [edit policy-options] - as-path private 64512-65535;