Lock of Network Security: Juniper Firewall Filtering Guide (JunOS)

It doesn’t mean to manage traffic in corporate networks and data centers, just decide where to go, but also protect your network from DDoS attacks, unauthorized access and unnecessary traffic load.

When it comes to high performance and seamless network management, Juniper JunOS The operating system is one of the strongest weapons in the sector with its filtering mechanism.

So how does filter logic work on Juniper? How to write and apply a firewall filter (ACL)? Let’s look deeply on the topic with the simplest expression and practical examples.

1. Juniper Filtering Manik: "Therm" Structure

Juniper (JunOS) uses a different philosophy from other manufacturers (e.g. Cisco) while writing filter on devices. JunOS is used in creating filters Term (Terim) uses blocks called.

One filter, multiple term can occur from the block. Each term owns two basic structures:

1. from (Coach): Determines which traffic of the filter will be captured (Source IP, target IP, port, protocol etc.).

2. then (Aksiyon): Determines what to do the captured traffic (accept, discard, reject, count, log vb.).

⚠️ Multi Critical Rule: At the end of Juniper filters a secret reject (implicit discard) The rule has. So, there is no term all traffic that does not comply with the block automatically is blocked (dropped). So you must add a "any-any" rule that accepts everything that does not necessarily be allowed to the end of the filter (if your purpose does not block everything!).

Step 2: Juniper Filtering Samples

Let's look at the most popular 3 filtering scenarios you can use directly on JunOS terminal.

Script 1: Server Management Port (SSH) Just Open to Specific IPs

Your device’s management IP (e.g. Loopback or management interface) is only SSH from your office IPs (Port 22) You want to access and block the SSH requests from the other world.

Ofis IP'niz: 192.168.10.50/32

Your Router Management IP: 10.0.0.1/32

JunOS CLI Commands:

# 1. Filtreyi oluşturmaya başlayıp ilk term (izin) bloğunu yazalım
set firewall family inet filter YONETIM-FILTRESI term OFIS-ERISIM from source-address 192.168.10.50/32
set firewall family inet filter YONETIM-FILTRESI term OFIS-ERISIM from destination-port 22
set firewall family inet filter YONETIM-FILTRESI term OFIS-ERISIM from protocol tcp
set firewall family inet filter YONETIM-FILTRESI term OFIS-ERISIM then accept

# 2. Diğer tüm SSH isteklerini engelleyen ikinci term bloğunu yazalım
set firewall family inet filter YONETIM-FILTRESI term SSH-ENGELLE from destination-port 22
set firewall family inet filter YONETIM-FILTRESI term SSH-ENGELLE from protocol tcp
set firewall family inet filter YONETIM-FILTRESI term SSH-ENGELLE then discard

# 3. Geri kalan tüm normal internet trafiğinin (web, dns vb.) geçmesine izin verelim
set firewall family inet filter YONETIM-FILTRESI term GERI-KALAN-TRAFIK then accept

Script 2: Limit ICMP (Ping) Packs (Rate Limiting)

You can put the speed limit to ping traffic (policer) to prevent the intensive ping requests (ICMP) router from outside.

JunOS CLI Commands:

# 1. Sınır belirleyiciyi (Policer) tanımlayalım (Örn: Saniyede 1 Megabit ve 15k burst)
set firewall policer PING-SINIRLAYICI if-exceeding bandwidth-limit 1m
set firewall policer PING-SINIRLAYICI if-exceeding burst-size-limit 15k
set firewall policer PING-SINIRLAYICI then discard

# 2. Filtreyi oluşturup bu sınırlandırıcıyı ICMP trafiğine bağlayalım
set firewall family inet filter ICMP-KONTROL term ICMP-KISITLA from protocol icmp
set firewall family inet filter ICMP-KONTROL term ICMP-KISITLA then policer PING-SINIRLAYICI

# 3. Kalan trafiğin normal akışına izin verelim
set firewall family inet filter ICMP-KONTROL term DIGERLERI then accept

3. Apply Filter to Interface (Interface)

The filters you write do not work until you connect them to a physical or logical interface. There are two way options when applying the filter to the interface:

• input: Traffic inside interface girerken filter is applied (the most preferred and performance method).

• output: Out of traffic interface outbound filter is applied.

Summer YONETIM-FILTRESI'ni router's interface facing the outside world (ge-0/0/0.0) Apply:

set interfaces ge-0/0/0 unit 0 family inet filter input YONETIM-FILTRESI
commit

Always the latest to be active on JunOS commit Note that you need to give the command.

4. Monitoring and Troubleshoot Performance

JunOS offers us very practical monitoring tools to see how much package your filters are working and what rule gets:

1. See Filter Statistics

Home term blocks, if you added then count SAYICI-ADI at the end, you can use the following command to see in real time how many packets matched that rule:

show firewall filter YONETIM-FILTRESI

2. Reset Filter Meters

You can clean meters to make your tests from scratch:

clear firewall filter YONETIM-FILTRESI

Last Word: Hardware Security with Juniper

Firewall filters in Juniper hardware, not directly in software level ASIC (Application-Specific Integrated Circuit) Because it is processed in chips, it works with a lag at the level of microseconds. A properly designed Juniper filtration architecture protects your network as a castle against external threats and keeps your traffic fluff.

You can always get support from our professional network team to configure complex filtering (ACL), DDoS protection rules and secure BGP redirects in your Juniper infrastructure!