public:tutoriais:juniper:carpet-bombing-filter [Bernardi Wiki]

Esta página é apenas de leitura. Pode ver a fonte, mas não alterá-la. Informe-se com o administrador deste Wiki se achar que isto não está correto.
==== Filtro DDoS para Provedores (testado Juniper MX204) ====

Este filtro foi criado para mitigar os principais vetores de amplificação e reflexão observados em redes de provedores brasileiros.

=== Perfil Conservador ===

O modelo abaixo foi desenvolvido para minimizar impactos em tráfego legítimo, mantendo proteção contra os ataques mais comuns.

<color #00a2e8>
**
Para um perfil mais agressivo:

  * Remova os termos '''12''' e '''13'''.
  * Altere o ''packet-length'' do termo '''11''' para ''600-2000''.

Essa alteração aumenta a eficiência contra ataques DNS Amplification, porém pode elevar o risco de falsos positivos em alguns cenários.
**</color>

=== Filtro de Proteção ===

=== Termo 1 - UDP Source Port 0 ===

Bloqueia ou limita tráfego UDP utilizando porta 0, normalmente associado a tráfego malformado ou malicioso.

<code>
set firewall family inet filter ddos-protection-brazil-isps interface-specific
set firewall family inet filter ddos-protection-brazil-isps term 1 from protocol udp
set firewall family inet filter ddos-protection-brazil-isps term 1 from destination-port 0
set firewall family inet filter ddos-protection-brazil-isps term 1 then policer term1-500m
set firewall family inet filter ddos-protection-brazil-isps term 1 then accept
</code>

=== Termo 2 - QOTD Amplification ===

Proteção contra ataques utilizando a porta UDP 17 (Quote of the Day).

<code>
set firewall family inet filter ddos-protection-brazil-isps term 2 from protocol udp
set firewall family inet filter ddos-protection-brazil-isps term 2 from source-port 17
set firewall family inet filter ddos-protection-brazil-isps term 2 then policer term2-100m
set firewall family inet filter ddos-protection-brazil-isps term 2 then accept
</code>

=== Termo 3 - Chargen Amplification ===

Proteção contra ataques utilizando a porta UDP 19 (Chargen).

<code>
set firewall family inet filter ddos-protection-brazil-isps term 3 from protocol udp
set firewall family inet filter ddos-protection-brazil-isps term 3 from source-port 19
set firewall family inet filter ddos-protection-brazil-isps term 3 then policer term3-100m
set firewall family inet filter ddos-protection-brazil-isps term 3 then accept
</code>

=== Termo 4 - LDAP Amplification ===

Limita ataques de reflexão LDAP pela porta UDP 389.

<code>
set firewall family inet filter ddos-protection-brazil-isps term 4 from protocol udp
set firewall family inet filter ddos-protection-brazil-isps term 4 from source-port 389
set firewall family inet filter ddos-protection-brazil-isps term 4 then policer term4-100m
set firewall family inet filter ddos-protection-brazil-isps term 4 then accept
</code>

=== Termo 5 - SSDP Amplification ===

Protege contra ataques SSDP originados na porta UDP 1900.

<code>
set firewall family inet filter ddos-protection-brazil-isps term 5 from protocol udp
set firewall family inet filter ddos-protection-brazil-isps term 5 from source-port 1900
set firewall family inet filter ddos-protection-brazil-isps term 5 then policer term5-100m
set firewall family inet filter ddos-protection-brazil-isps term 5 then accept
</code>

=== Termo 6 - Memcached Amplification ===

Proteção contra ataques utilizando servidores Memcached expostos.

<code>
set firewall family inet filter ddos-protection-brazil-isps term 6 from protocol udp
set firewall family inet filter ddos-protection-brazil-isps term 6 from source-port 11211
set firewall family inet filter ddos-protection-brazil-isps term 6 then policer term6-100m
set firewall family inet filter ddos-protection-brazil-isps term 6 then accept
</code>

=== Termo 7 - Porta UDP 37810 ===

Limitação para vetores de amplificação observados utilizando a porta UDP 37810.

<code>
set firewall family inet filter ddos-protection-brazil-isps term 7 from protocol udp
set firewall family inet filter ddos-protection-brazil-isps term 7 from source-port 37810
set firewall family inet filter ddos-protection-brazil-isps term 7 then policer term7-100m
set firewall family inet filter ddos-protection-brazil-isps term 7 then accept
</code>

=== Termo 8 - NTP Amplification ===

Protege contra ataques NTP Reflection.

O filtro permite apenas pacotes compatíveis com respostas legítimas de tamanho 76 bytes.

<code>
set firewall family inet filter ddos-protection-brazil-isps term 8 from packet-length-except 76
set firewall family inet filter ddos-protection-brazil-isps term 8 from protocol udp
set firewall family inet filter ddos-protection-brazil-isps term 8 from source-port 123
set firewall family inet filter ddos-protection-brazil-isps term 8 then policer term8-100m
set firewall family inet filter ddos-protection-brazil-isps term 8 then accept
</code>

=== Termo 9 - ICMP Port Unreachable ===

Controla excesso de respostas ICMP do tipo ''Port Unreachable''.

<code>
set firewall family inet filter ddos-protection-brazil-isps term 9 from protocol icmp
set firewall family inet filter ddos-protection-brazil-isps term 9 from icmp-type unreachable
set firewall family inet filter ddos-protection-brazil-isps term 9 from icmp-code port-unreachable
set firewall family inet filter ddos-protection-brazil-isps term 9 then policer term9-10m
set firewall family inet filter ddos-protection-brazil-isps term 9 then accept
</code>

=== Termo 10 - DNS Fragmentado ===

Limita respostas DNS fragmentadas, frequentemente utilizadas em ataques de amplificação.

<code>
set firewall family inet filter ddos-protection-brazil-isps term 10 from fragment-flags more-fragments
set firewall family inet filter ddos-protection-brazil-isps term 10 from protocol udp
set firewall family inet filter ddos-protection-brazil-isps term 10 from source-port 53
set firewall family inet filter ddos-protection-brazil-isps term 10 then policer term10-500m
set firewall family inet filter ddos-protection-brazil-isps term 10 then accept
</code>

=== Termo 11 - DNS de Grande Porte ===

Controla respostas DNS entre 901 e 1500 bytes.

<code>
set firewall family inet filter ddos-protection-brazil-isps term 11 from packet-length 901-1500
set firewall family inet filter ddos-protection-brazil-isps term 11 from protocol udp
set firewall family inet filter ddos-protection-brazil-isps term 11 from source-port 53
set firewall family inet filter ddos-protection-brazil-isps term 11 then policer term11-500m
set firewall family inet filter ddos-protection-brazil-isps term 11 then accept
</code>

=== Termo 12 - DNS Médio ===

Controla respostas DNS entre 600 e 900 bytes.

<code>
set firewall family inet filter ddos-protection-brazil-isps term 12 from packet-length 600-900
set firewall family inet filter ddos-protection-brazil-isps term 12 from protocol udp
set firewall family inet filter ddos-protection-brazil-isps term 12 from source-port 53
set firewall family inet filter ddos-protection-brazil-isps term 12 then policer term12-500m
set firewall family inet filter ddos-protection-brazil-isps term 12 then accept
</code>

=== Termo 13 - DNS Genérico ===

Captura demais respostas DNS UDP que não foram tratadas pelos filtros anteriores.

<code>
set firewall family inet filter ddos-protection-brazil-isps term 13 from protocol udp
set firewall family inet filter ddos-protection-brazil-isps term 13 from source-port 53
set firewall family inet filter ddos-protection-brazil-isps term 13 then policer term13-500m
set firewall family inet filter ddos-protection-brazil-isps term 13 then accept
</code>

=== Tráfego Restante ===

Todo o tráfego não enquadrado nos termos anteriores é liberado normalmente.

<code>
set firewall family inet filter ddos-protection-brazil-isps term accept then accept
</code>

==== Configuração dos Policers ====

Os policers limitam a taxa máxima permitida para cada categoria de tráfego. Quando o limite é ultrapassado, os pacotes excedentes são descartados.

=== Definição dos Policers ===

<code>
set firewall policer term1-500m if-exceeding bandwidth-limit 500m
set firewall policer term1-500m if-exceeding burst-size-limit 15m
set firewall policer term1-500m then discard
set firewall policer term2-100m if-exceeding bandwidth-limit 100m
set firewall policer term2-100m if-exceeding burst-size-limit 15m
set firewall policer term2-100m then discard
set firewall policer term3-100m if-exceeding bandwidth-limit 100m
set firewall policer term3-100m if-exceeding burst-size-limit 15m
set firewall policer term3-100m then discard
set firewall policer term4-100m if-exceeding bandwidth-limit 100m
set firewall policer term4-100m if-exceeding burst-size-limit 15m
set firewall policer term4-100m then discard
set firewall policer term5-100m if-exceeding bandwidth-limit 100m
set firewall policer term5-100m if-exceeding burst-size-limit 15m
set firewall policer term5-100m then discard
set firewall policer term6-100m if-exceeding bandwidth-limit 100m
set firewall policer term6-100m if-exceeding burst-size-limit 15m
set firewall policer term6-100m then discard
set firewall policer term7-100m if-exceeding bandwidth-limit 100m
set firewall policer term7-100m if-exceeding burst-size-limit 15m
set firewall policer term7-100m then discard
set firewall policer term8-100m if-exceeding bandwidth-limit 100m
set firewall policer term8-100m if-exceeding burst-size-limit 15m
set firewall policer term8-100m then discard
set firewall policer term9-10m if-exceeding bandwidth-limit 10m
set firewall policer term9-10m if-exceeding burst-size-limit 5m
set firewall policer term9-10m then discard
set firewall policer term10-500m if-exceeding bandwidth-limit 500m
set firewall policer term10-500m if-exceeding burst-size-limit 15m
set firewall policer term10-500m then discard
set firewall policer term11-500m if-exceeding bandwidth-limit 500m
set firewall policer term11-500m if-exceeding burst-size-limit 15m
set firewall policer term11-500m then discard
set firewall policer term12-500m if-exceeding bandwidth-limit 500m
set firewall policer term12-500m if-exceeding burst-size-limit 15m
set firewall policer term12-500m then discard
set firewall policer term13-500m if-exceeding bandwidth-limit 500m
set firewall policer term13-500m if-exceeding burst-size-limit 15m
set firewall policer term13-500m then discard
</code>

==== Aplicação do Filtro ====

Após criar o filtro e os policers, aplique-o na interface de borda desejada.

<code>
set interfaces aeX unit XXX family inet filter input ddos-protection-brazil-isps
</code>

=== Exemplo ===

Aplicando na interface ''ae0'' unidade ''0'':

<code>
set interfaces ae0 unit 0 family inet filter input ddos-protection-brazil-isps
</code>

<color #ff7f27>
**Recomenda-se aplicar inicialmente em um único link, monitorar o comportamento do tráfego e somente depois expandir a utilização para os demais enlaces do backbone.**</color>