==== Filtro DDoS para Provedores (testado Juniper MX204) ==== Este filtro foi criado para mitigar os principais vetores de amplificação e reflexão observados em redes de provedores brasileiros. === Perfil Conservador === O modelo abaixo foi desenvolvido para minimizar impactos em tráfego legítimo, mantendo proteção contra os ataques mais comuns. ** Para um perfil mais agressivo: * Remova os termos '''12''' e '''13'''. * Altere o ''packet-length'' do termo '''11''' para ''600-2000''. Essa alteração aumenta a eficiência contra ataques DNS Amplification, porém pode elevar o risco de falsos positivos em alguns cenários. ** === Filtro de Proteção === === Termo 1 - UDP Source Port 0 === Bloqueia ou limita tráfego UDP utilizando porta 0, normalmente associado a tráfego malformado ou malicioso. set firewall family inet filter ddos-protection-brazil-isps interface-specific set firewall family inet filter ddos-protection-brazil-isps term 1 from protocol udp set firewall family inet filter ddos-protection-brazil-isps term 1 from destination-port 0 set firewall family inet filter ddos-protection-brazil-isps term 1 then policer term1-500m set firewall family inet filter ddos-protection-brazil-isps term 1 then accept === Termo 2 - QOTD Amplification === Proteção contra ataques utilizando a porta UDP 17 (Quote of the Day). set firewall family inet filter ddos-protection-brazil-isps term 2 from protocol udp set firewall family inet filter ddos-protection-brazil-isps term 2 from source-port 17 set firewall family inet filter ddos-protection-brazil-isps term 2 then policer term2-100m set firewall family inet filter ddos-protection-brazil-isps term 2 then accept === Termo 3 - Chargen Amplification === Proteção contra ataques utilizando a porta UDP 19 (Chargen). set firewall family inet filter ddos-protection-brazil-isps term 3 from protocol udp set firewall family inet filter ddos-protection-brazil-isps term 3 from source-port 19 set firewall family inet filter ddos-protection-brazil-isps term 3 then policer term3-100m set firewall family inet filter ddos-protection-brazil-isps term 3 then accept === Termo 4 - LDAP Amplification === Limita ataques de reflexão LDAP pela porta UDP 389. set firewall family inet filter ddos-protection-brazil-isps term 4 from protocol udp set firewall family inet filter ddos-protection-brazil-isps term 4 from source-port 389 set firewall family inet filter ddos-protection-brazil-isps term 4 then policer term4-100m set firewall family inet filter ddos-protection-brazil-isps term 4 then accept === Termo 5 - SSDP Amplification === Protege contra ataques SSDP originados na porta UDP 1900. set firewall family inet filter ddos-protection-brazil-isps term 5 from protocol udp set firewall family inet filter ddos-protection-brazil-isps term 5 from source-port 1900 set firewall family inet filter ddos-protection-brazil-isps term 5 then policer term5-100m set firewall family inet filter ddos-protection-brazil-isps term 5 then accept === Termo 6 - Memcached Amplification === Proteção contra ataques utilizando servidores Memcached expostos. set firewall family inet filter ddos-protection-brazil-isps term 6 from protocol udp set firewall family inet filter ddos-protection-brazil-isps term 6 from source-port 11211 set firewall family inet filter ddos-protection-brazil-isps term 6 then policer term6-100m set firewall family inet filter ddos-protection-brazil-isps term 6 then accept === Termo 7 - Porta UDP 37810 === Limitação para vetores de amplificação observados utilizando a porta UDP 37810. set firewall family inet filter ddos-protection-brazil-isps term 7 from protocol udp set firewall family inet filter ddos-protection-brazil-isps term 7 from source-port 37810 set firewall family inet filter ddos-protection-brazil-isps term 7 then policer term7-100m set firewall family inet filter ddos-protection-brazil-isps term 7 then accept === Termo 8 - NTP Amplification === Protege contra ataques NTP Reflection. O filtro permite apenas pacotes compatíveis com respostas legítimas de tamanho 76 bytes. set firewall family inet filter ddos-protection-brazil-isps term 8 from packet-length-except 76 set firewall family inet filter ddos-protection-brazil-isps term 8 from protocol udp set firewall family inet filter ddos-protection-brazil-isps term 8 from source-port 123 set firewall family inet filter ddos-protection-brazil-isps term 8 then policer term8-100m set firewall family inet filter ddos-protection-brazil-isps term 8 then accept === Termo 9 - ICMP Port Unreachable === Controla excesso de respostas ICMP do tipo ''Port Unreachable''. set firewall family inet filter ddos-protection-brazil-isps term 9 from protocol icmp set firewall family inet filter ddos-protection-brazil-isps term 9 from icmp-type unreachable set firewall family inet filter ddos-protection-brazil-isps term 9 from icmp-code port-unreachable set firewall family inet filter ddos-protection-brazil-isps term 9 then policer term9-10m set firewall family inet filter ddos-protection-brazil-isps term 9 then accept === Termo 10 - DNS Fragmentado === Limita respostas DNS fragmentadas, frequentemente utilizadas em ataques de amplificação. set firewall family inet filter ddos-protection-brazil-isps term 10 from fragment-flags more-fragments set firewall family inet filter ddos-protection-brazil-isps term 10 from protocol udp set firewall family inet filter ddos-protection-brazil-isps term 10 from source-port 53 set firewall family inet filter ddos-protection-brazil-isps term 10 then policer term10-500m set firewall family inet filter ddos-protection-brazil-isps term 10 then accept === Termo 11 - DNS de Grande Porte === Controla respostas DNS entre 901 e 1500 bytes. set firewall family inet filter ddos-protection-brazil-isps term 11 from packet-length 901-1500 set firewall family inet filter ddos-protection-brazil-isps term 11 from protocol udp set firewall family inet filter ddos-protection-brazil-isps term 11 from source-port 53 set firewall family inet filter ddos-protection-brazil-isps term 11 then policer term11-500m set firewall family inet filter ddos-protection-brazil-isps term 11 then accept === Termo 12 - DNS Médio === Controla respostas DNS entre 600 e 900 bytes. set firewall family inet filter ddos-protection-brazil-isps term 12 from packet-length 600-900 set firewall family inet filter ddos-protection-brazil-isps term 12 from protocol udp set firewall family inet filter ddos-protection-brazil-isps term 12 from source-port 53 set firewall family inet filter ddos-protection-brazil-isps term 12 then policer term12-500m set firewall family inet filter ddos-protection-brazil-isps term 12 then accept === Termo 13 - DNS Genérico === Captura demais respostas DNS UDP que não foram tratadas pelos filtros anteriores. set firewall family inet filter ddos-protection-brazil-isps term 13 from protocol udp set firewall family inet filter ddos-protection-brazil-isps term 13 from source-port 53 set firewall family inet filter ddos-protection-brazil-isps term 13 then policer term13-500m set firewall family inet filter ddos-protection-brazil-isps term 13 then accept === Tráfego Restante === Todo o tráfego não enquadrado nos termos anteriores é liberado normalmente. set firewall family inet filter ddos-protection-brazil-isps term accept then accept ==== Configuração dos Policers ==== Os policers limitam a taxa máxima permitida para cada categoria de tráfego. Quando o limite é ultrapassado, os pacotes excedentes são descartados. === Definição dos Policers === set firewall policer term1-500m if-exceeding bandwidth-limit 500m set firewall policer term1-500m if-exceeding burst-size-limit 15m set firewall policer term1-500m then discard set firewall policer term2-100m if-exceeding bandwidth-limit 100m set firewall policer term2-100m if-exceeding burst-size-limit 15m set firewall policer term2-100m then discard set firewall policer term3-100m if-exceeding bandwidth-limit 100m set firewall policer term3-100m if-exceeding burst-size-limit 15m set firewall policer term3-100m then discard set firewall policer term4-100m if-exceeding bandwidth-limit 100m set firewall policer term4-100m if-exceeding burst-size-limit 15m set firewall policer term4-100m then discard set firewall policer term5-100m if-exceeding bandwidth-limit 100m set firewall policer term5-100m if-exceeding burst-size-limit 15m set firewall policer term5-100m then discard set firewall policer term6-100m if-exceeding bandwidth-limit 100m set firewall policer term6-100m if-exceeding burst-size-limit 15m set firewall policer term6-100m then discard set firewall policer term7-100m if-exceeding bandwidth-limit 100m set firewall policer term7-100m if-exceeding burst-size-limit 15m set firewall policer term7-100m then discard set firewall policer term8-100m if-exceeding bandwidth-limit 100m set firewall policer term8-100m if-exceeding burst-size-limit 15m set firewall policer term8-100m then discard set firewall policer term9-10m if-exceeding bandwidth-limit 10m set firewall policer term9-10m if-exceeding burst-size-limit 5m set firewall policer term9-10m then discard set firewall policer term10-500m if-exceeding bandwidth-limit 500m set firewall policer term10-500m if-exceeding burst-size-limit 15m set firewall policer term10-500m then discard set firewall policer term11-500m if-exceeding bandwidth-limit 500m set firewall policer term11-500m if-exceeding burst-size-limit 15m set firewall policer term11-500m then discard set firewall policer term12-500m if-exceeding bandwidth-limit 500m set firewall policer term12-500m if-exceeding burst-size-limit 15m set firewall policer term12-500m then discard set firewall policer term13-500m if-exceeding bandwidth-limit 500m set firewall policer term13-500m if-exceeding burst-size-limit 15m set firewall policer term13-500m then discard ==== Aplicação do Filtro ==== Após criar o filtro e os policers, aplique-o na interface de borda desejada. set interfaces aeX unit XXX family inet filter input ddos-protection-brazil-isps === Exemplo === Aplicando na interface ''ae0'' unidade ''0'': set interfaces ae0 unit 0 family inet filter input ddos-protection-brazil-isps **Recomenda-se aplicar inicialmente em um único link, monitorar o comportamento do tráfego e somente depois expandir a utilização para os demais enlaces do backbone.**