Este filtro foi criado para mitigar os principais vetores de amplificação e reflexão observados em redes de provedores brasileiros.

O modelo abaixo foi desenvolvido para minimizar impactos em tráfego legítimo, mantendo proteção contra os ataques mais comuns.

** Para um perfil mais agressivo: * Remova os termos '12' e '13'. * Altere o packet-length do termo '11' para 600-2000. Essa alteração aumenta a eficiência contra ataques DNS Amplification, porém pode elevar o risco de falsos positivos em alguns cenários. **

Bloqueia ou limita tráfego UDP utilizando porta 0, normalmente associado a tráfego malformado ou malicioso.

set firewall family inet filter ddos-protection-brazil-isps interface-specific
set firewall family inet filter ddos-protection-brazil-isps term 1 from protocol udp
set firewall family inet filter ddos-protection-brazil-isps term 1 from destination-port 0
set firewall family inet filter ddos-protection-brazil-isps term 1 then policer term1-500m
set firewall family inet filter ddos-protection-brazil-isps term 1 then accept

Proteção contra ataques utilizando a porta UDP 17 (Quote of the Day).

set firewall family inet filter ddos-protection-brazil-isps term 2 from protocol udp
set firewall family inet filter ddos-protection-brazil-isps term 2 from source-port 17
set firewall family inet filter ddos-protection-brazil-isps term 2 then policer term2-100m
set firewall family inet filter ddos-protection-brazil-isps term 2 then accept

Proteção contra ataques utilizando a porta UDP 19 (Chargen).

set firewall family inet filter ddos-protection-brazil-isps term 3 from protocol udp
set firewall family inet filter ddos-protection-brazil-isps term 3 from source-port 19
set firewall family inet filter ddos-protection-brazil-isps term 3 then policer term3-100m
set firewall family inet filter ddos-protection-brazil-isps term 3 then accept

Limita ataques de reflexão LDAP pela porta UDP 389.

set firewall family inet filter ddos-protection-brazil-isps term 4 from protocol udp
set firewall family inet filter ddos-protection-brazil-isps term 4 from source-port 389
set firewall family inet filter ddos-protection-brazil-isps term 4 then policer term4-100m
set firewall family inet filter ddos-protection-brazil-isps term 4 then accept

Protege contra ataques SSDP originados na porta UDP 1900.

set firewall family inet filter ddos-protection-brazil-isps term 5 from protocol udp
set firewall family inet filter ddos-protection-brazil-isps term 5 from source-port 1900
set firewall family inet filter ddos-protection-brazil-isps term 5 then policer term5-100m
set firewall family inet filter ddos-protection-brazil-isps term 5 then accept

Proteção contra ataques utilizando servidores Memcached expostos.

set firewall family inet filter ddos-protection-brazil-isps term 6 from protocol udp
set firewall family inet filter ddos-protection-brazil-isps term 6 from source-port 11211
set firewall family inet filter ddos-protection-brazil-isps term 6 then policer term6-100m
set firewall family inet filter ddos-protection-brazil-isps term 6 then accept

Limitação para vetores de amplificação observados utilizando a porta UDP 37810.

set firewall family inet filter ddos-protection-brazil-isps term 7 from protocol udp
set firewall family inet filter ddos-protection-brazil-isps term 7 from source-port 37810
set firewall family inet filter ddos-protection-brazil-isps term 7 then policer term7-100m
set firewall family inet filter ddos-protection-brazil-isps term 7 then accept

Protege contra ataques NTP Reflection.

O filtro permite apenas pacotes compatíveis com respostas legítimas de tamanho 76 bytes.

set firewall family inet filter ddos-protection-brazil-isps term 8 from packet-length-except 76
set firewall family inet filter ddos-protection-brazil-isps term 8 from protocol udp
set firewall family inet filter ddos-protection-brazil-isps term 8 from source-port 123
set firewall family inet filter ddos-protection-brazil-isps term 8 then policer term8-100m
set firewall family inet filter ddos-protection-brazil-isps term 8 then accept

Controla excesso de respostas ICMP do tipo Port Unreachable.

set firewall family inet filter ddos-protection-brazil-isps term 9 from protocol icmp
set firewall family inet filter ddos-protection-brazil-isps term 9 from icmp-type unreachable
set firewall family inet filter ddos-protection-brazil-isps term 9 from icmp-code port-unreachable
set firewall family inet filter ddos-protection-brazil-isps term 9 then policer term9-10m
set firewall family inet filter ddos-protection-brazil-isps term 9 then accept

Limita respostas DNS fragmentadas, frequentemente utilizadas em ataques de amplificação.

set firewall family inet filter ddos-protection-brazil-isps term 10 from fragment-flags more-fragments
set firewall family inet filter ddos-protection-brazil-isps term 10 from protocol udp
set firewall family inet filter ddos-protection-brazil-isps term 10 from source-port 53
set firewall family inet filter ddos-protection-brazil-isps term 10 then policer term10-500m
set firewall family inet filter ddos-protection-brazil-isps term 10 then accept

Controla respostas DNS entre 901 e 1500 bytes.

set firewall family inet filter ddos-protection-brazil-isps term 11 from packet-length 901-1500
set firewall family inet filter ddos-protection-brazil-isps term 11 from protocol udp
set firewall family inet filter ddos-protection-brazil-isps term 11 from source-port 53
set firewall family inet filter ddos-protection-brazil-isps term 11 then policer term11-500m
set firewall family inet filter ddos-protection-brazil-isps term 11 then accept

Controla respostas DNS entre 600 e 900 bytes.

set firewall family inet filter ddos-protection-brazil-isps term 12 from packet-length 600-900
set firewall family inet filter ddos-protection-brazil-isps term 12 from protocol udp
set firewall family inet filter ddos-protection-brazil-isps term 12 from source-port 53
set firewall family inet filter ddos-protection-brazil-isps term 12 then policer term12-500m
set firewall family inet filter ddos-protection-brazil-isps term 12 then accept

Captura demais respostas DNS UDP que não foram tratadas pelos filtros anteriores.

set firewall family inet filter ddos-protection-brazil-isps term 13 from protocol udp
set firewall family inet filter ddos-protection-brazil-isps term 13 from source-port 53
set firewall family inet filter ddos-protection-brazil-isps term 13 then policer term13-500m
set firewall family inet filter ddos-protection-brazil-isps term 13 then accept

Todo o tráfego não enquadrado nos termos anteriores é liberado normalmente.

set firewall family inet filter ddos-protection-brazil-isps term accept then accept

Os policers limitam a taxa máxima permitida para cada categoria de tráfego. Quando o limite é ultrapassado, os pacotes excedentes são descartados.

set firewall policer term1-500m if-exceeding bandwidth-limit 500m
set firewall policer term1-500m if-exceeding burst-size-limit 15m
set firewall policer term1-500m then discard
set firewall policer term2-100m if-exceeding bandwidth-limit 100m
set firewall policer term2-100m if-exceeding burst-size-limit 15m
set firewall policer term2-100m then discard
set firewall policer term3-100m if-exceeding bandwidth-limit 100m
set firewall policer term3-100m if-exceeding burst-size-limit 15m
set firewall policer term3-100m then discard
set firewall policer term4-100m if-exceeding bandwidth-limit 100m
set firewall policer term4-100m if-exceeding burst-size-limit 15m
set firewall policer term4-100m then discard
set firewall policer term5-100m if-exceeding bandwidth-limit 100m
set firewall policer term5-100m if-exceeding burst-size-limit 15m
set firewall policer term5-100m then discard
set firewall policer term6-100m if-exceeding bandwidth-limit 100m
set firewall policer term6-100m if-exceeding burst-size-limit 15m
set firewall policer term6-100m then discard
set firewall policer term7-100m if-exceeding bandwidth-limit 100m
set firewall policer term7-100m if-exceeding burst-size-limit 15m
set firewall policer term7-100m then discard
set firewall policer term8-100m if-exceeding bandwidth-limit 100m
set firewall policer term8-100m if-exceeding burst-size-limit 15m
set firewall policer term8-100m then discard
set firewall policer term9-10m if-exceeding bandwidth-limit 10m
set firewall policer term9-10m if-exceeding burst-size-limit 5m
set firewall policer term9-10m then discard
set firewall policer term10-500m if-exceeding bandwidth-limit 500m
set firewall policer term10-500m if-exceeding burst-size-limit 15m
set firewall policer term10-500m then discard
set firewall policer term11-500m if-exceeding bandwidth-limit 500m
set firewall policer term11-500m if-exceeding burst-size-limit 15m
set firewall policer term11-500m then discard
set firewall policer term12-500m if-exceeding bandwidth-limit 500m
set firewall policer term12-500m if-exceeding burst-size-limit 15m
set firewall policer term12-500m then discard
set firewall policer term13-500m if-exceeding bandwidth-limit 500m
set firewall policer term13-500m if-exceeding burst-size-limit 15m
set firewall policer term13-500m then discard

Após criar o filtro e os policers, aplique-o na interface de borda desejada.

set interfaces aeX unit XXX family inet filter input ddos-protection-brazil-isps

Aplicando na interface ae0 unidade 0:

set interfaces ae0 unit 0 family inet filter input ddos-protection-brazil-isps

Recomenda-se aplicar inicialmente em um único link, monitorar o comportamento do tráfego e somente depois expandir a utilização para os demais enlaces do backbone.