Difference between revisions of "Manual:Routing/Routing filters"

From MikroTik Wiki
Jump to: navigation, search
m (clarify prefix filter docs)
Line 77: Line 77:
 
     <td><var><b>chain</b></var> (<em>string</em>;)</td>
 
     <td><var><b>chain</b></var> (<em>string</em>;)</td>
 
     <td> chain name to place this rule in. If a chain with the specified name does not exist it will be automatically created
 
     <td> chain name to place this rule in. If a chain with the specified name does not exist it will be automatically created
chain name to place this rule in. If a chain with the specified name does not exist it will be automatically created
 
 
<ul  class="bullets">
 
<ul  class="bullets">
 
<li> <var>ospf-in</var> - predefined filter chain for routes received via [[OSPF]];
 
<li> <var>ospf-in</var> - predefined filter chain for routes received via [[OSPF]];
Line 121: Line 120:
 
<tr>
 
<tr>
 
     <td><var><b>prefix</b></var> (<em>IP prefix</em>; Default: <b>0.0.0.0/0</b>)</td>
 
     <td><var><b>prefix</b></var> (<em>IP prefix</em>; Default: <b>0.0.0.0/0</b>)</td>
     <td> network prefix to match. If prefix-length is not set, only exact match is done. For example, 0.0.0.0/0 then matches only the default route and nothing else</td>
+
     <td> network prefix to match. If prefix-length is not set, only exact match is done. For example, 0.0.0.0/0 then matches only the default route and nothing else. If network mask is not set, /32 is assumed</td>
 
</tr>
 
</tr>
 
<tr>
 
<tr>
Line 128: Line 127:
 
<ul class="bullets">
 
<ul class="bullets">
 
<li> the network prefix of the route falls within the range of the prefix of the rule, (i.e.
 
<li> the network prefix of the route falls within the range of the prefix of the rule, (i.e.
<li><li> the network mask of the route is greater of equal than the network mask of the prefix;
+
:<li> the network mask of the route is greater than or equal to the network mask of the prefix;
<li><li> the network address of the route masked out by the network mask of the prefix is equal to the network address of the prefix;)
+
:<li> the network address of the route masked out by the network mask of the prefix is equal to the network address of the prefix;)
 
<li> the length of the network mask of the route falls within the range of the prefix-length
 
<li> the length of the network mask of the route falls within the range of the prefix-length
 
</ul>
 
</ul>
Line 222: Line 221:
 
<tr>
 
<tr>
 
     <td><var><b>set-out-nexthop-linklocal</b></var> (<em>IPv6 link-local address</em>;)</td>
 
     <td><var><b>set-out-nexthop-linklocal</b></var> (<em>IPv6 link-local address</em>;)</td>
     <td> set gateway value to be announced using BGP link-local nexthop feature. Valid only in outgoing filters and BGP routes</td>
+
     <td> set gateway value to be announced using BGP link-local nexthop feature. Valid only in outgoing filters and for BGP routes</td>
 
</tr>
 
</tr>
 
<tr>
 
<tr>

Revision as of 19:30, 30 October 2009

Version.png

Applies to RouterOS: 3, v4

Sub-menu: /routing filter



<tr> <td>address-family (ip|ipv6|l2vpn|l2vpn-cisco|vpnv4;)</td> <td> match by BGP address family</td> </tr> <tr> <td>append-bgp-communities (integer:integer | internet | local-as | no-advertise | no-export;)</td> <td> similar to 'set-bgp-communities', but does not delete any existing information about communities</td> </tr> <tr> <td>append-route-targets (AsIP|AsNum;)</td> <td></td> </tr> <tr> <td>bgp-as-path (string;)</td> <td> unanchored pattern to be searched inside AS_PATH attribute of the route. POSIX regular expressions are supported.</td> </tr> <tr> <td>bgp-as-path-length (integer-integer;)</td> <td> match length of AS_PATH BGP attribute, representing the number of ASes that have been traversed. Read how the AS_PATH length is calculated before using this matcher</td> </tr> <tr> <td>bgp-atomic-aggregate (absent | present;)</td> <td> match ATOMIC_AGGREGATE BGP attribute</td> </tr> <tr> <td>bgp-communities (integer:integer | internet | local-as | no-advertise | no-export;)</td> <td> match the COMMUNITIES BGP attribute. Match is done when communities attribute in a route contains all entries from this configured list. But note that if communities list contains 'internet', the whole list always matched.</td> </tr> <tr> <td>bgp-local-pref (integer[-integer];)</td> <td> match LOCAL_PREF BGP attribute. If the LOCAL_PREF for a route is not set, value 0 is used instead</td> </tr> <tr> <td>bgp-med (integer[-integer];)</td> <td> match MULTI_EXIT_DISC BGP attribute. If the MULTI_EXIT_DISC for a route is not set, value 0 is used instead</td> </tr> <tr> <td>bgp-origin (igp | egp | incomplete;)</td> <td> match ORIGIN BGP attribute. If the ORIGIN for a route is not set, value 'incomplete' is used instead</td> </tr> <tr> <td>bgp-weight (signed integer[-signed integer];)</td> <td> match BGP weight property. If this property for a route is not set, value 0 is used instead</td> </tr> <tr> <td>chain (string;)</td> <td> chain name to place this rule in. If a chain with the specified name does not exist it will be automatically created
  • ospf-in - predefined filter chain for routes received via OSPF;
  • ospf-out - predefined filter chain for external routes redistributed via OSPF;
  • rip-in - predefined filter chain for routes received via RIP;
  • rip-out - predefined filter chain for external routes redistributed via RIP;
  • mme-in - predefined filter chain for routes received via MME;
  • connected-in - predefined filter chain for all connected routes;
  • dynamic-in - predefined filter chain for all other dynamic routes, i.e. all dynamic routes except (1) those added by routing protocols and (2) connected routes. In this category falls routes added by some external program, for example PPP daemon.


Note that internal RIP filtering is done using prefix lists [and internal (intra-area) OSPF filtering is not supported yet]</td> </tr> <tr>

   <td>distance (integer: 0..255[ - integer:0..255];)</td>
   <td> match routes with specific administrative distance</td>

</tr> <tr>

   <td>invert-math (yes | no; Default: no)</td>
   <td> invert this match, i.e. apply the rule to routes that would fail to match it and vice versa</td>

</tr> <tr>

   <td>jump-target (string;)</td>
   <td> name of the target chain to jump to, if the 'action=jump' is used</td>

</tr> <tr>

   <td>locally-originated-bgp (yes|no;)</td>
   <td></td>

</tr> <tr>

   <td>match-chain (string;)</td>
   <td> the name of the chain which is used to evaluate the route. If the chain accepts the route, 'match-chain' property produces a true match</td>

</tr> <tr>

   <td>ospf-type (string;)</td>
   <td> OSPF route type matcher</td>

</tr> <tr>

   <td>pref-src (IP address range;)</td>
   <td> match routes with a specific preferred source value</td>

</tr>

<tr>

   <td>prefix (IP prefix; Default: 0.0.0.0/0)</td>
   <td> network prefix to match. If prefix-length is not set, only exact match is done. For example, 0.0.0.0/0 then matches only the default route and nothing else. If network mask is not set, /32 is assumed</td>

</tr> <tr>

   <td>prefix-length (integer; Default: 0-32)</td>
   <td> network prefix mask length to match. If prefix-length is set, for a route to match the prefix and prefix-length of a rule, the following should hold:
  • the network prefix of the route falls within the range of the prefix of the rule, (i.e.
  • the network mask of the route is greater than or equal to the network mask of the prefix;
  • the network address of the route masked out by the network mask of the prefix is equal to the network address of the prefix;)
  • the length of the network mask of the route falls within the range of the prefix-length

</td> </tr>

<tr>

   <td>protocol (connect | static | rip | ospf | bgp;)</td>
   <td> match routes coming from a specific protocol (the values are self-explanatory)</td>

</tr> <tr>

   <td>route-comment (string;)</td>
   <td> match routes with a specific comment</td>

</tr> <tr>

   <td>route-tag (integer;)</td>
   <td> match routes with a specific route-tag property value</td>

</tr> <tr>

   <td>routing-mark (string;)</td>
   <td> match routes with a specific routing mark</td>

</tr> <tr>

   <td>scope (integer 0..255[-integer 0..255];)</td>
   <td> match routes with a specific scope property value</td>

</tr> <tr>

   <td>set-bgp-communities (integer:integer | internet | local-as | no-advertise | no-export;)</td>
   <td> set COMMUNITIES BGP attribut</td>

</tr> <tr>

   <td>set-bgp-local-pref (integer;)</td>
   <td> set LOCAL_PREF BGP attribute</td>

</tr> <tr>

   <td>set-bgp-med (integer;)</td>
   <td> set MULTI_EXIT_DISC BGP attribute</td>

</tr> <tr>

   <td>set-bgp-prepend (integer: 0..16 | default;)</td>
   <td> how many times to prepend router's own AS number to AS_PATH attribute

For incoming filters, it affects the AS_PATH attribute length, which is used in BGP route selection process. For outgoing filters, the prepending is done when announcing route via BGP and affects only routes sent to EBGP peers (for IBGP value 1 is always used)</td> </tr> <tr>

   <td>set-bgp-prepend-path (AS list;)</td>
   <td> add specified list of AS numbers to AS_PATH attribute

If both set-bgp-prepend and set-bgp-prepend-path are used then set-bgp-prepend will have highest priority. </td> </tr> <tr>

   <td>set-bgp-weight (signed integer;)</td>
   <td> set BGP weight property to be used in BGP route selection process. Valid only in incoming filters and for BGP routes</td>

</tr> <tr>

   <td>set-check-gateway (arp | none | ping;)</td>
   <td> set which protocol to use for gateway reachability, if any. Valid only in incoming filters</td>

</tr> <tr>

   <td>set-disabled (yes | no;)</td>
   <td> if set, the route will not become active.  Valid only in incoming filters</td>

</tr> <tr>

   <td>set-distance (integer: 0..255;)</td>
   <td> set the administrative distance of the route. If set to value 255, the route will not become active. Valid only in incoming filters</td>

</tr> <tr>

   <td>set-in-nexthop (IP address;)</td>
   <td> set gateway value to the specific IP address[es]. Valid only in incoming filters</td>

</tr> <tr>

   <td>set-in-nexthop-direct (interface name;)</td>
   <td> set gateway value to the specific interface. Valid only in incoming filters</td>

</tr> <tr>

   <td>set-in-nexthop-ipv6 (IPv6 address;)</td>
   <td> set gateway value to the specific IPv6 address[es]. Valid only in incoming filters

</td> </tr> <tr>

   <td>set-in-nexthop-linklocal (IPv6 link-local address % interface name;)</td>
   <td> set gateway value to the specific IPv6 link-local address[es] on specific interfaces. The syntax separates address and interface by '%'. Valid only in incoming filters</td>

</tr> <tr>

   <td>set-out-nexthop (IP address;)</td>
   <td> set gateway to be announced to the specific IP address[es]. Valid only in outgoing filters</td>

</tr> <tr>

   <td>set-out-nexthop-ipv6 (IPv6 address;)</td>
   <td> set gateway to be announced to the specific IPv6 address[es]. Valid only in outgoing filters</td>

</tr> <tr>

   <td>set-out-nexthop-linklocal (IPv6 link-local address;)</td>
   <td> set gateway value to be announced using BGP link-local nexthop feature. Valid only in outgoing filters and for BGP routes</td>

</tr> <tr>

   <td>set-pref-src (IP address;)</td>
   <td> set the preferred source address for packets leaving via this route. Valid only in incoming filters</td>

</tr> <tr>

   <td>set-route-comment (string;)</td>
   <td> set comment text. Valid only in incoming filters</td>

</tr> <tr>

   <td>set-route-tag (integer;)</td>
   <td> set OSPF or RIP route tag property value. For RIP only values 0..65535 are valid</td>

</tr> <tr>

   <td>set-route-targets (AsNum|AsIP;)</td>
   <td> </td>

</tr> <tr>

   <td>set-routing-mark (string;)</td>
   <td> set routing mark for the route. Valid only in incoming filters</td>

</tr> <tr>

   <td>set-scope (integer: 0..255;)</td>
   <td> set scope property, used in recursive nexthop resolving. Valid only in incoming filters</td>

</tr> <tr>

   <td>set-target-scope (integer: 0..255;)</td>
   <td> set target-scope property, used in recursive nexthop resolving. Valid only in incoming filters</td>

</tr> <tr>

   <td>set-type (blackhole | prohibit | unicast | unreachable;)</td>
   <td> set route type. Valid only in incoming filters
  • unicast - standard route
  • blackhole - silently discard packets
  • prohibit - reply to sender with ICMP Communication Administratively Prohibited messages
  • unreachable - reply to sender with ICMP Network Unreachable messages

</td> </tr>

<tr>

   <td>set-use-te-nexthop (yes|no;)</td>
   <td> </td>

</tr> <tr>

   <td>target-scope (integer 0..255[-integer 0..255];)</td>
   <td> match routes with a specific 'target-scope' value</td>

</tr> </table>

</div>

Property Description
action (accept | discard | jump | log | passthrough | reject | return; Default: passthrough) action to perform on route matching the rule.
  • accept - accept the routing information
  • discard - completely exclude matching prefix from further processing. For incoming filters, 'discard' means that information about this route is completely lost. For outgoing filters it's the same as 'reject'
  • jump - pass control to another filter list that should be specified as 'jump-target' parameter
  • log - log message about this match in system log and continue with the next rule in chain
  • passthrough - do not perform any action and continue to the next rule in chain
  • reject - reject the routing information for matching prefix. For incoming filters, 'reject' means that information about this route stored in memory, but the route will not become active. For outgoing filters it's the same as 'discard'
  • return - return to the previous chain from which a jump to the current chain took place </td> </ul>