Belajar Mengkonfigurasi Firewall Filter sederhana

Di Junos
http://iwing.wordpress.com

--------------------------------------------------------
Topology yang digunakan adalah sebagai berikut:
--------------------------------------------------------

--------------------------------------------------------
Contoh konfigurasi IOS software:
--------------------------------------------------------
Router(config)#access-list 110 deny ip host 192.168.10.2 any
Router(config)#access-list 110 permit ip any any
--------------------------------------------------------
Contoh konfigurasi JUNOS software:
--------------------------------------------------------
[edit firewall family inet filter test-blok]
root@cnc2# set term test-blok-iwing from source-address 192.168.10.2/32
root@cnc2# set term test-blok-iwing then reject
root@cnc2# set term accept-all then accept
root@cnc2#
--------------------------------------------------------
Kasus nya adalah, saya ingin memblokir ip host 192.168.10.2,
untuk mengakses ip host 192.168.30.2
--------------------------------------------------------
--------------------------------------------------------
[edit firewall]
root@cnc2# show
family inet {
filter test-blok {
term test-blok-iwing {
from {
source-address {
192.168.10.2/32;
}
}
then {
reject;
}
}
term accept-all {
then accept;
}
}
}

[edit firewall]
root@cnc2#
--------------------------------------------------------
Seperti di IOS, kita bisa meletakan rule nya diarah
inbound atau outbound, pada kasus saya akan saya simpan
di arah outbound int fxp0.0
--------------------------------------------------------
[edit interfaces]
root@cnc2# set fxp0.0 family inet filter output test-blok
root@cnc2#
--------------------------------------------------------
[edit interfaces fxp0 unit 0]
root@cnc2# show
family inet {
filter {
output test-blok;
}
address 192.168.30.1/24;
}

[edit interfaces fxp0 unit 0]

root@cnc2#
--------------------------------------------------------
Hasilnya adalah :
--------------------------------------------------------
--------------------------------------------------------
Kasus kedua, saya ingin memblokir layanan telnet ke router
cnc2 dari network 192.168.10.0/24,rulenya saya coba
buat di router cnc1
--------------------------------------------------------
Contoh konfigurasi IOS software:
--------------------------------------------------------
Router(config)#access-list 120 deny tcp any host 192.168.20.2 eq telnet
Router(config)#access-list 120 deny tcp any host 192.168.30.1 eq telnet
Router(config)#access-list 120 deny tcp any host 2.2.2.2 eq telnet
Router(config)#access-list 120 permit ip any any
--------------------------------------------------------
Contoh konfigurasi JUNOS software:
--------------------------------------------------------
[edit firewall family inet filter protect-router]
root@cnc1# set term block-cli-access from destination-address 192.168.20.2/32
root@cnc1# set term block-cli-access from destination-address 192.168.30.1/32
root@cnc1# set term block-cli-access from destination-address 2.2.2.2/32
root@cnc1# set term block-cli-access from protocol tcp
root@cnc1# set term block-cli-access from destination-port telnet
root@cnc1# set term block-cli-access then reject
root@cnc1# set term allow-others then accept
root@cnc1#
--------------------------------------------------------
[edit firewall]
root@cnc1# show
family inet {
filter protect-router {
term block-cli-access {
from {
destination-address {
192.168.20.2/32;
2.2.2.2/32;
192.168.30.1/32;
}
protocol tcp;
destination-port telnet;
}
then {
reject;
}
}
 term allow-others {
then accept;
}
}
}

[edit firewall]
root@cnc1#
--------------------------------------------------------
Seperti di IOS, kita bisa meletakan rule nya diarah
inbound atau outbound, pada kasus saya akan saya simpan
di arah inbound int fxp0.0
--------------------------------------------------------
[edit interfaces]
root@cnc1# set fxp0.0 family inet filter input protect-router
root@cnc1#
--------------------------------------------------------
[edit interfaces fxp0 unit 0]
root@cnc1# show
family inet {
filter {
input protect-router;
}
address 192.168.10.1/24;
}

[edit interfaces fxp0 unit 0]

root@cnc1#
--------------------------------------------------------
Hasilnya adalah sebagai berikut :
--------------------------------------------------------
--------------------------------------------------------
Sekian dulu mudah-mudahan bermanfaat, kalau ada yang keliru
tolong beritahu saya "CMIIW"