loopback.conf

# https://www.safaribooksonline.com/library/view/juniper-mx-series/9781491932711/ch04.html
# http://www.hiphop-resistance.com/juniperdayone/Securing_RouteEngine2.pdf
# https://spaces.internet2.edu/display/RS/Routing+Security+Home
# https://tools.ietf.org/html/rfc7454

# add loopback addrs to ensure prefix-list is not empty;
prefix-list bmp-stations-v4 {
    127.0.0.0/8;
    apply-path "routing-options bmp station <*> station-address <*.*.*.*>";
}
prefix-list bmp-stations-v6 {
    ::1/128;
    apply-path "routing-options bmp station <*> station-address <*:*:*>";
}
prefix-list dns-servers-v4 {
    127.0.0.0/8;
    apply-path "system name-server <*.*.*.*>";
}
prefix-list dns-servers-v6 {
    ::1/128;
    apply-path "system name-server <*:*:*>";
}
prefix-list loopback-v4 {
    127.0.0.0/8;
    apply-path "interfaces lo0 unit <*> family inet address <*.*.*.*>";
}
prefix-list loopback-v6 {
    ::1/128;
    apply-path "interfaces lo0 unit <*> family inet6 address <*:*:*>";
}
prefix-list netconf-clients-v4 {
    127.0.0.0/8;
    ## REMOVED ##
}
prefix-list netconf-clients-v6 {
    ::1/128;
    ## REMOVED ##
}
prefix-list ntp-servers-v4 {
    127.0.0.0/8;
    apply-path "system ntp server <*.*.*.*>";
}
prefix-list ntp-servers-v6 {
    ::1/128;
    apply-path "system ntp server <*:*:*>";
}
prefix-list radius-servers-v4 {
    127.0.0.0/8;
    apply-path "system radius-server <*.*.*.*>";
}
prefix-list radius-servers-v6 {
    ::1/128;
    apply-path "system radius-server <*:*:*>";
}
prefix-list snmp-clients-v4 {
    127.0.0.0/8;
    apply-path "snmp community <*> clients <*.*.*.*>";
}
prefix-list snmp-clients-v6 {
    ::1/128;
    apply-path "snmp community <*> clients <*:*:*>";
}
prefix-list ssh-clients-v4 {
    127.0.0.0/8;
    ## REMOVED ##
}
prefix-list ssh-clients-v6 {
    ::1/128;
    ## REMOVED ##
}

interfaces {
    lo0 {
        unit 0 {
            family inet {
                input loopback-v4;
            family inet6 {
                input loopback-v6;
firewall {
    family inet {
        filter loopback-v4 {
            term bfd {
                from {
                    source-prefix-list {
                        bgp-neighbors-v4;
                        depaul-v4;
                    }
                    protocol udp;
                    port 3784;
                }
                then {
                    count bfd;
                    accept;
                }
            }
            term bgp {
                from {
                    source-prefix-list {
                        bgp-neighbors-v4;
                    }
                    protocol tcp;
                    port bgp;
                }
                then {
                    count bgp;
                    accept;
                }
            }
            term bmp {
                from {
                    source-prefix-list {
                        bmp-stations-v4;
                    }
                    protocol tcp;
                    source-port 1790;
                }
                then {
                    count bmp;
                    accept;
                }
            }
            term dns {
                from {
                    source-prefix-list {
                        dns-servers-v4;
                    }
                    protocol [ tcp udp ];
                    source-port 53;
                }
                then {
                    count dns;
                    accept;
                }
            }
            term icmp {
                from {
                    protocol icmp;
                    icmp-type [ echo-reply echo-request parameter-problem time-exceeded unreachable ];
                }
                then {
                    count icmp;
                    accept;
                }
            }
            term igmp {
                from {
                    destination-address {
                        224.0.0.0/4;
                    }
                    protocol igmp;
                }
                then {
                    count igmp;
                    accept;
                }
            }
            term netconf {
                from {
                    source-prefix-list {
                        netconf-clients-v4;
                    }
                    protocol tcp;
                    destination-port 830;
                }
                then {
                    count netconf;
                    accept;
                }
            }
            term ntp {
                from {
                    source-prefix-list {
                        loopback-v4;
                        ntp-servers-v4;
                    }
                    protocol udp;
                    port ntp;
                }
                then {
                    count ntp;
                    accept;
                }
            }
            term ospf {
                from {
                    source-prefix-list {
                        depaul-v4;
                    }
                    protocol ospf;
                }
                then {
                    count ospf;
                    accept;
                }
            term pim {
                from {
                    source-prefix-list {
                        depaul-v4;
                    }
                    protocol pim;
                }
                then {
                    count pim;
                    accept;
                }
            }
            term radius {
                from {
                    source-prefix-list {
                        radius-servers-v4;
                    }
                    protocol udp;
                    source-port [ 1812 1813 ];
                }
                then {
                    count radius;
                    accept;
                }
            }
            term snmp {
                from {
                    source-prefix-list {
                        snmp-clients-v4;
                    }
                    protocol udp;
                    destination-port 161;
                }
                then {
                    count snmp;
                    accept;
                }
            }
            term ssh {
                from {
                    source-prefix-list {
                        ssh-clients-v4;
                    }
                    protocol tcp;
                    port 22;
                }
                then {
                    count ssh;
                    accept;
            }
            term traceroute-udp {
                 from  {
                    protocol udp;
                    destination-port 33434-33534;
                 }
                 then {
                     count traceroute-udp;
                     accept;
                 }
             }
            term default {
                then {
                    count default;
                    syslog;
                    discard;
                }
            }
        }
    }
    family inet6 {
        filter loopback-v6 {
            term bfd {
                from {
                    source-address {
                        fe80::/10;
                    }
                    source-prefix-list {
                        bgp-neighbors-v6;
                        depaul-v6;
                    }
                    payload-protocol udp;
                    port 3784;
                }
                then {
                    count bfd;
                    accept;
                }
            }
            term bgp {
                from {
                    source-address {
                        fe80::/10;
                    }
                    source-prefix-list {
                        bgp-neighbors-v6;
                    }
                    payload-protocol tcp;
                    port bgp;
                }
                then {
                    count bgp;
                    accept;
                }
            }
            term bmp {
                from {
                    source-prefix-list {
                        bmp-stations-v6;
                    }
                    payload-protocol tcp;
                    source-port 1790;
                }
                then {
                    count bmp;
                    accept;
                }
            }
            term dns {
                from {
                    source-prefix-list {
                        dns-servers-v6;
                    }
                    payload-protocol [ tcp udp ];
                    source-port 53;
                }
                then {
                    count dns;
                    accept;
                }
            }
            term icmp6 {
                from {
                    payload-protocol icmp6;
                    icmp-type [ destination-unreachable echo-reply echo-request membership-query membership-report membership-termination neighbor-advertisement neighbor-solicit packet-too-big router-advertisement parameter-problem time-exceeded ]
                }
                then {
                    count icmp6;
                    accept;
                }
            }
            term netconf {
                from {
                    source-prefix-list {
                        netconf-clients-v6;
                    }
                    payload-protocol tcp;
                    destination-port 830;
                }
                then {
                    count netconf;
                    accept;
                }
            }
            term ntp {
                from {
                    source-prefix-list {
                        loopback-v6;
                        ntp-servers-v6;
                    }
                    payload-protocol udp;
                    port ntp;
                }
                then {
                    count ntp;
                    accept;
                }
            }
            term ospf {
                from {
                    source-address {
                        fe80::/10;
                    }
                    source-prefix-list {
                        depaul-v6;
                    }
                    payload-protocol ospf;
                }
                then {
                    count ospf;
                    accept;
                }
            term pim {
                from {
                    source-address {
                        fe80::/10;
                    }
                    source-prefix-list {
                        depaul-v6;
                    }
                    payload-protocol pim;
                }
                then {
                    count pim;
                    accept;
                }
            }
            term radius {
                from {
                    source-prefix-list {
                        radius-servers-v6;
                    }
                    payload-protocol udp;
                    source-port [ 1812 1813 ];
                }
                then {
                    count radius;
                    accept;
                }
            }
            term snmp {
                from {
                    source-prefix-list {
                        snmp-clients-v6;
                    }
                    payload-protocol udp;
                    destination-port 161;
                }
                then {
                    count snmp;
                    accept;
                }
            }
            term ssh {
                from {
                    source-prefix-list {
                        ssh-clients-v6;
                    }
                    payload-protocol tcp;
                    port 22;
                }
                then {
                    count ssh;
                    accept;
            }
            term traceroute-udp {
                 from  {
                    payload-protocol udp;
                    destination-port 33434-33534;
                 }
                 then {
                     count traceroute-udp;
                     accept;
                 }
             }
            term default {
                then {
                    count default;
                    syslog;
                    discard;
                }
            }
        }
    }
}