#定义 router ID
router id 100.127.70.25;
#定义自有网络，这是filter policy
function is_own_network() {
return net ~ [
10.0.0.0/22{22,24} # Anycast DNS
];
}
# The Kernel protocol is not a real routing protocol. Instead of communicating
# with other routers in the network, it performs synchronization of BIRD's
# routing tables with the OS kernel.
protocol kernel {
scan time 60;
import none;
# export all; # Actually insert routes into the kernel routing table
}
# The Device protocol is not a real routing protocol. It doesn't generate any
# routes and it only serves as a module for getting information about network
# interfaces from the kernel.
protocol device {
scan time 60;
}
protocol static static4 {
route 10.0.0.0/24 reject;
}
protocol bgp vultr
{
# substitute with your AS or Vultr's private AS
local as xxxx;
import all;
export filter {
if is_own_network() && source ~ [RTS_STATIC, RTS_BGP] then {
accept;
}
reject;
};
graceful restart on;
multihop 2;
neighbor 169.254.169.254 as 64515;
password "";
}
我们都知道 IDC 需要使用 BGP 协议来与上游交换路由表和发送自己的 IP Prefix，而且可以通过 BGP 来对路由属性对自己和客户的网段进行修改以达到控制路径的效果。但是有多少人知道其实 BGP 可以使用 community 来实现非常方便的路由路径调整呢？这篇文章将讲述如何使用 community 来打造适合机房的路由控制方案。
ip community-list standard no-export-hkix permit 48024:30010
ip community-list standard no-export-hkix-aliyun permit 48024:30020
ip community-list standard no-export-hkix-aliyun permit 48024:30030
ip community-list standard no-export-he permit 48024:40010
ip community-list standard prepend1x-he permit 48024:40011
ip community-list standard prepend2x-he permit 48024:40012
ip community-list standard prepend3x-he permit 48024:40013
ip community-list standard no-export-cdn77 permit 48024:40020
ip community-list standard prepend1x-cdn77 permit 48024:40021
ip community-list standard prepend2x-cdn77 permit 48024:40022
ip community-list standard prepend3x-cdn77 permit 48024:40023
ip community-list standard no-export-cdn77-level3 permit 48024:60010
ip community-list standard no-export-cdn77-gtt permit 48024:60020
ip community-list standard no-export-cdn77-corebackbone permit 48024:60040
ip community-list standard no-export-cdn77-cogent permit 48024:60050
ip community-list standard no-export-cdn77-ntt permit 48024:60060
ip community-list standard no-export-cdn77-tata permit 48024:60070
ip community-list standard no-export-cdn77-retn permit 48024:60080
ip community-list standard no-export-cdn77-upc permit 48024:60090
ip community-list standard no-export-cdn77-sparkle permit 48024:60100
ip community-list standard no-export-cdn77-telia permit 48024:60110
ip community-list standard no-export-cdn77-comcast permit 48024:60120
ip community-list standard no-export-cdn77-nme permit 48024:60160
ip community-list standard no-export-cdn77-telefonica permit 48024:60190
ip community-list standard no-export-cdn77-vodafone permit 48024:60200
ip community-list standard no-export-cdn77-pccw permit 48024:60210
ip community-list standard no-export-cdn77-coloau permit 48024:60240
ip community-list standard no-export-cdn77-serversaustralia permit 48024:60250
ip community-list standard no-export-cdn77-orange permit 48024:60260
ip community-list standard nerocloud-rtbh permit 48024:666
ip community-list standard no-export permit 48024:1000
ip community-list standard prepend1x-nerocloud permit 48024:1001
ip community-list standard prepend2x-nerocloud permit 48024:1002
ip community-list standard prepend3x-nerocloud permit 48024:1003
route-map nerocloud-import permit 10
match community nerocloud-rtbh
set ip next-hop xx.xx.xx.xx
set community 3491:999 4635:666 6939:666 additive
continue 20
route-map nerocloud-import permit 20
ip route xx.xx.xx.xx 255.255.255.255 Null0
解释一下：
我们的rtbh是 48024:666，当客户发这个community时，我们网内应该将被攻击的IP封禁，set ip next-hop xx.xx.xx.xx 就是将被攻击的 IP丢到下一跳（并不真实存在的）然后再把这个网关加到NULL0上，就能在网内屏蔽这个/32 IP。
