New Tool - Juniper Protect-RE Filter Generator

Also new on the Network Tools page: a Juniper Protect-RE Filter Generator — builds the lo0.0 input firewall filter every RE-bound packet passes through, regardless of which interface or destination address it actually arrived on.

Check the protocols you run, list trusted sources where it matters, and get a complete, correctly-ordered config — anti-spoofing and fragment discard first, then source-restricted NTP/RADIUS/SNMP/BGP, then OSPF/VRRP, then management access, a blanket TCP SYN/FIN/RST flood policer, type-restricted rate-limited ICMP, dual-style traceroute support (UDP and Windows’ ICMP-based tracert), optional BFD, and a logged, counted catch-all discard at the end.

A few things worth calling out:

• apply-path prefix-lists for BGP, NTP, RADIUS, and SNMP — instead of a static address list you have to remember to update, these pull straight from the actual configuration (protocols bgp, system ntp/radius-server, snmp client-list) at commit time, including across routing-instances/virtual-routers for BGP. Add or remove a peer where it actually lives, and the filter updates itself on the next commit.
• IS-IS gets a real answer, not a fake one. It runs directly over CLNS/OSI framing, not IP, so no IP firewall filter can see it — checking the IS-IS box adds an explanatory comment pointing at interface-level authentication instead of generating a filter term that would silently do nothing.
• The whole thing is wrapped in a Junos configuration group (groups { PROTECT-RE-GROUP { ... } }), bound to any lo0 unit via unit <*>, activated by apply-groups — plus a generated-date annotation at the top.
• Every accept term gets its own counter, service ports use destination-port rather than the looser either-direction port match, and the catch-all uses syslog instead of the small local log buffer — details that came out of comparing against a real production filter, not just vendor docs.

Same rules as every other tool here: runs entirely in your browser, nothing sent anywhere. It’s a starting point, not a certified config — read it line by line, verify against your own environment, and always use commit confirmed when applying an RE filter remotely. A mistake here can lock you out of the box entirely.

fryguy.net/tools-junos-protect-re