BGP Example

Policy definition:

# Create policy
set policy route-map setmet rule 2 action 'permit'
set policy route-map setmet rule 2 set as-path prepend '2 2 2'

# Apply policy to BGP
set protocols bgp system-as 1
set protocols bgp neighbor 203.0.113.2 address-family ipv4-unicast route-map import 'setmet'
set protocols bgp neighbor 203.0.113.2 address-family ipv4-unicast soft-reconfiguration 'inbound'

Using ‘soft-reconfiguration’ we get the policy update without bouncing the neighbor.

Routes learned before routing policy applied:

vyos@vos1:~$ show ip bgp
BGP table version is 0, local router ID is 192.168.56.101
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
              r RIB-failure, S Stale, R Removed
Origin codes: i - IGP, e - EGP, ? - incomplete

   Network          Next Hop            Metric LocPrf Weight Path
*> 198.51.100.3/32   203.0.113.2           1             0 2 i  < Path

Total number of prefixes 1

Routes learned after routing policy applied:

vyos@vos1:~$ show ip bgp
BGP table version is 0, local router ID is 192.168.56.101
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
              r RIB-failure, S Stale, R Removed
Origin codes: i - IGP, e - EGP, ? - incomplete

   Network          Next Hop            Metric LocPrf Weight Path
*> 198.51.100.3/32   203.0.113.2           1             0 2 2 2 2 i

Total number of prefixes 1
vyos@vos1:~$

You now see the longer AS path.

Transparent Proxy

The following example will show how VyOS can be used to redirect web traffic to an external transparent proxy:

set policy route FILTER-WEB rule 1000 destination port 80
set policy route FILTER-WEB rule 1000 protocol tcp
set policy route FILTER-WEB rule 1000 set table 100

This creates a route policy called FILTER-WEB with one rule to set the routing table for matching traffic (TCP port 80) to table ID 100 instead of the default routing table.

To create routing table 100 and add a new default gateway to be used by traffic matching our route policy:

set protocols static table 100 route 0.0.0.0/0 next-hop 10.255.0.2

This can be confirmed using the show ip route table 100 operational command.

Finally, to apply the policy route to ingress traffic on our LAN interface, we use:

set policy route FILTER-WEB interface eth1

Clamp MSS for a specific IP

This example shows how to target an MSS clamp (in our example to 1360 bytes) to a specific destination IP.

set policy route IP-MSS-CLAMP rule 10 description 'Clamp TCP session MSS to 1360 for 198.51.100.30'
set policy route IP-MSS-CLAMP rule 10 destination address '198.51.100.30/32'
set policy route IP-MSS-CLAMP rule 10 protocol 'tcp'
set policy route IP-MSS-CLAMP rule 10 set tcp-mss '1360'
set policy route IP-MSS-CLAMP rule 10 tcp flags 'SYN'

To apply this policy to the correct interface, configure it on the interface the inbound local host will send through to reach our destined target host (in our example eth1).

set policy route IP-MSS-CLAMP interface eth1

You can view that the policy is being correctly (or incorrectly) utilised with the following command:

show policy route statistics