WAN Interface Filter Rules

These WAN interface rules control traffic flow into and out of the WAN interface. This example setup is focused on outbound client traffic, so it does not allow other traffic is inbound.

Create Ruleset

Add the WAN filter ruleset on both nodes:

tnsr(config)# vpf filter ruleset WAN-filter
tnsr(config-vpf-filter-ruleset)# description Filter rules for WAN

Allow ICMP

This rule allows ICMP inbound for diagnostic and network control purposes:

tnsr(config-vpf-filter-ruleset)# rule 10
tnsr(config-vpf-filter-rule)# description Allow ICMP inbound
tnsr(config-vpf-filter-rule)# pass
tnsr(config-vpf-filter-rule)# direction in
tnsr(config-vpf-filter-rule)# stateful
tnsr(config-vpf-filter-rule)# ip-version ipv4
tnsr(config-vpf-filter-rule)# protocol icmp
tnsr(config-vpf-filter-rule)# exit

Allow VRRP

These rules allow VRRP to communicate inbound and outbound to ensure both nodes can exchange heartbeats:

tnsr(config-vpf-filter-ruleset)# rule 20
tnsr(config-vpf-filter-rule)# description Allow VRRP inbound
tnsr(config-vpf-filter-rule)# pass
tnsr(config-vpf-filter-rule)# direction in
tnsr(config-vpf-filter-rule)# ip-version ipv4
tnsr(config-vpf-filter-rule)# protocol vrrp
tnsr(config-vpf-filter-rule)# exit
tnsr(config-vpf-filter-ruleset)# rule 21
tnsr(config-vpf-filter-rule)# description Allow VRRP outbound
tnsr(config-vpf-filter-rule)# pass
tnsr(config-vpf-filter-rule)# direction out
tnsr(config-vpf-filter-rule)# ip-version ipv4
tnsr(config-vpf-filter-rule)# protocol vrrp
tnsr(config-vpf-filter-rule)# exit

Note

The VRRP rules could be more strict, allowing only a source of the peer interface IP address and/or to a destination of 224.0.0.18.

Do not use stateful on VRRP rules as it is multicast and has no return traffic, so the state never has traffic it can match.

Allow Egress Traffic

This rule allows traffic outbound from TNSR itself and for traffic routed through TNSR egressing through the WAN interface on TNSR:

tnsr(config-vpf-filter-ruleset)# rule 1000
tnsr(config-vpf-filter-rule)# description Pass outbound from TNSR to any destination
tnsr(config-vpf-filter-rule)# pass
tnsr(config-vpf-filter-rule)# direction out
tnsr(config-vpf-filter-rule)# stateful
tnsr(config-vpf-filter-rule)# ip-version ipv4
tnsr(config-vpf-filter-rule)# exit

Activate Ruleset

Exit out to complete the ruleset:

tnsr(config-vpf-filter-ruleset)# exit

Next, activate the WAN filter ruleset:

tnsr(config)# vpf options
tnsr(config-vpf-option)# interface WAN filter-ruleset WAN-filter
tnsr(config-vpf-option)# exit