Just to recap:
We learn customer prefixes via dedicated downstream routers which append a community xxx:1000 and set a high local
preference. These routers have queues applied, to limit customers to their subscribed service speed.
If a customers advertises eg 1.1.1.0/22 to us, this prefix is then correctly advertised to our upstream providers.
If clever customers then however additionally advetise 1.1.1.0/24 on an internet exchange where we peer with route servers , our
infrastructure would learn this route and whilst it wouldn’t advertise it upstream (it doesn’t contain community
xxx:1000) we would still prefer to route their traffic towards them via this more specific route.
We subsequently wrote a script which automatically maintains a prefix filter on our routers at various internet
exchanges, to discard any prefixes which match or fall within prefixes we learn from our customers.
/system script
add name=bgp-build_customer_filter owner=admin policy=read,write \
source=":log info \"BGP - Started building customer prefix filter\";\r\
\n:local i;\r\
\n:local destination;\r\
\n:local nm;\r\
\n\r\
\n/routing filter set [ find where chain=customer-prefix-filter ] comment=\"deleteme:\";\
\r\
\n:foreach i in=[ /ip route find where active and bgp-communities ~ \"xxx:1000\" ] do={\
\r\
\n :set destination [ /ip route get \$i dst-address ];\r\
\n :set nm [ :pick \$destination ([ :find \$destination \"/\" ]+1) [ :len \$destination \
] ];\r\
\n /routing filter add chain=customer-prefix-filter prefix=\"\$destination\" prefix-leng\
th=\"\$nm-32\" action=discard;\r\
\n}\r\
\n/routing filter remove [ find where chain=customer-prefix-filter and comment=\"deleteme\
:\" ];\r\
\n:log info \"BGP - Finished building customer prefix filter\";\r\
\n"
/system scheduler
add interval=3h name="Build customer prefix filter" on-event="/system script run \"bgp-build_customer_filter\"" \
policy=read,write start-date=jan/01/1970 start-time=00:30:00