Tue Jan 24, 2023 9:52 pm
Or to be a bit more dynamic and have the possibility to re-use rule sets on other routers and reduce the number of rules - matching dst on address-lists
An example from my IPv6 rule set
/ipv6/firewall/address-list/add list=ipv6-subnets address=2a11:abc1:a0::/48
/ipv6/firewall/address-list/add list=ipv6-subnets address=2a22:aa00:::/23
...
/routing/filter/rule/add chain=ipv6-ebgp-provider-out rule="if (afi ipv6 && dst in ipv6-subnets) {accept}"
The nice thing about matching dst on an address-list is it's matching only the exact address with the exact subnet mask, not smaller, not larger, and you have only one rule even when advertising multiple subnets.
Attention: In IPv4 matching dst on address-list there is a bug currently with /32 subnets - these would still be matched and advertised in this example even though the network mask is not matching a network mask of the address-list.