Configuration example of a firewall filter used to limit J-Web access to a Juniper device.

Firewall filter configuration example to restrict management access to the device:

> OPTION 1: Configuring web-management for a trusted interface only (using xe-0/0/0.0 as an example):

This can be used if you are able to restrict J-Web access to an interface only, without the need to specify allow IP addresses.

> OPTION 2: Limiting web-management to only allowed IPs:

set policy-options prefix-list trusted-IPs 10.0.0.0/24 <<<< Example allowing a whole subnet

set policy-options prefix-list trusted-IPs 192.168.1.1/32 <<<< Example allowing a single host

NOTE: When using Juniper Secure Connect, the IPs of the users that will be connecting to the VPN will also need to be added to this prefix list. They will need to make a J-Web connection to download the VPN configuration when connecting from the JSC client.

set firewall family inet filter protect-RE term allow from source-prefix-list trusted-IPs

set firewall family inet filter protect-RE term allow from protocol tcp

set firewall family inet filter protect-RE term allow from destination port 80 <<<< In case you use web-management http

set firewall family inet filter protect-RE term allow from destination port 443 <<<< In case you use web-management https

set firewall family inet filter protect-RE term allow then accept

set firewall family inet filter protect-RE term deny from protocol tcp

set firewall family inet filter protect-RE term deny from destination port 80 <<<< In case you use web-management http

set firewall family inet filter protect-RE term deny from destination port 443 <<<< In case you use web-management https

set firewall family inet filter protect-RE term deny then discard

set firewall family inet filter protect-RE term deny then count <<<< In case you want to count the unsucessful attempts

set firewall family inet filter protect-RE term deny then log <<<< In case you want to log the unsucessful attempts

set firewall family inet filter protect-RE term allow-else then accept <<<< default accept term to avoid denying other traffic by accident

set interfaces lo0.0 family inet filter input protect-RE <<<< Applying the filter to the loopback interface so it catches all traffic directed to the SRX's routing engine

> OPTION 3: Filter specific subnet
 

set firewall family inet filter test term 1 from source-address 10.0.0.0/24

set firewall family inet filter test term 1 from destination-port https

set firewall family inet filter test term 1 then count deny-jweb

set firewall family inet filter test term 1 then log

set firewall family inet filter test term 1 then discard

set firewall family inet filter test term 2 then accept

NOTE: term 2 is the term that will match everything else aside term1 to allow it. The last term by default is an implicit deny, if you don't set a last term accepting the remaining traffic, you may block all traffic.

Apply the filter to the lo0:

set interfaces lo0.0 family inet filter input test

You can use the commands to check if the filter is working properly:

>show firewall log

>show firewall