how can I filter all the routes from one AS?
I want to filter all routes from AS 6400 towards AS1000, how can I filter whole routes from one AS to another?
I do not want to be used as transit AS so I need to do that, I Googled and got some stuff about using prefix-list + route-map but the thing is AS6400 is an actual Internet active AS which hosts some 500000 plus routes, and it does not sound reasonable to write prefix list for that amount of route, so what should I do?
There are a couple ways to do this, without having to specify every single prefix that you're receiving from AS6400 in a prefix-list (I would personally advise against doing this because as you mentioned, the administrative overhead is high and the process will become exponentially more error-prone as the number of prefixes increases).
1) Tag routes you've received from AS6400 with the no export community. You would do this within a route-map:
route-map RECEIVE-FROM-6400 permit 5
set community no-export additive
This will tell R3 to not advertise the routes learned from AS6400 to AS1000 via the eBGP session to R1. This is your simplest option (note here that this will need to be an inbound filter applied on R4 on the eBGP session to R2/AS6400).
2) You could use an AS Path access list to determine which prefixes have an AS path that begins with 6400 and then you could use it on a BGP neighbor statement with a filter list, or you could use it in a route-map to deny advertising the prefixes on R3. This is less simple because it requires knowledge of regex (to be fair, the regex required here is somewhat simple) and it also depends on no one doing anything funny with their AS path, of which there's no real guarantee. Using a route-map, the configuration to implement would look something like this (assuming IOS):
ip as-path access-list 10 permit ^6400_[0-9]*$
route-map ANNOUNCE-TO-1000 deny 5
match as-path 10
route-map ANNOUNCE-TO-1000 permit 10
Note that the above will need to be configured as an outbound filter on R3 for the eBGP session with AS1000.
Using the well-known 'no export' community is likely going to be your best bet, along with being very judicious with your outbound announcements to AS1000 and AS6400.
If your goal is to not transit traffic through your AS to others, all you need to do is strictly control your outbound announcements to ensure that only your routes are advertised to either upstream peer.
If you are an edge AS (not a BGP-speaking ISP to your own customers) the simple way is almost exactly as you mentioned, but just using a prefix-list to control route announcements to peers. Define all of your prefixes exactly as you want to announce them to the peers, then apply that prefix-list outbound toward both peers. There is a great example of this (among other good BGP practices) on the Team Cymru Secure BGP Template.
Their example shows the following:
router bgp ###
neighbor x.x.x.x remote-as ****
neighbor x.x.x.x prefix-list announce out
ip prefix-list announce description Our allowed routing announcements
ip prefix-list announce seq 5 permit 192.0.2.0/24
ip prefix-list announce seq 10 deny 0.0.0.0/0 le 32
This causes the 192.0.2.0/24 network to be matched exactly and permitted, while the next line matches all other prefixes (mask length is 0, but match length is less-than/equal-to 32) and denies them.
