Filtering http/https traffic destined for a juniper router

Question

I need to find a way to harden my network so that all juniper routers reject web management and any http / https traffic that is destined for them specifically.

This is what I came up with so far:

edit
delete system services web-management
edit firewall family inet filter local_web_filter
set term block_web from destination-address 127.0.0.1/32
set term block_web from port http
set term block_web from port https
set term block_web then log
set term block_web then reject tcp-reset
set term default-term then accept
set interfaces lo0 unit 0 family inet filter input local_web_filter
set interfaces lo0 unit 0 family inet address 127.0.0.1/32
commit
write memory

I have little experience configuring juniper routers, so any help would be much appreciated.

Answer 1

A few remarks:

• if you disable the web management service, you wouldn't have to block HTTP(S) traffic anymore, since there's no service listening on that port.
• should you be wanting to filter traffic to the router's web management interface, then your firewall filter is not very useful for a few reasons:
  1. you're only blocking traffic towards localhost. So only traffic from your router to your router's web interface could match that. If you want to make sure nothing reaches the web management interface, you should match on any IP address used by the router. Since you're applying the filter on the loopback interface, I'd just remove the match on the destination address.
  2. you're matching on port 80 and port 443, which implies both source and destination ports. You should explicitly match on destination-port 80 and destination-port 443.
• write memory is not a valid JunOS command