[edit policy-options]
MX#show
prefix-list NET {
    192.168.10.101/32;
}
prefix-list UNTRUST {
    192.168.10.0/24;
    192.168.20.0/24;
}

[edit firewall]
MX#show
family inet {
    filter PROTECT-RE {
        term 1 {
            from {
                prefix-list {
                    NET except;
                    UNTRUST;
                }
                protocol [ tcp udp ];
                port ftp;
            }
            then {
                discard;
            }
        }
        term 2 {
            from {
                protocol [ tcp udp ];
            }
            then accept;
        }
        term 3 {
            then {
                discard;
            }
        }
    }
}