{% extends "base.html" %} {%- import "macros/icons.html" as icons -%} {% block title %}{{ config.title }} · Routing security for every network{% endblock title %} {% block body_class %}layout-home{% endblock body_class %} {% block body %}
{#- The photograph is set in two colours by the stylesheet; see .hero-photo. #}
BGP-4 · RFC 4271 · version {{ config.extra.version }}

Routing security for every network.

Ferrix is a BGP daemon for Linux routers. It filters the routes it receives, validates them with the RPKI, prevents route leaks with BGP roles, and installs the best paths in the kernel. It is free software, written in Rust.

Quick start {{ icons::arrow_right() }} Documentation

$cargo build --release -p bgp

Source: Unsplash

01Default Import Policy

Ferrix applies the following checks to every route from an external neighbor by default. Nine of them can be disabled per neighbor where required.

  1. 01Bogon prefixes
  2. 02Bogon AS numbers in the path
  3. 03Prefixes longer than /24 or /48
  4. 04Default route
  5. 05AS paths longer than 64
  6. 06AS_SET in the path
  7. 07First AS is not the neighbor
  8. 08Local AS in the path
  9. 09Next hop is not the neighbor
  10. 10Next hop is unusable
  11. 11Local prefixes

Each check reports a distinct rejection reason. RPKI origin validation, ASPA verification, BGP roles, prefix limits, and prefix and origin lists are configured per neighbor.

Comparison with the NLNOG BGP Filter Guide {{ icons::arrow_right() }}
02Specifications
Protocol
BGP-4, four-octet AS numbers, MP-BGP
Address families
IPv4 and IPv6 unicast; IPv4 with IPv6 next hops (RFC 8950)
Validation
RPKI origin validation and ASPA; RTR versions 0 through 2
Route leak prevention
BGP roles and Only to Customer (RFC 9234)
Neighbors
Global and link-local addresses
Policy
Prefix and origin lists, prefix limits, communities, control communities
Forwarding
Linux kernel over netlink, with nexthop objects
Kernel installation
1 million routes in about 1 second
Monitoring
Status page, JSON API, Prometheus metrics
License
Apache 2.0
03Features
03.1

Import Policy

Rejects bogon prefixes and AS numbers, third-party next hops, and local prefixes by default. Supports prefix lists, origin AS lists, and prefix limits.

 03.2

RPKI Validation

Route origin validation and ASPA verification. Routes are revalidated when the RPKI data changes.

 03.3

Route Leak Prevention

BGP role negotiation and the Only to Customer attribute, as specified in RFC 9234.

 03.4

Kernel Route Installation

Installs active routes over netlink. Routes with unresolvable next hops are excluded from best path selection.

 03.5

Route Advertisement

Advertises learned routes as BGP roles permit, with export policy and route server control communities.

 03.6

Neighbor Types

Link-local neighbors such as fe80::1%eth0, IPv4 routes with IPv6 next hops, and ADD-PATH.

 03.7

Monitoring

Records every rejected route with its reason. Provides Prometheus metrics and alerting rules.

 03.8

Reliability

No unsafe code and fuzz-tested parsers. A failure in one session does not affect other sessions.
04Interoperability

An automated lab tests Ferrix with FRR 10.5.1, BIRD 2.18, and Routinator 0.15.2, in the following phases:

    {%- for phase in ["basics", "roles", "rpki", "refresh", "flaps", "restart", "scale", "limits", "hijacks", "nexthops", "transit", "v6only", "linklocal"] %}
  1. {% if loop.index < 10 %}0{% endif %}{{ loop.index }}{{ phase }}
    2. {%- endfor %}
Test phases {{ icons::arrow_right() }}
05Getting Started

Establish a BGP session with a test peer on a single host, without privileges and without modifying the kernel routing table.

Quick start {{ icons::arrow_right() }} 
$ cargo run -p bgp -- docs/examples/quick-start.textpb
$ cargo run -p bgp-integration-tests --example fake_peer -- \
    --server 127.0.0.1:1790 --asn 65001 --announce 203.0.113.0/24
# then http://127.0.0.1:8080/statusz
{% endblock body %}