From 42d79354e328971b0f85d3c62bd1bb290f9f6604 Mon Sep 17 00:00:00 2001 From: Rayhaan Jaufeerally Date: Sun, 20 Sep 2026 19:29:31 +0200 Subject: [PATCH] docs: peer with BIRD over ::1 on the router; explain the multihop requirement Co-Authored-By: Claude Fable 5.1 --- docs/lab/prod/on-router/05-lab-lo.network | 15 +++++++++------ docs/lab/prod/on-router/README.md | 10 +++++----- docs/lab/prod/on-router/bird-ferrix-local.conf | 13 +++++++++---- docs/lab/prod/on-router/ferrix.textpb | 9 ++++----- 4 files changed, 27 insertions(+), 20 deletions(-) diff --git a/docs/lab/prod/on-router/05-lab-lo.network b/docs/lab/prod/on-router/05-lab-lo.network index 1effb3e..06d7cdd 100644 --- a/docs/lab/prod/on-router/05-lab-lo.network +++ b/docs/lab/prod/on-router/05-lab-lo.network @@ -4,12 +4,15 @@ [Match] Name=lo -# One address each for BIRD and ferrix to peer over. -[Address] -Address=fd00:179::1/128 - -[Address] -Address=fd00:179::2/128 +# BIRD and ferrix peer over ::1, which needs no configuration. Should BIRD +# object to identical local and neighbour addresses, give them one each +# instead (and use those in bird.conf and ferrix.textpb): +# +# [Address] +# Address=fd00:179::1/128 +# +# [Address] +# Address=fd00:179::2/128 # AnyIP: the router answers ping for every address in the lab space. [Route] diff --git a/docs/lab/prod/on-router/README.md b/docs/lab/prod/on-router/README.md index 171ef24..a16e348 100644 --- a/docs/lab/prod/on-router/README.md +++ b/docs/lab/prod/on-router/README.md @@ -1,7 +1,6 @@ # Running ferrix_bgp on the production router -ferrix and BIRD run side by side on pr01 and peer over two loopback -addresses. Students reach the status page through a reverse proxy that adds +ferrix and BIRD run side by side on pr01 and peer over `::1`. Students reach the status page through a reverse proxy that adds TLS and a password. Nothing here has been run on the router; treat each step as something to check. @@ -24,10 +23,11 @@ Check the router really is x86-64 first (`uname -m`). install -m 0644 ferrix.textpb /etc/ferrix-bgp/ferrix.textpb install -m 0644 ferrix-bgp.service /etc/systemd/system/ferrix-bgp.service -## 3. Loopback addresses +## 3. Loopback -Merge `05-lab-lo.network` into the networkd file that matches `lo`, then -`networkctl reload` and confirm with `ip -6 addr show dev lo`. +Peering over `::1` needs no address setup. `05-lab-lo.network` only carries +the AnyIP route for the lab space; merge it into the networkd file that +matches `lo` if it is not there already, then `networkctl reload`. ## 4. BIRD diff --git a/docs/lab/prod/on-router/bird-ferrix-local.conf b/docs/lab/prod/on-router/bird-ferrix-local.conf index df56d83..45fb647 100644 --- a/docs/lab/prod/on-router/bird-ferrix-local.conf +++ b/docs/lab/prod/on-router/bird-ferrix-local.conf @@ -1,13 +1,18 @@ # Replaces "protocol bgp ferrix" in bird.conf when ferrix runs on this host. # Only the addresses and "multihop" differ from the WireGuard version; the # import filter and everything about export control stay as they are. +# +# Without "multihop" BIRD looks for the neighbour on a directly connected +# network, cannot find ::1 there, and disables the protocol with +# "Error: Invalid next hop". After fixing that, `birdc enable ferrix` if a +# reconfigure does not bring it back by itself. protocol bgp ferrix { description "ferrix_bgp teaching lab (announce only, same host)"; - local fd00:179::1 as 210036; - neighbor fd00:179::2 as FERRIX_ASN; - # Both ends are addresses of this machine, so there is no directly - # connected neighbour for "direct" to find. + local ::1 as 210036; + neighbor ::1 as FERRIX_ASN; + # Both ends are this machine, so there is no directly connected + # neighbour for "direct" (the eBGP default) to find. multihop; passive on; ipv6 { diff --git a/docs/lab/prod/on-router/ferrix.textpb b/docs/lab/prod/on-router/ferrix.textpb index fc47608..bb2cdd9 100644 --- a/docs/lab/prod/on-router/ferrix.textpb +++ b/docs/lab/prod/on-router/ferrix.textpb @@ -4,14 +4,13 @@ local_asn: 4200000001 # Unused in practice (BIRD is passive and we dial it), but a listener is # required. 179 belongs to BIRD, so take another port on our own address. -listen_endpoints { address: "fd00:179::2" port: 9179 } +listen_endpoints { address: "::1" port: 9179 } peers { name: "pr01-bird" - endpoint { address: "fd00:179::1" port: 179 } - # BIRD recognises its neighbour by source address. Both addresses live on - # this host, so say which one is ours. - local_address: "fd00:179::2" + endpoint { address: "::1" port: 179 } + # BIRD recognises its neighbour by source address, so pin ours. + local_address: "::1" remote_asn: 210036 hold_time_seconds: 90 }