Rayhaan JaufeerallyandClaude Fable 5.1
22384d0b07
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
97 lines
3.8 KiB
Plaintext
97 lines
3.8 KiB
Plaintext
# BIRD 2.x / 3.x: peer the production router (AS210036) with ferrix_bgp over
|
|
# WireGuard. ferrix is announce-only: we accept the lab /48s from it and send
|
|
# it nothing.
|
|
#
|
|
# Include from bird.conf: include "/etc/bird/bird-ferrix.conf";
|
|
# Check and apply: birdc configure check && birdc configure
|
|
# Inspect: birdc show protocols all ferrix
|
|
# birdc show route protocol ferrix all
|
|
|
|
define FERRIX_ASN = 4200000001;
|
|
define LAB_PREFIXES = [ 2a0d:d741::/40{48,48} ];
|
|
|
|
filter ferrix_import
|
|
{
|
|
# Only the students' /48s, nothing shorter or longer, nothing else.
|
|
if !(net ~ LAB_PREFIXES) then reject;
|
|
|
|
# ferrix allows at most 16 prepends on top of its own ASN.
|
|
if bgp_path.len > 17 then reject;
|
|
if bgp_path.first != FERRIX_ASN then reject;
|
|
|
|
# Students type communities freely into a web form with no login, so
|
|
# only namespaces we have chosen to expose get through.
|
|
#
|
|
# Standard: just the two well-known ones BIRD itself honours, so
|
|
# NO_EXPORT / NO_ADVERTISE visibly work. Notably BLACKHOLE (65535:666),
|
|
# which SwissIX acts on, stays scrubbed.
|
|
bgp_community.filter([ (65535, 65281), (65535, 65282) ]);
|
|
|
|
# Large: the SwissIX route-server action communities, all of which live
|
|
# under their route-server ASN 42476
|
|
# (https://www.swissix.ch/resources/action-bgp-communities/):
|
|
# 42476:0:<peer-as> do not redistribute to peer 42476:0:0 to nobody
|
|
# 42476:1:<peer-as> redistribute to peer 42476:1:0 to all
|
|
# 42476:101|102|103:<peer-as or 0> prepend 1x / 2x / 3x
|
|
# 42476:901|902:<peer-as> add NO_EXPORT / NO_ADVERTISE
|
|
# Everything else is dropped, including our own (210036, *, *) space so
|
|
# students cannot trigger anything this network acts on internally. Add
|
|
# further namespaces here deliberately.
|
|
bgp_large_community.filter([ (42476, *, *) ]);
|
|
|
|
bgp_ext_community.empty;
|
|
|
|
# Announce-only: there is nothing behind these prefixes. Do not forward
|
|
# their traffic into the tunnel; answer with "unreachable" instead.
|
|
dest = RTD_UNREACHABLE;
|
|
|
|
accept;
|
|
}
|
|
|
|
protocol bgp ferrix
|
|
{
|
|
description "ferrix_bgp teaching lab (announce only)";
|
|
local 2a0d:d747:1::1 as 210036;
|
|
neighbor 2a0d:d747:1:: as FERRIX_ASN;
|
|
direct;
|
|
|
|
# ferrix dials us. Staying passive avoids log noise from failed attempts
|
|
# towards a laptop that is asleep or firewalled.
|
|
passive on;
|
|
|
|
# ferrix supports none of these; leave them off.
|
|
# password "..."; (TCP MD5)
|
|
# ttl security on; (GTSM)
|
|
# bfd on;
|
|
|
|
ipv6 {
|
|
import filter ferrix_import;
|
|
# 128 students, one /48 each. Extra routes are ignored, the session
|
|
# stays up.
|
|
import limit 130 action block;
|
|
# Send nothing: ferrix keeps received routes in memory and renders
|
|
# every one of them on its status page.
|
|
export none;
|
|
};
|
|
}
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Your upstream / IXP export filters must let these routes out, and must
|
|
# strip ferrix's private ASN so the origin seen by the Internet is AS210036,
|
|
# matching the route6 objects. Add, before the final reject of each such
|
|
# filter:
|
|
#
|
|
# if proto = "ferrix" then {
|
|
# bgp_path.delete([ 64512..65534, 4200000000..4294967294 ]);
|
|
# accept;
|
|
# }
|
|
#
|
|
# Consequence: AS-path prepends set by students are made of the private ASN
|
|
# and are stripped here too, so prepending in ferrix has no effect beyond
|
|
# this router. The SwissIX prepend communities (42476:101..103:*) do work:
|
|
# the route server prepends AS210036 itself.
|
|
#
|
|
# The session towards the SwissIX route servers must also send large
|
|
# communities unmodified; check that its export filter does not clear them.
|
|
# ---------------------------------------------------------------------------
|