ferrix/docs/content/docs/getting-started/introduction.md

+++ title = "Ferrix Overview" description = "Describes Ferrix, its capabilities, its current limitations, and the structure of its source code." weight = 1

[extra] nav = "Overview" +++

Ferrix is a Border Gateway Protocol (BGP) daemon for Linux routers at the edge of a network. It establishes BGP sessions with transit providers, peers, Internet exchange route servers, and customers, and it installs the best path for each prefix in the Linux kernel. Ferrix is written in Rust and contains no unsafe code.

Ferrix applies the standard inbound route filters to every external neighbor by default: bogon prefixes and AS numbers, overly specific prefixes, long AS paths, third-party next hops, and the local router's own prefixes. Route origin validation, ASPA verification, and BGP roles each require one configuration statement. See Comparison with the NLNOG BGP Filter Guide.

The daemon is a single binary, bgp. It contains the BGP speaker, the RPKI-to-Router (RTR) client, the kernel route installer, and an HTTP status interface.

Features

Ferrix provides the following capabilities:

• Import policy. Ferrix validates every route that a neighbor advertises before the route enters the routing table. By default, it rejects bogon prefixes and AS numbers, routes whose next hop is not the advertising neighbor, and routes for prefixes that the local router originates. You can configure per-neighbor prefix lists, origin AS lists, and prefix limits. See Import Policy.
• RPKI validation. Ferrix performs route origin validation (ROV) and AS path verification with Autonomous System Provider Authorization (ASPA) data received over RTR. See RPKI.
• Route leak prevention. Ferrix implements BGP roles and the Only to Customer (OTC) attribute (RFC 9234). See BGP Roles.
• Kernel route installation. On Linux, Ferrix installs the active route for each prefix in the kernel routing table over netlink. Routes with an unresolvable next hop are excluded from best path selection. See Kernel Route Installation.
• Route advertisement. Ferrix advertises the routes that it originates to all neighbors. It can also advertise learned routes, subject to BGP roles, communities, and export policy. See Route Advertisement.
• Monitoring. Ferrix provides a status page, a JSON API, a server-sent event stream, and Prometheus metrics. See Monitoring Ferrix.

Release Status

Important

Ferrix 0.1.0 is the first release. It has not been deployed in a production network. Ferrix is tested against FRR, BIRD, and Routinator in an automated interoperability lab and against real Linux kernels.

Ferrix 0.1.0 does not support the following features:

• Route reflection, per-client best path selection for route servers, and ADD-PATH for advertised routes.
• TCP Authentication Option (TCP-AO), TCP MD5 signatures, and the Generalized TTL Security Mechanism (GTSM).
• Graceful restart, Bidirectional Forwarding Detection (BFD), and configuration changes without a restart.
• Recursive resolution of next hops that are not directly connected.

For the implementation status of each RFC, see Supported Standards.

Source Code Organization

The Ferrix source code is a Cargo workspace. Table 1 lists its crates.

Crate	Contents
crates/primitives	Prefixes, address families, and parsing utilities
crates/packet	BGP message encoding and decoding
crates/rib	The routing table, best path selection, and the change journal
crates/rpki	The RTR client, route origin validation, and ASPA verification
crates/fib	Kernel route installation over netlink
crates/server	Session management, the BGP finite state machine, policy, and configuration
crates/web	The status page, HTTP API, and metrics
bin/bgp	The daemon

For a description of how these components interact, see Architecture Overview.

License

Ferrix is licensed under the Apache License 2.0. The source code is available at git.rayhaan.net/rayhaan/ferrix.