-
Notifications
You must be signed in to change notification settings - Fork 0
Capstone Implementation Weekly Reflection
This week, I made excellent progress, starting with formally joining the DN42 network. I completed the registration process, including reserving an ASN and IPv4 and IPv6 address space. I also began the process of setting up infrastructure, specifically provisioning the Supermicro server with Proxmox and deploying RTR servers onto it, which will enable the router to validate route origins to help prevent BGP route hijacking. There is still more work to be done on this front, including deploying the other services like DNS. I also identified several good starting peers with whom I can connect once the router is set up, but at this point I am blocked by not having access to the Protectli which I will install VyOS on, which will hopefully be resolved this coming week. I also do not know whether I will receive access to a public IP, which is essential to start sprint 2, when I will set up my first peer.
One of the major learnings this week was simply understanding how ROA actually works. Route Origin Authorization involves the use of a cache server which downloads route signatures (typically, this file contains signatures proving the ownership of individual netblocks by their associated ASNs, but DN42 has opted not to use that feature), then uses an RPKI to Router (RTR) server which consumes the database to allow the router to check incoming route advertisements and ensure they come from the correct ASN.
Minus a few hiccups getting Proxmox installed, primarily to do with the IPMI but also with bugs in Proxmox's ZFS install, I did not encounter any issues completing this week's tasks. As a result of not having access to the Protectli, I did shuffle around some objectives. Until the router is available, I will continue working on the supporting services, including DNS and an API to scrape the registry and build the RPKI database. Once it is available, these may be pushed back to accomodate for setting it up in preparation for peering. Regardless, sprint 1 is currently on track.