Peering

Introduction

Once all the necessary resources have been accepted into the DN42 Registry, you can begin to peer with neighbors. The process for this varies by peer, for example Kioubit provides an automated peering system, while Lan Tian communicates via email but uses the 1xRTT method to do so without extra delay. Other peers can be found on the IRC or via the Pingfinder. However, the technical setups are likely to share some similarities.

Wireguard

Usually, you will need to at least send a Wireguard public key, Wireguard endpoint including port, tunnel IPv4 address and optionally IPv6 ULA or link-local address, which server of theirs you would like to peer with, and your ASN. You can then set up your end of the tunnel, even if the peer has not responded, since both Wireguard and BGP will just keep trying to connect to the peer until it comes up. The below is an example VyOS configuration for the Kioubit VPN connection.

 address <random>/32
 address fe80::<asn>/128
 description "Example Network (AS424242XXXX)"
 peer us2 {
     address <public-ip>
     allowed-ips 0.0.0.0/0
     allowed-ips ::/0
     port 21878
     public-key <pubkey>
 }
 port 2XXXX
 private-key <redacted>

Note that the ASN is used in a couple places. Often, Wireguard ports are based on ASNs, so for example 2XXXX would mean 2 followed by the last 4 digits of their ASN. Meanwhile, the connection to the peer would use your ASN, such as in the above with port 21878. Peering with multiprotocol BGP is almost always preferred, and can be performed using a link-local IPv6 address, often in the format fe80::<asn> or similar, again using the last 4 digits of the target ASN. The IPv4 peer can actually be any random non-DN42 private address, since this will simply be used as a next-hop to reach the DN42 network. The IPv4 address typically requires a static route with a /32 scope to be configured, while using link-local addresses requires specifying the source address (but it also means that each Wireguard interface can use the same address).

 route <random>/32 {
     interface wgXXXX {
     }
 }

Then, the below BGP configuration sets up multiprotocol BGP (since both ipv4-unicast and ipv6-unicast are included) over the tunnel. Note that while the static IPv4 route is not used here, it will be included as the next-hop for all routes. ebgp-multihop is not required to bring up the BGP session, but all IPv4 routes will be marked inactive if it is left out, since there are multiple hops (when using non-DN42 addresses) to reach the peer over IPv4, unlike the link-local connection with IPv6.

 neighbor fe80::ade0 {
     address-family {
         ipv4-unicast {
         }
         ipv6-unicast {
         }
     }
     ebgp-multihop 10
     interface {
         source-interface wg3914
     }
     remote-as 4242423914
 }

Success!

Once you've joined the network, try exploring by visiting sites like wiki.dn42, burble.dn42, search.dn42, and others. Also, visit ca.dn42 to get the most used internal CA certificate.