ROA
Route Origin Authorization (ROA) is a method used to verify that routes are originating from the correct DN42 ASN, so that other members cannot take over those routes. The first stage of setting up ROA was adding route and route6 objects to the DN42 Registry, but to verify these an RTR server or RPKI cache is needed. RTR is the Resource Public Key Infrastructure (RPKI) to Router Protocol, which allows a BGP-enabled router to communicate with the RTR server in a standardized manner to validate route origins.
First, I set up a new LXC container in Proxmox, which can be thought of as halfway between a VM and a Docker container. Like a VM, it has a full systemd runtime with many background services, but it uses the same containerization features exposed by the Linux kernel as Docker, making it significantly more lightweight than any VM. The default options besides the name were mostly OK, though I decided to upload an SSH key to avoid setting a root password.
I also had to download an OS template from the Proxmox repositories by going to the local storage and clicking Templates. I chose to use Ubuntu Server 20.04, which is still well-supported and contains all the required packages for most applications.
Next, I left the container with the default 8GB root filesystem, which is plenty due to how lightweight containers are.
Similarly, the single CPU core should suffice for such a lightweight server.
512MB is plenty of memory for a lightweight server like this, realistically most applications running in a container will not need more anyway.
Similarly, most of the default network settings were correct, although I did change to DHCP to get an IP while setting up the server. Later, this server will get a static IP.
DNS is also a non-issue, and simply inherits from the host. This may also be changed later.
Lastly, I finalized the settings and chose to start the container after its creation, then hit Finish.
It took just a few seconds, and the container was created and then started, and accessible via SSH. I did not know its IP, but I found this by running pct enter on the Proxmox system, which creates a root session inside any container, then running ip addr.
My RTR server of choice was Cloudflare's GoRTR, as identified in the Capstone Design course.
I installed GoRTR simply by finding the latest .deb file on the releases page of their repository, then running wget to download it and dpkg -i gortr_0.14.7_amd64.deb to install it.
To configure GoRTR, edit the file at /etc/default/gortr. These environment variables are loaded by the GoRTR and passed to the command as arguments. Set GORTR_ARGS to the below:
GORTR_ARGS=-cache https://dn42.burble.com/roa/dn42_roa_46.json -checktime=false -verify=falseNote that the equal signs are required. There is another way to manually generate the list of DN42 route origin authorizations, but Burble helpfully provides a pre-compiled list at https://dn42.burble.com/roa/dn42_roa_46.json, which is compatible with GoRTR. The argument -checktime=false disables checking if the file is still valid, and -verify=false indicates that the list is not signed and no signature should be verified (the point of RPKI is to support public-key infrastructure signing of ROAs, however DN42 chooses to bypass this since the routes are generated from a registry which already requires authentication. It's also possible to set up GoRTR with TLS or SSH for transport security from the router, but due to the network segmentation and little worry of DDoS or other attacks, I opted not to enable this.
Then, run systemctl enable --now gortr to enable and start the cache. GoRTR will periodically (by default, every 7200 seconds) fetch an updated list to serve. GoRTR listens for HTTP requests on port 8282, so this should be opened in the firewall. There is also a Prometheus metrics endpoint at :8080/metrics. Run rtrdump -connect localhost:8282 -file debug.json to ensure GoRTR has started and loaded the cache.
As a side note, make sure the container is configured to autostart on boot in the Proxmox options.
