-
Notifications
You must be signed in to change notification settings - Fork 0
Services
Besides the router itself, there are a few supporting services needed, mainly an RPKI cache server and a BGP Looking Glass. The former keeps an updated cache of RPKI public keys which can be used to verify ROA signatures, while the latter tracks BGP session information to provide a look into the status of BGP and all reachable neighbors. There aren't too many options in this area, but those that exist are relatively easy to use.
There are a couple good options for RPKI cache servers. First, Cloudflare's GoRTR is based on Go and is extremely lightweight, supporting large amounts of request, and it's very easy to configure. Another option is NLnet Labs' Routinator, which is also easy to set up and is written in Rust, making it similarly lightweight and fast.
On a Debian-based Linux server, download the .deb file from the latest release, and install it using sudo dpkg -i gortr_<version>_amd64.deb (it can also be installed from source using the instructions in the README). Then, edit the file at /etc/default/gortr, and set the GORTR_ARGS variable to -cache https://dn42.burble.com/roa/dn42_roa_46.json -verify false -checktime false. GoRTR can also be configured to listen on SSH if desired as a secure channel, or served over HTTPS.
GoRTR also exposes a Prometheus metrics endpoint on port 8080 at /metrics, if monitoring is necessary.
A popular and easy-to-use BGP looking glass is the Looking Glass project. This PHP-based web app uses SSH to log into the router and fetch BGP information. It can be set up in Docker and uses modern technologies like AJAX to remain responsive. Another option is the Python-based Hyperglass, which has better documentation and is slightly more actively maintained.