Permalink
Cannot retrieve contributors at this time
Join GitHub today
GitHub is home to over 28 million developers working together to host and review code, manage projects, and build software together.
Sign up
Fetching contributors…
Cannot retrieve contributors at this time
| # $OpenBSD: bgpd.conf,v 1.15 2018/11/17 17:22:38 deraadt Exp $ | |
| # example bgpd configuration file, see bgpd.conf(5) | |
| # define our own ASN as a macro | |
| ASN="65001" | |
| # global configuration | |
| AS $ASN | |
| router-id 192.0.2.1 | |
| # list of networks that may be originated by our ASN | |
| prefix-set mynetworks { \ | |
| 192.0.2.0/24 \ | |
| 2001:db8:abcd::/48 \ | |
| } | |
| # define bogon prefixes which should not be part of the DFZ | |
| prefix-set bogons { | |
| 0.0.0.0/8 or-longer # 'this' network [RFC1122] | |
| 10.0.0.0/8 or-longer # private space [RFC1918] | |
| 100.64.0.0/10 or-longer # CGN Shared [RFC6598] | |
| 127.0.0.0/8 or-longer # localhost [RFC1122] | |
| 169.254.0.0/16 or-longer # link local [RFC3927] | |
| 172.16.0.0/12 or-longer # private space [RFC1918] | |
| 192.0.2.0/24 or-longer # TEST-NET-1 [RFC5737] | |
| 192.88.99.0/24 or-longer # 6to4 anycast relay [RFC7526] | |
| 192.168.0.0/16 or-longer # private space [RFC1918] | |
| 198.18.0.0/15 or-longer # benchmarking [RFC2544] | |
| 198.51.100.0/24 or-longer # TEST-NET-2 [RFC5737] | |
| 203.0.113.0/24 or-longer # TEST-NET-3 [RFC5737] | |
| 224.0.0.0/4 or-longer # multicast | |
| 240.0.0.0/4 or-longer # reserved for future use | |
| ::/8 or-longer # RFC 4291 IPv4-compatible, loopback, et al | |
| 0100::/64 or-longer # Discard-Only [RFC6666] | |
| 2001:2::/48 or-longer # BMWG [RFC5180] | |
| 2001:10::/28 or-longer # ORCHID [RFC4843] | |
| 2001:db8::/32 or-longer # docu range [RFC3849] | |
| 2002::/16 or-longer # 6to4 anycast relay [RFC7526] | |
| 3ffe::/16 or-longer # old 6bone | |
| fc00::/7 or-longer # unique local unicast | |
| fe80::/10 or-longer # link local unicast | |
| fec0::/10 or-longer # old site local unicast | |
| ff00::/8 or-longer # multicast | |
| } | |
| # Generate routes for the networks our ASN will originate. | |
| # The communities (read 'tags') are later used to match on what | |
| # is announced to EBGP neighbors | |
| network prefix-set mynetworks set large-community $ASN:1:1 | |
| # assume simple network with 3 routers in IBGP full mesh | |
| group "ibgp mesh v4" { | |
| remote-as $ASN | |
| # use loopback for IBGP sessions, assume its distributed in OSPF | |
| local-address 192.0.2.1 | |
| neighbor 192.0.2.2 # router 2 ipv4 | |
| neighbor 192.0.2.3 # router 3 ipv4 | |
| } | |
| # define the IPv6 IBGP sessions | |
| group "ibgp mesh v6" { | |
| remote-as $ASN | |
| local-address 2001:db8:abcd::1 | |
| neighbor 2001:db8:abcd::2 # router 2 ipv6 | |
| neighbor 2001:db8:abcd::3 # router 3 ipv6 | |
| } | |
| # upstream providers | |
| group "upstreams" { | |
| neighbor 203.0.113.1 { | |
| remote-as 65002 | |
| descr "IPv4 Transit Provider A" | |
| } | |
| neighbor 198.51.100.0 { | |
| remote-as 65123 | |
| descr "IPv4 Transit provider B" | |
| } | |
| neighbor 2001:db8:666::2 { | |
| remote-as 65123 | |
| descr "IPv6 Transit provider B" | |
| } | |
| } | |
| ## rules section | |
| # uncomment the following two lines to accept a default route from upstreams | |
| #allow from group upstreams prefix 0.0.0.0/0 | |
| #allow from group upstreams prefix ::/0 | |
| ### for simple BGP setups, no editing below this line is required ### | |
| # Outbound EBGP: only allow self originated networks to ebgp peers | |
| # Don't leak any routes from upstream or peering sessions. This is done | |
| # by checking for routes that are tagged with the large-community $ASN:1:1 | |
| allow to ebgp prefix-set mynetworks large-community $ASN:1:1 | |
| # deny more-specifics of our own originated prefixes | |
| deny quick from ebgp prefix-set mynetworks or-longer | |
| # IBGP: allow all updates to and from our IBGP neighbors | |
| allow from ibgp | |
| allow to ibgp | |
| # Scrub normal and large communities relevant to our ASN from EBGP neighbors | |
| # https://tools.ietf.org/html/rfc7454#section-11 | |
| match from ebgp set { community delete $ASN:* } | |
| match from ebgp set { large-community delete $ASN:*:* } | |
| # filter out prefixes longer than 24 or shorter than 8 bits for IPv4 | |
| # and longer than 48 or shorter than 16 bits for IPv6. | |
| allow from any inet prefixlen 8 - 24 | |
| allow from any inet6 prefixlen 16 - 48 | |
| # Honor requests to gracefully shutdown BGP sessions | |
| # https://tools.ietf.org/html/rfc8326 | |
| match from any community GRACEFUL_SHUTDOWN set { localpref 0 } | |
| deny quick from any prefix-set bogons | |
| # filter bogon AS numbers | |
| # AS_TRANS (23456) is not supposed to show up in any path and indicates a | |
| # missconfiguration. Additionally Private or Reserved ASNs have no place in | |
| # the public DFZ. http://www.iana.org/assignments/as-numbers/as-numbers.xhtml | |
| deny quick from any AS 23456 | |
| deny quick from any AS 64496 - 131071 | |
| deny quick from any AS 4200000000 - 4294967295 | |
| # filter out too long paths | |
| deny from any max-as-len 100 |