BGP Workshop - Revision history

R3boot at 15:48, 26 July 2024

2024-07-26T15:48:47Z

← Older revision		Revision as of 15:48, 26 July 2024
Line 1:		Line 1:
	Ever wondered how to use the protocol that binds the internet together? This workshop will help you understand the basics of BGP, by performing a number of tasks with BGP. The workshop is divided into two parts; In the first part, we will be building a demonstration network in which we will apply the basic configuration to get a working BGP network. Using this knowledge (and assuming you know how to configure point-to-point VPN tunnels), you can setup fully routed private networks that are vendor / device / OS agnostic. The second part of the workshop is optional, and will discuss some practical applications that are built on top of, namely Anycast and DDoS migitation using remotely triggered blackhole routing.		Ever wondered how to use the protocol that binds the internet together? This workshop will help you understand the basics of BGP, by performing a number of tasks with BGP. The workshop is divided into two parts; In the first part, we will be building a demonstration network in which we will apply the basic configuration to get a working BGP network. Using this knowledge (and assuming you know how to configure point-to-point VPN tunnels), you can setup fully routed private networks that are vendor / device / OS agnostic. The second part of the workshop is optional, and will discuss some practical applications that are built on top of, namely Anycast and DDoS migitation using remotely triggered blackhole routing.

	1) Basics		# Basics
	~~1.1)~~ Routing theory		## Routing theory
	~~1.2)~~ Setting up a peering		## Setting up a peering
	~~1.3) Route leaks~~		## Filtering
	~~1.4)~~ Aggregation		## Aggregation
	~~1.5)~~ Hijacking		## Hijacking

	2) Advanced		# Advanced
	~~2.1)~~ Anycast		## Anycast
	~~2.2)~~ DDoS migitation		## DDoS migitation

	Assumed is that you have an understanding of Linux and the basics of networking (what is an ip, what is a subnet, what is a router, what is a switch). While the workshop is designed around Linux/BIRD, the concepts that we will be working with apply to all devices that are able to talk, configure policies/access lists and can speak BGP, or most other routing protocols.		Assumed is that you have an understanding of Linux and the basics of networking (what is an ip, what is a subnet, what is a router, what is a switch). While the workshop is designed around Linux/BIRD, the concepts that we will be working with apply to all devices that are able to talk, configure policies/access lists and can speak BGP, or most other routing protocols.
Line 157:		Line 157:


	== 1.4) ~~BGP hijacking~~ ==		== 1.4) Hijacking ==

	Configure an extra dummy interface that is configured with an IP address belonging to some peer:		Configure an extra dummy interface that is configured with an IP address belonging to some peer:

R3boot at 15:46, 26 July 2024

2024-07-26T15:46:12Z

← Older revision		Revision as of 15:46, 26 July 2024
Line 1:		Line 1:
	Ever wondered how to use the protocol that binds the internet together? This workshop will help you understand the basics of BGP, by performing a number of tasks with BGP on a ~~small~~-~~scale~~. We will ~~work with the following subjects:~~		Ever wondered how to use the protocol that binds the internet together? This workshop will help you understand the basics of BGP, by performing a number of tasks with BGP. The workshop is divided into two parts; In the first part, we will be building a demonstration network in which we will apply the basic configuration to get a working BGP network. Using this knowledge (and assuming you know how to configure point-to-point VPN tunnels), you can setup fully routed private networks that are vendor / device / OS agnostic. The second part of the workshop is optional, and will discuss some practical applications that are built on top of, namely Anycast and DDoS migitation using remotely triggered blackhole routing.

	* Routing theory		1) Basics
	* Setting up a peering		1.1) Routing theory
	* Route leaks		1.2) Setting up a peering
	* Aggregation		1.3) Route leaks
	* Hijacking		1.4) Aggregation
	* Anycast		1.5) Hijacking
	* DDoS migitation ~~(s/RTBH)~~
			2) Advanced
			2.1) Anycast
			2.2) DDoS migitation

	Assumed is that you have an understanding of Linux and the basics of networking (what is an ip, what is a subnet, what is a router, what is a switch). While the workshop is designed around Linux/BIRD, the concepts that we will be working with apply to all devices that are able to talk, configure policies/access lists and can speak BGP, or most other routing protocols.		Assumed is that you have an understanding of Linux and the basics of networking (what is an ip, what is a subnet, what is a router, what is a switch). While the workshop is designed around Linux/BIRD, the concepts that we will be working with apply to all devices that are able to talk, configure policies/access lists and can speak BGP, or most other routing protocols.

	== Expectations ==		== Expectations ==
	This workshop will NOT be about internet routing. It will discuss the BGP protocol using a bunch of examples that can be applied to anything that runs BGP. These techniques can be applied on your LAN and over VPN tunnels. The workshop is divided into two parts; In the first part, we will be building a demonstration network in which we will apply the basic configuration to get a working BGP network. Using this knowledge (and assuming you know how to configure point-to-point VPN tunnels), you can setup fully routed private networks that are vendor / device / OS agnostic. The second part of the workshop is optional, and will discuss some practical applications that are built on top of, namely Anycast and DDoS migitation using remotely triggered blackhole routing.		This workshop will NOT be about internet routing. It will discuss the BGP protocol using a bunch of examples that can be applied to anything that runs BGP. These techniques can be applied on your LAN and over VPN tunnels.

	== Requirements ==		== Requirements ==

R3boot at 15:43, 26 July 2024

2024-07-26T15:43:48Z

← Older revision		Revision as of 15:43, 26 July 2024
Line 1:		Line 1:
	~~= Introduction =~~
	Ever wondered how to use the protocol that binds the internet together? This workshop will help you understand the basics of BGP, by performing a number of tasks with BGP on a small-scale. We will work with the following subjects:		Ever wondered how to use the protocol that binds the internet together? This workshop will help you understand the basics of BGP, by performing a number of tasks with BGP on a small-scale. We will work with the following subjects:

Line 10:		Line 9:
	* DDoS migitation (s/RTBH)		* DDoS migitation (s/RTBH)

	Assumed is that you have an understanding of Linux and the basics of networking (what is an ip, what is a subnet, what is a router, what is a switch).		Assumed is that you have an understanding of Linux and the basics of networking (what is an ip, what is a subnet, what is a router, what is a switch). While the workshop is designed around Linux/BIRD, the concepts that we will be working with apply to all devices that are able to talk, configure policies/access lists and can speak BGP, or most other routing protocols.

	== Expectations ==		== Expectations ==
	This workshop will NOT be about internet routing. It will discuss the BGP protocol using a bunch of examples that can be applied to anything that runs BGP. These techniques can be applied on your LAN and over VPN tunnels.		This workshop will NOT be about internet routing. It will discuss the BGP protocol using a bunch of examples that can be applied to anything that runs BGP. These techniques can be applied on your LAN and over VPN tunnels. The workshop is divided into two parts; In the first part, we will be building a demonstration network in which we will apply the basic configuration to get a working BGP network. Using this knowledge (and assuming you know how to configure point-to-point VPN tunnels), you can setup fully routed private networks that are vendor / device / OS agnostic. The second part of the workshop is optional, and will discuss some practical applications that are built on top of, namely Anycast and DDoS migitation using remotely triggered blackhole routing.

	== Requirements ==		== Requirements ==

R3boot at 15:36, 26 July 2024

2024-07-26T15:36:30Z

← Older revision		Revision as of 15:36, 26 July 2024
Line 86:		Line 86:
	192.168.1.0/24 dev dummy1 proto bird scope link metric 32		192.168.1.0/24 dev dummy1 proto bird scope link metric 32

	= Basic BGP operations =		= 1) Basic BGP operations =

	== Setting up your first BGP peering(s) ==		== 1.1) Setting up your first BGP peering(s) ==

	For each participant you want to setup a peering for, configure a block like below. Replace X.X.X.X and AAAAA with your own details. Replace Y.Y.Y.Y and BBBBB with the details that are used by your peer. Add a descriptive name for PEERNAME.		For each participant you want to setup a peering for, configure a block like below. Replace X.X.X.X and AAAAA with your own details. Replace Y.Y.Y.Y and BBBBB with the details that are used by your peer. Add a descriptive name for PEERNAME.
Line 110:		Line 110:
	ip route show protocol bird		ip route show protocol bird

	== Filtering ==		== 1.2) Filtering ==

	Modify the configuration and add an export filter for each peer.		Modify the configuration and add an export filter for each peer.
Line 137:		Line 137:
	ip route show protocol bird		ip route show protocol bird

	== Aggregation ==		== 1.3) Aggregation ==

	Setup a static route which contains both your subnets. Configure the subnet to send host unreachables whenever an ip does not respond to ARP requests.		Setup a static route which contains both your subnets. Configure the subnet to send host unreachables whenever an ip does not respond to ARP requests.
Line 155:		Line 155:


	== BGP hijacking ==		== 1.4) BGP hijacking ==

	Configure an extra dummy interface that is configured with an IP address belonging to some peer:		Configure an extra dummy interface that is configured with an IP address belonging to some peer:
Line 179:		Line 179:
	ip route show protocol bgp		ip route show protocol bgp

	=== Preventing BGP hijacking ===		=== 1.4.1) Preventing BGP hijacking ===

	Modify the import filter for your peer to only accept prefixes that belong to your peer, and use this filter to select routes imported from your peer:		Modify the import filter for your peer to only accept prefixes that belong to your peer, and use this filter to select routes imported from your peer:
Line 208:		Line 208:
	ip link del dummy2		ip link del dummy2

	= Advanced BGP tricks =		= 2) Advanced BGP tricks =

	== BGP Anycast ==		== 2.1) BGP Anycast ==

	Configure a loopback interface for your service		Configure a loopback interface for your service
Line 240:		Line 240:
	ip link del dummy2		ip link del dummy2

	== DDoS migitation using s/RTBH ==		== 2.2) DDoS migitation using s/RTBH ==

	Modify your export filter(s) so that a BGP community gets added whenever BIRD finds a single ip address belonging to your ip space:		Modify your export filter(s) so that a BGP community gets added whenever BIRD finds a single ip address belonging to your ip space:

R3boot: /* Load and check setup */

2024-07-26T15:34:03Z

Load and check setup

← Older revision		Revision as of 15:34, 26 July 2024
Line 81:		Line 81:


	Doublecheck that BIRD is exporting routes to the kernel using `ip route show protocol bird`. It should look like the following:		Doublecheck that BIRD is exporting routes to the kernel using '''ip route show protocol bird'''. It should look like the following:

	192.168.0.0/24 dev dummy0 proto bird scope link metric 32		192.168.0.0/24 dev dummy0 proto bird scope link metric 32
	192.168.1.0/24 dev dummy1 proto bird scope link metric 32		192.168.1.0/24 dev dummy1 proto bird scope link metric 32


	= Basic BGP operations =		= Basic BGP operations =

R3boot: /* Registration */

2024-07-26T15:32:11Z

Registration

← Older revision		Revision as of 15:32, 26 July 2024
Line 23:		Line 23:

	== Registration ==		== Registration ==
	Every participant of the workshop needs their own AS number and a prefix. Either add your details to the sheet below, or ask [User:R3boot\|r3boot] to add you.		Every participant of the workshop needs their own AS number and a prefix. Either add your details to the sheet below, or ask [[User:R3boot\|r3boot]] to add you.

	https://docs.nurd.space/sheet/#/2/sheet/edit/IacR4-gLFoetuyrli3JBhIMB/		https://docs.nurd.space/sheet/#/2/sheet/edit/IacR4-gLFoetuyrli3JBhIMB/

R3boot at 15:31, 26 July 2024

2024-07-26T15:31:57Z

← Older revision		Revision as of 15:31, 26 July 2024
Line 23:		Line 23:

	== Registration ==		== Registration ==
	Every participant of the workshop ~~will receive a temporarily and private~~ AS number and ~~two private networks~~. ~~During the workshop, we will create an "Internet" with these~~ details~~. In order~~ to ~~register~~, ~~ping~~ r3boot ~~on IRC or send an email~~ to ~~r3boot at r3blog dot nl, and I will~~ add you ~~to the list below:~~		Every participant of the workshop needs their own AS number and a prefix. Either add your details to the sheet below, or ask [User:R3boot\|r3boot] to add you.

	https://docs.nurd.space/sheet/#/2/sheet/edit/IacR4-gLFoetuyrli3JBhIMB/		https://docs.nurd.space/sheet/#/2/sheet/edit/IacR4-gLFoetuyrli3JBhIMB/

R3boot at 15:09, 26 July 2024

2024-07-26T15:09:47Z

Show changes

R3boot at 11:25, 26 July 2024

2024-07-26T11:25:34Z

← Older revision		Revision as of 11:25, 26 July 2024
Line 54:		Line 54:
	\| 192.168.5.0/24		\| 192.168.5.0/24
	\|-		\|-
			\| r3boot
			\|
			\| 65003
			\| 192.168.6.0/23
			\| 192.168.6.0/24
			\| 192.168.7.0/24
	\|}		\|}

	=== Router requirements ===		=== Router requirements ===
	TBA		TBA

R3boot at 07:28, 22 July 2024

2024-07-22T07:28:17Z

@@ Line 39: / Line 39: @@
 | 192.168.0.0/24
 | 192.168.1.0/24
 |-
 |}