ホーム エクスプローラ ヘルプ
サインイン
mark22k
/
dn42-wiki
同期ミラー https://codeberg.org/mark22k/dn42-wiki.git
Watch 1
Star 0
Fork 0
ファイル 課題 0 Wiki
ブランチ: pages
ブランチ タグ
dn42-wiki
/
howto
/
vyos1.4.x.html

vyos1.4.x.html 38 KB
パーマリンク 履歴 Raw

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549 
  1. <!DOCTYPE html>
    2. 

  2. <html lang="en">
    3. 

  3.     <head>
    4. 

  4. <meta charset="UTF-8">
    5. 

  5. 

  6. 

  7. 

  8. <title>VyOS 1.4.x sagitta | dn42 wiki</title>
    9. 

  9. 

  10. <meta name="viewport" content="width=device-width, initial-scale=1.0">
    11. 

  11. <meta name="robots" content="index, follow">
    12. 

  12. <meta name="keywords" content="dn42,wiki,routing,bgp">
    13. 

  13. 

  14. <link rel="canonical" href="https://dn42.obl.ong/howto/vyos1.4.x.html">
    15. 

  15. <link rel="icon" type="image/x-icon" href="/favicon.ico">
    16. 

  16. <link rel="shortcut icon" type="image/x-icon" href="/favicon.ico">
    17. 

  17. 

  18. <link rel="author" type="text/html" href="/docs/people">
    19. 

  19. 

  20. <link rel="stylesheet" href="/css/normalize.css">
    21. 

  21. <link rel="stylesheet" href="/css/simple.min.css">
    22. 

  22. <link rel="stylesheet" href="/css/style.css">
    23. 

  23. <link rel="stylesheet" href="/css/menu.css">
    24. 

  24. 

  25. 

  26. </head>
    27. 

  27.     
    28. 

  28.     <body>
    29. 

  29. 

  30.         <header>
    31. 

  31. 

  32. 

  33. <b>dn42 wiki / VyOS 1.4.x sagitta</b>
    34. 

  34. 

  35. <div id="dn42_header">
    36. 

  36.     
    37. 

  37.     <p><a href="/"><img src="/dn42.png" alt="dn42" /></a></p>
    38. 

  38. 

  39. </div>
    40. 

  40. </header>
    41. 

  41. 

  42.         <main>
    43. 

  43.             <h1 id="vyos-14x-sagitta">VyOS 1.4.x sagitta</h1>
    44. 

  44. <p>VyOS is an open source software router.  It is feature rich and supports multiple deployment options such as physical hardware (Old PC’s) or a VPC/VM.  The developers have a nightly rolling release that includes all the latest features such as Wireguard.</p>
    45. 

  45. 

  46. <p>It can be downloaded here <a href="https://www.vyos.io/rolling-release/">https://www.vyos.io/rolling-release/</a>.</p>
    47. 

  47. 

  48. <h2 id="firewall-baseline">Firewall Baseline</h2>
    49. 

  49. <p>We will configure firewall access lists for inbound connections on our peer Wireguard interfaces as well as block all inbound connections to our router with the exception of BGP.  This should be a good baseline firewall ruleset to filter inbound traffic on your network’s edge.  Modifications may be needed depending on your specific goals.  If your router has an uplink back to a larger internal network (outside of DN42), an outbound firewall ruleset will need to be applied to that interface.</p>
    50. 

  50. 

  51. <p>By default, VyOS is a <strong>stateless</strong> firewall.  To enable <strong>stateful</strong> packet inspection globally enter the following commands.</p>
    52. 

  52. <div class="language-sh highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="nb">set </span>firewall state-policy established action <span class="s1">'accept'</span>
    53. 

  53. <span class="nb">set </span>firewall state-policy related action <span class="s1">'accept'</span>
    54. 

  54. </code></pre></div></div>
    55. 

  55. 

  56. <p>We also need to accept invalids on our network’s edge.  However, this should not become common practice elsewhere.</p>
    57. 

  57. <div class="language-sh highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="nb">set </span>firewall state-policy invalid action <span class="s1">'accept'</span>
    58. 

  58. </code></pre></div></div>
    59. 

  59. 

  60. <p>The below commands create <strong>in</strong> and <strong>local</strong> baseline templates to be applied to all Wireguard interfaces that are facing peers.  In this example, <strong>172.20.20.0/24</strong> and <strong>fd88:9deb:a69e::/48</strong> are your assigned address spaces.</p>
    61. 

  61. <div class="language-sh highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="c">#Create Groups v4</span>
    62. 

  62. <span class="nb">set </span>firewall group network-group Allowed-Transit-v4 network <span class="s1">'10.0.0.0/8'</span>
    63. 

  63. <span class="nb">set </span>firewall group network-group Allowed-Transit-v4 network <span class="s1">'172.20.0.0/14'</span>
    64. 

  64. <span class="nb">set </span>firewall group network-group Allowed-Transit-v4 network <span class="s1">'172.31.0.0/16'</span>
    65. 

  65. 

  66. <span class="nb">set </span>firewall group network-group My-Assigned-Space-v4 network <span class="s1">'172.20.20.0/24'</span>
    67. 

  67. 

  68. <span class="c">#Create Groups v6</span>
    69. 

  69. <span class="nb">set </span>firewall group ipv6-network-group Allowed-Transit-v6 network <span class="s1">'fd00::/8'</span>
    70. 

  70. 

  71. <span class="nb">set </span>firewall group ipv6-network-group My-Assigned-Space-v6 network <span class="s1">'fd88:9deb:a69e::/48'</span>
    72. 

  72. 

  73. 

  74. <span class="c">#Inbound Connections v4</span>
    75. 

  75. <span class="nb">set </span>firewall name Tunnels_In_v4 default-action <span class="s1">'drop'</span>
    76. 

  76. <span class="nb">set </span>firewall name Tunnels_In_v4 enable-default-log
    77. 

  77. <span class="nb">set </span>firewall name Tunnels_In_v4 rule 68 action <span class="s1">'drop'</span>
    78. 

  78. <span class="nb">set </span>firewall name Tunnels_In_v4 rule 68 description <span class="s1">'Block Traffic to Operator Assigned IP Space'</span>
    79. 

  79. <span class="nb">set </span>firewall name Tunnels_In_v4 rule 68 destination group network-group <span class="s1">'My-Assigned-Space-v4'</span>
    80. 

  80. <span class="nb">set </span>firewall name Tunnels_In_v4 rule 68 log <span class="s1">'enable'</span>
    81. 

  81. <span class="nb">set </span>firewall name Tunnels_In_v4 rule 68 action <span class="s1">'drop'</span>
    82. 

  82. <span class="nb">set </span>firewall name Tunnels_In_v4 rule 70 action <span class="s1">'accept'</span>
    83. 

  83. <span class="nb">set </span>firewall name Tunnels_In_v4 rule 70 description <span class="s1">'Allow Peer Transit'</span>
    84. 

  84. <span class="nb">set </span>firewall name Tunnels_In_v4 rule 70 destination group network-group <span class="s1">'Allowed-Transit-v4'</span>
    85. 

  85. <span class="nb">set </span>firewall name Tunnels_In_v4 rule 70 <span class="nb">source </span>group network-group <span class="s1">'Allowed-Transit-v4'</span>
    86. 

  86. <span class="nb">set </span>firewall name Tunnels_In_v4 rule 70 log <span class="s1">'enable'</span>
    87. 

  87. <span class="nb">set </span>firewall name Tunnels_In_v4 rule 99 action <span class="s1">'drop'</span>
    88. 

  88. <span class="nb">set </span>firewall name Tunnels_In_v4 rule 99 description <span class="s1">'Black Hole'</span>
    89. 

  89. <span class="nb">set </span>firewall name Tunnels_In_v4 rule 99 log <span class="s1">'enable'</span>
    90. 

  90. 

  91. <span class="c">#Inbound Connections v6</span>
    92. 

  92. <span class="nb">set </span>firewall ipv6-name Tunnels_In_v6 default-action <span class="s1">'drop'</span>
    93. 

  93. <span class="nb">set </span>firewall ipv6-name Tunnels_In_v6 enable-default-log
    94. 

  94. <span class="nb">set </span>firewall ipv6-name Tunnels_In_v6 rule 68 action <span class="s1">'drop'</span>
    95. 

  95. <span class="nb">set </span>firewall ipv6-name Tunnels_In_v6 rule 68 description <span class="s1">'Block Traffic to Operator Assigned IP Space'</span>
    96. 

  96. <span class="nb">set </span>firewall ipv6-name Tunnels_In_v6 rule 68 destination group network-group <span class="s1">'My-Assigned-Space-v6'</span>
    97. 

  97. <span class="nb">set </span>firewall ipv6-name Tunnels_In_v6 rule 68 log <span class="s1">'enable'</span>
    98. 

  98. <span class="nb">set </span>firewall ipv6-name Tunnels_In_v6 rule 70 action <span class="s1">'accept'</span>
    99. 

  99. <span class="nb">set </span>firewall ipv6-name Tunnels_In_v6 rule 70 description <span class="s1">'Allow Peer Transit'</span>
    100. 

  100. <span class="nb">set </span>firewall ipv6-name Tunnels_In_v6 rule 70 destination group network-group <span class="s1">'Allowed-Transit-v6'</span>
    101. 

  101. <span class="nb">set </span>firewall ipv6-name Tunnels_In_v6 rule 70 log <span class="s1">'enable'</span>
    102. 

  102. <span class="nb">set </span>firewall ipv6-name Tunnels_In_v6 rule 70 <span class="nb">source </span>group network-group <span class="s1">'Allowed-Transit-v6'</span>
    103. 

  103. <span class="nb">set </span>firewall ipv6-name Tunnels_In_v6 rule 99 action <span class="s1">'drop'</span>
    104. 

  104. <span class="nb">set </span>firewall ipv6-name Tunnels_In_v6 rule 99 description <span class="s1">'Black Hole'</span>
    105. 

  105. <span class="nb">set </span>firewall ipv6-name Tunnels_In_v6 rule 99 log <span class="s1">'enable'</span>
    106. 

  106. 

  107. <span class="c">#Local Connections v4</span>
    108. 

  108. <span class="nb">set </span>firewall name Tunnels_Local_v4 default-action <span class="s1">'drop'</span>
    109. 

  109. <span class="nb">set </span>firewall name Tunnels_Local_v4 rule 50 action <span class="s1">'accept'</span>
    110. 

  110. <span class="nb">set </span>firewall name Tunnels_Local_v4 rule 50 icmp
    111. 

  111. <span class="nb">set </span>firewall name Tunnels_Local_v4 rule 50 protocol <span class="s1">'icmp'</span>
    112. 

  112. <span class="nb">set </span>firewall name Tunnels_Local_v4 rule 61 action <span class="s1">'accept'</span>
    113. 

  113. <span class="nb">set </span>firewall name Tunnels_Local_v4 rule 61 description <span class="s1">'Allow BGP'</span>
    114. 

  114. <span class="nb">set </span>firewall name Tunnels_Local_v4 rule 61 destination port <span class="s1">'179'</span>
    115. 

  115. <span class="nb">set </span>firewall name Tunnels_Local_v4 rule 61 protocol <span class="s1">'tcp'</span>
    116. 

  116. <span class="nb">set </span>firewall name Tunnels_Local_v4 rule 98 action <span class="s1">'drop'</span>
    117. 

  117. <span class="nb">set </span>firewall name Tunnels_Local_v4 rule 98 description <span class="s1">'Black Hole'</span>
    118. 

  118. <span class="nb">set </span>firewall name Tunnels_Local_v4 rule 98 log <span class="s1">'enable'</span>
    119. 

  119. <span class="nb">set </span>firewall name Tunnels_Local_v4 rule 98 state invalid <span class="s1">'enable'</span>
    120. 

  120. <span class="nb">set </span>firewall name Tunnels_Local_v4 rule 99 action <span class="s1">'drop'</span>
    121. 

  121. <span class="nb">set </span>firewall name Tunnels_Local_v4 rule 99 description <span class="s1">'Black Hole'</span>
    122. 

  122. <span class="nb">set </span>firewall name Tunnels_Local_v4 rule 99 log <span class="s1">'enable'</span>
    123. 

  123. 

  124. <span class="c">#Local Connections v6</span>
    125. 

  125. <span class="nb">set </span>firewall ipv6-name Tunnels_Local_v6 default-action <span class="s1">'drop'</span>
    126. 

  126. <span class="nb">set </span>firewall ipv6-name Tunnels_Local_v6 rule 50 action <span class="s1">'accept'</span>
    127. 

  127. <span class="nb">set </span>firewall ipv6-name Tunnels_Local_v6 rule 50 icmpv6
    128. 

  128. <span class="nb">set </span>firewall ipv6-name Tunnels_Local_v6 rule 50 protocol <span class="s1">'ipv6-icmp'</span>
    129. 

  129. <span class="nb">set </span>firewall ipv6-name Tunnels_Local_v6 rule 61 action <span class="s1">'accept'</span>
    130. 

  130. <span class="nb">set </span>firewall ipv6-name Tunnels_Local_v6 rule 61 description <span class="s1">'Allow BGP'</span>
    131. 

  131. <span class="nb">set </span>firewall ipv6-name Tunnels_Local_v6 rule 61 destination port <span class="s1">'179'</span>
    132. 

  132. <span class="nb">set </span>firewall ipv6-name Tunnels_Local_v6 rule 61 protocol <span class="s1">'tcp'</span>
    133. 

  133. <span class="nb">set </span>firewall ipv6-name Tunnels_Local_v6 rule 98 action <span class="s1">'drop'</span>
    134. 

  134. <span class="nb">set </span>firewall ipv6-name Tunnels_Local_v6 rule 98 description <span class="s1">'Black Hole'</span>
    135. 

  135. <span class="nb">set </span>firewall ipv6-name Tunnels_Local_v6 rule 98 log <span class="s1">'enable'</span>
    136. 

  136. <span class="nb">set </span>firewall ipv6-name Tunnels_Local_v6 rule 98 state invalid <span class="s1">'enable'</span>
    137. 

  137. <span class="nb">set </span>firewall ipv6-name Tunnels_Local_v6 rule 99 action <span class="s1">'drop'</span>
    138. 

  138. <span class="nb">set </span>firewall ipv6-name Tunnels_Local_v6 rule 99 description <span class="s1">'Black Hole'</span>
    139. 

  139. <span class="nb">set </span>firewall ipv6-name Tunnels_Local_v6 rule 99 log <span class="s1">'enable'</span>
    140. 

  140. </code></pre></div></div>
    141. 

  141. 

  142. <h2 id="wireguard">Wireguard</h2>
    143. 

  143. <h3 id="setup-keys">Setup Keys</h3>
    144. 

  144. <p>You can choose to generate a unique keypair and use it for every wireguard peering, or you can choose to generate a different one for each new peering.</p>
    145. 

  145. <div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>generate pki wireguard key-pair
    146. 

  146. 

  147. #Output example:
    148. 

  148. Private key: SOoPQdMdmXE3ssp0/vwwoIMhQqvcQls+DhDjmaLw03U=
    149. 

  149. Public key: ArkXeK1c0pCWCouePcRRBCQpXfi4ZIvRFFwTxO60dxs=
    150. 

  150. </code></pre></div></div>
    151. 

  151. 

  152. <p>If you choose to generate unique keypairs for peerings, you can generate and install the keypair in a single command. Note that you have to be in <code class="language-plaintext highlighter-rouge">configure</code> mode, at the top level, as shown below:</p>
    153. 

  153. <div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>vyos@vyos$ configure
    154. 

  154. 

  155. [edit]
    156. 

  156. vyos@vyos# run generate pki wireguard key-pair install interface wg4242424242
    157. 

  157. 1 value(s) installed. Use "compare" to see the pending changes, and "commit" to apply.
    158. 

  158. Corresponding public-key to use on peer system is: 'UcqcZsJvq1MlYgo3gObjaJ8FH+N7wkfV+EH3YDAMyRE='
    159. 

  159. [edit]
    160. 

  160. vyos@vyos-home# show interfaces wireguard wg4242424242 
    161. 

  161. +private-key kHCqfe/GZ8phoNnWfkL3+joXi/qK3ZfdfAnlNuX/9FU=
    162. 

  162. </code></pre></div></div>
    163. 

  163. 

  164. <p>To retrieve keys later, use the op-mode command <code class="language-plaintext highlighter-rouge">show interfaces wireguard wg4242424242 public-key</code>.</p>
    165. 

  165. 

  166. <p>Example:</p>
    167. 

  167. <div class="language-sh highlighter-rouge"><div class="highlight"><pre class="highlight"><code>vyos@vyos<span class="nv">$ </span>show interfaces wireguard wg4242424242 public-key 
    168. 

  168. UcqcZsJvq1MlYgo3gObjaJ8FH+N7wkfV+EH3YDAMyRE<span class="o">=</span>
    169. 

  169. </code></pre></div></div>
    170. 

  170. 

  171. <h3 id="configure-first-peers-tunnel">Configure First Peer’s tunnel</h3>
    172. 

  172. <p>This example assumes that your ASN is 4242421234 and your peer’s ASN is 4242424242</p>
    173. 

  173. <div class="language-sh highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="nb">set </span>interfaces wireguard wg4242424242 description <span class="s1">'AS4242424242 - My First Peer'</span>
    174. 

  174. 

  175. <span class="c"># Common practice on DN42 is for peers to use 2+the last four digits of your peer's ASN as the port.</span>
    176. 

  176. <span class="c"># You will have to let your peer know what you choose for your port, as well as your clearnet IP address.</span>
    177. 

  177. <span class="nb">set </span>interfaces wireguard wg4242424242 port <span class="s1">'24242'</span>
    178. 

  178. <span class="nb">set </span>interfaces wireguard wg4242424242 private-key <span class="s1">'SOoPQdMdmXE3ssp0/vwwoIMhQqvcQls+DhDjmaLw03U='</span>
    179. 

  179. 

  180. <span class="c"># An arbitrary link-local IPv6 address (that you'll have to tell to your peer)</span>
    181. 

  181. <span class="nb">set </span>interfaces wireguard wg4242424242 address <span class="s1">'fe80::1234/64'</span>
    182. 

  182. 

  183. <span class="c"># One of your DN42 IPv4 addresses (not really needed if you'll enable extended next-hop)</span>
    184. 

  184. <span class="nb">set </span>interfaces wireguard wg4242424242 address <span class="s1">'172.20.20.1/32'</span>
    185. 

  185. 

  186. <span class="c"># Set your peer's clearnet endpoint information. You need to use an IPv4 or IPv6 address</span>
    187. 

  187. <span class="c"># (as opposed to a DNS name).</span>
    188. 

  188. <span class="c"># If you have a static IP address but your peer does not,</span>
    189. 

  189. <span class="c"># you can leave out this part of the configuration.</span>
    190. 

  190. <span class="nb">set </span>interfaces wireguard wg4242424242 peer location1 address <span class="s1">'192.0.2.1'</span>
    191. 

  191. <span class="nb">set </span>interfaces wireguard wg4242424242 peer location1 port <span class="s1">'21234'</span>
    192. 

  192. 

  193. <span class="c"># You can allow everything here and relay on your firewall</span>
    194. 

  194. <span class="nb">set </span>interfaces wireguard wg4242424242 peer location1 allowed-ips <span class="s1">'0.0.0.0/0'</span>
    195. 

  195. <span class="nb">set </span>interfaces wireguard wg4242424242 peer location1 allowed-ips <span class="s1">'::/0'</span>
    196. 

  196. <span class="nb">set </span>interfaces wireguard wg4242424242 peer location1 public-key <span class="s1">'&lt;wireguard public key of your peer&gt;'</span>
    197. 

  197. 

  198. <span class="c"># (persistent-keepalive option could be optional, but in my case I noticed that helps starting BGP session)</span>
    199. 

  199. <span class="nb">set </span>interfaces wireguard wg4242424242 peer location1 persistent-keepalive <span class="s1">'60'</span>
    200. 

  200. 

  201. <span class="c"># Configure firewall</span>
    202. 

  202. <span class="nb">set </span>firewall interface wg4242424242 interface-group ipv6-name <span class="s1">'Tunnels_In_v6'</span>
    203. 

  203. <span class="nb">set </span>firewall interface wg4242424242 interface-group name <span class="s1">'Tunnels_In_v4'</span>
    204. 

  204. <span class="nb">set </span>firewall interface wg4242424242 <span class="nb">local </span>ipv6-name <span class="s1">'Tunnels_Local_v6'</span>
    205. 

  205. <span class="nb">set </span>firewall interface wg4242424242 <span class="nb">local </span>name <span class="s1">'Tunnels_Local_v4'</span>
    206. 

  206. </code></pre></div></div>
    207. 

  207. 

  208. <h2 id="bgp">BGP</h2>
    209. 

  209. <p>Now that we have a tunnel to our peer and theoretically can ping them, we can setup BGP.</p>
    210. 

  210. <h3 id="initial-router-setup">Initial Router Setup</h3>
    211. 

  211. <div class="language-sh highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="c"># Set your ASN and IP blocks</span>
    212. 

  212. <span class="nb">set </span>protocols bgp system-as <span class="s1">'4242421234'</span>
    213. 

  213. 

  214. <span class="nb">set </span>protocols bgp address-family ipv4-unicast network 172.20.20.0/24<span class="sb">`</span>  
    215. 

  215. <span class="nb">set </span>protocols bgp address-family ipv6-unicast network fd88:9deb:a69e::/48<span class="sb">`</span>
    216. 

  216. 

  217. <span class="c"># Note that your address blocks should match your exact prefix as listed in the registry.</span>
    218. 

  218. <span class="c"># if you try to advertise a subnet of your assigned block, it could get filtered by some peers.</span>
    219. 

  219. 

  220. <span class="c"># To keep it simple, just make your router ID match your lower IP within the DN42 registered space.</span>
    221. 

  221. <span class="nb">set </span>protocols bgp parameters router-id <span class="s1">'172.20.20.1'</span>
    222. 

  222. </code></pre></div></div>
    223. 

  223. 

  224. <h3 id="neighbor-up-with-peers">Neighbor Up With Peers</h3>
    225. 

  225. <h4 id="option-1-mp-bgp-with-multi-protocol---with-extended-next-hop">Option 1: MP-BGP (with Multi Protocol) - with Extended Next-Hop</h4>
    226. 

  226. <p>MP-BGP peerings over IPv6 are recommended on DN42.</p>
    227. 

  227. <div class="language-sh highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="c"># For these examples, your peer's link-local address is fe80::4242</span>
    228. 

  228. 

  229. <span class="nb">set </span>protocols bgp neighbor fe80::4242 update-source <span class="s1">'wg4242424242'</span>
    230. 

  230. <span class="nb">set </span>protocols bgp neighbor fe80::4242 description <span class="s1">'FriendlyNet'</span>
    231. 

  231. 

  232. <span class="nb">set </span>protocols bgp neighbor fe80::4242 capability extended-nexthop
    233. 

  233. 

  234. <span class="nb">set </span>protocols bgp neighbor fe80::4242 address-family ipv4-unicast 
    235. 

  235. <span class="nb">set </span>protocols bgp neighbor fe80::4242 address-family ipv6-unicast 
    236. 

  236. 

  237. </code></pre></div></div>
    238. 

  238. <h4 id="option-2-bgp-no-multi-protocol---no-extended-next-hop">Option 2: BGP (no Multi Protocol) - no Extended Next-Hop</h4>
    239. 

  239. <div class="language-sh highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="c"># First, we set the ipv6 part.</span>
    240. 

  240. <span class="nb">set </span>protocols bgp neighbor fe80::4242 remote-as <span class="s1">'4242424242'</span>
    241. 

  241. <span class="nb">set </span>protocols bgp neighbor fe80::4242 address-family ipv6-unicast 
    242. 

  242. <span class="nb">set </span>protocols bgp neighbor fe80::4242 description <span class="s1">'FriendlyNet'</span>
    243. 

  243. 

  244. <span class="c"># For the ipv4 part we need to add first a static ipv4 route to our peer tunneled ipv4 address</span>
    245. 

  245. <span class="nb">set </span>protocols static route 172.20.x.y interface wg1234
    246. 

  246. 

  247. <span class="c"># 172.20.x.y is your peer tunneled IPv4</span>
    248. 

  248. <span class="nb">set </span>protocols bgp neighbor 172.20.x.y remote-as <span class="s1">'&lt;your peer ASN&gt;'</span>
    249. 

  249. <span class="nb">set </span>protocols bgp neighbor 172.20.x.y address-family ipv4-unicast 
    250. 

  250. <span class="nb">set </span>protocols bgp neighbor 172.20.x.y description <span class="s1">'FriendlyNet'</span>
    251. 

  251. 

  252. <span class="c"># This setting may need to be adjusted depending on circumstances</span>
    253. 

  253. <span class="nb">set </span>protocols bgp neighbor 172.20.x.y ebgp-multihop 20
    254. 

  254. </code></pre></div></div>
    255. 

  255. 

  256. <p>You can now check your BGP summary:</p>
    257. 

  257. 

  258. <div class="language-sh highlighter-rouge"><div class="highlight"><pre class="highlight"><code>show ip bgp summary
    259. 

  259. 

  260. IPv4 Unicast Summary <span class="o">(</span>VRF default<span class="o">)</span>:
    261. 

  261. BGP router identifier 172.20.20.1, <span class="nb">local </span>AS number 4242421234 vrf-id 0
    262. 

  262. BGP table version 2782
    263. 

  263. RIB entries 1378, using 258 KiB of memory
    264. 

  264. Peers 1, using 1 MiB of memory
    265. 

  265. Peer <span class="nb">groups </span>1, using 64 bytes of memory
    266. 

  266. 

  267. Neighbor               V         AS   MsgRcvd   MsgSent   TblVer  InQ OutQ  Up/Down State/PfxRcd   PfxSnt Desc
    268. 

  268. fe80::4242             4 4242424242      1031         6        0    0    0 00:04:20          710        1 FriendlyNet
    269. 

  269. 

  270. IPv6 Unicast Summary <span class="o">(</span>VRF default<span class="o">)</span>:
    271. 

  271. BGP router identifier 172.20.20.1, <span class="nb">local </span>AS number 4242421234 vrf-id 0
    272. 

  272. BGP table version 2782
    273. 

  273. RIB entries 1378, using 258 KiB of memory
    274. 

  274. Peers 1, using 1 MiB of memory
    275. 

  275. Peer <span class="nb">groups </span>1, using 64 bytes of memory
    276. 

  276. 

  277. Neighbor               V         AS   MsgRcvd   MsgSent   TblVer  InQ OutQ  Up/Down State/PfxRcd   PfxSnt Desc
    278. 

  278. fe80::4242             4 4242424242      1031         6        0    0    0 00:04:20          710        1 FriendlyNet
    279. 

  279. </code></pre></div></div>
    280. 

  280. 

  281. <p>Setting up peer-groups might help standardize multiple peerings:</p>
    282. 

  282. 

  283. <div class="language-sh highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="c"># One peer group for all IPv6 MP-BGP link-local extended-nexthop peers</span>
    284. 

  284. <span class="nb">set </span>protocols bgp peer-group dn42 address-family ipv4-unicast
    285. 

  285. <span class="nb">set </span>protocols bgp peer-group dn42 address-family ipv6-unicast
    286. 

  286. <span class="nb">set </span>protocols bgp peer-group dn42 capability extended-nexthop
    287. 

  287. 

  288. <span class="nb">set </span>protocols bgp neighbor fe80::4242 peer-group dn42
    289. 

  289. 

  290. <span class="c"># If you have any non-multiprotocol peerings you'll need to set up peer-groups</span>
    291. 

  291. <span class="c"># for the individual address families. This is left up to the reader.</span>
    292. 

  292. 

  293. <span class="c"># Delete the settings that are now redundant</span>
    294. 

  294. delete protocols bgp neighbor fe80::4242 address-family
    295. 

  295. delete protocols bgp neighbor fe80::4242 capability
    296. 

  296. </code></pre></div></div>
    297. 

  297. 

  298. <h2 id="rpkiroa-checking">RPKI/ROA Checking</h2>
    299. 

  299. <p>Burble has made this super easy. More info can be found <a href="/howto/ROA-slash-RPKI">here</a> on this wiki. 
    300. 

  300. You can achieve this by running docker on a seperate server in the network but as of Vyos 1.4 2023-02-28 its possible to do it on the vyos machine itself. This setup is using Cloudflare’s GoRTR and automatically reaching out and downloading a custom JSON file generated by Burble just for the DN42 network.</p>
    301. 

  301. 

  302. <h3 id="setup-rpki-caching-server-on-the-vyos-machine">Setup RPKI Caching Server on the Vyos machine</h3>
    303. 

  303. 

  304. <p>Run this command in operation mode to pull the container image to the vyos machine.</p>
    305. 

  305. <div class="language-sh highlighter-rouge"><div class="highlight"><pre class="highlight"><code>add container image cloudflare/gortr
    306. 

  306. </code></pre></div></div>
    307. 

  307. 

  308. <p>Run the following commands in configuration mode:</p>
    309. 

  309. 

  310. <p>To create the network for the prki container so it is only reachable on the vyos machine.</p>
    311. 

  311. <div class="language-sh highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="nb">set </span>container network rpki
    312. 

  312. <span class="nb">set </span>container network rpki prefix 172.16.2.0/24
    313. 

  313. </code></pre></div></div>
    314. 

  314. 

  315. <p>To create the container itself</p>
    316. 

  316. <div class="language-sh highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="nb">set </span>container name gortr image cloudflare/gortr
    317. 

  317. <span class="nb">set </span>container name gortr <span class="nb">command</span> <span class="s2">"-cache https://dn42.burble.com/roa/dn42_roa_46.json -verify=false -checktime=false -bind :8082"</span>
    318. 

  318. <span class="nb">set </span>container name gortr network rpki address 172.16.2.10
    319. 

  319. <span class="nb">set </span>container name gortr restart on-failure
    320. 

  320. </code></pre></div></div>
    321. 

  321. 

  322. <h3 id="setup-rpki-caching-server-on-a-seperate-server">Setup RPKI Caching Server on a seperate server</h3>
    323. 

  323. <p>But its also possible to setup the container on a seperate machine.
    324. 

  324. Run the following docker command to setup the clouflare gortr container on a seperate server with docker installed.</p>
    325. 

  325. 

  326. <div class="language-sh highlighter-rouge"><div class="highlight"><pre class="highlight"><code>docker run <span class="nt">-ti</span> <span class="nt">-p</span> 8082:8082 cloudflare/gortr <span class="nt">-cache</span> https://dn42.burble.com/roa/dn42_roa_46.json <span class="nt">-verify</span><span class="o">=</span><span class="nb">false</span> <span class="nt">-checktime</span><span class="o">=</span><span class="nb">false</span> <span class="nt">-bind</span> :8082
    327. 

  327. </code></pre></div></div>
    328. 

  328. <p>This will start a docker container that listens on the host server’s IP at port 8082.</p>
    329. 

  329. 

  330. <h3 id="point-vyos-router-at-rpki-caching-server">Point VyOS Router at RPKI Caching Server</h3>
    331. 

  331. 

  332. <div class="language-sh highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="nb">set </span>protocols rpki cache &lt;ip address of your GoRTR instance&gt; port <span class="s1">'8082'</span>
    333. 

  333. <span class="nb">set </span>protocols rpki cache &lt;ip address of your GoRTR instance&gt; preference <span class="s1">'1'</span>   
    334. 

  334. </code></pre></div></div>
    335. 

  335. 

  336. <p>You can check the connection with <code class="language-plaintext highlighter-rouge">show rpki cache-connection</code> the output will look like this:</p>
    337. 

  337. <div class="language-sh highlighter-rouge"><div class="highlight"><pre class="highlight"><code>show rpki cache-connection
    338. 

  338. Connected to group 1
    339. 

  339. rpki tcp cache &lt;ip address of your GoRTR instance&gt;  8082 pref 1 <span class="o">(</span>connected<span class="o">)</span>
    340. 

  340. </code></pre></div></div>
    341. 

  341. 

  342. <p>You can also see the received prefix-table with <code class="language-plaintext highlighter-rouge">show rpki prefix-table</code>.</p>
    343. 

  343. 

  344. <h3 id="create-route-map">Create Route Map</h3>
    345. 

  345. <div class="language-sh highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="nb">set </span>policy route-map DN42-ROA rule 10 action <span class="s1">'permit'</span>
    346. 

  346. <span class="nb">set </span>policy route-map DN42-ROA rule 10 match rpki <span class="s1">'valid'</span>
    347. 

  347. <span class="nb">set </span>policy route-map DN42-ROA rule 20 action <span class="s1">'permit'</span>
    348. 

  348. <span class="nb">set </span>policy route-map DN42-ROA rule 20 match rpki <span class="s1">'notfound'</span>
    349. 

  349. <span class="nb">set </span>policy route-map DN42-ROA rule 30 action <span class="s1">'deny'</span>
    350. 

  350. <span class="nb">set </span>policy route-map DN42-ROA rule 30 match rpki <span class="s1">'invalid'</span>
    351. 

  351. </code></pre></div></div>
    352. 

  352. <p>This example allows all routes in unless they are marked invalid or in other words possibly been a victim of BGP hijacking.
    353. 

  353. You can also consider to “deny” the “notfound” prefixes, for better control.</p>
    354. 

  354. 

  355. <p>You can also consider to combine within the same route-map the RPKI and one or more a prefix lists containing your internal network prefixes, as described later (The example “No RPKI/ROA and Internal Network Falls Into DN42 Range”).</p>
    356. 

  356. 

  357. <h3 id="assign-route-map-to-neighbor">Assign Route Map to Neighbor</h3>
    358. 

  358. <div class="language-sh highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="nb">set </span>protocols bgp neighbor fe80::1234 address-family ipv4-unicast route-map <span class="nb">export</span> <span class="s1">'DN42-ROA'</span>
    359. 

  359. <span class="nb">set </span>protocols bgp neighbor fe80::1234 address-family ipv4-unicast route-map import <span class="s1">'DN42-ROA'</span>
    360. 

  360. <span class="nb">set </span>protocols bgp neighbor fe80::1234 address-family ipv6-unicast route-map <span class="nb">export</span> <span class="s1">'DN42-ROA'</span>
    361. 

  361. <span class="nb">set </span>protocols bgp neighbor fe80::1234 address-family ipv6-unicast route-map import <span class="s1">'DN42-ROA'</span> 
    362. 

  362. </code></pre></div></div>
    363. 

  363. <p><em>Remember to do that for all your new peerings!</em></p>
    364. 

  364. 

  365. <h2 id="example-route-map">Example Route Map</h2>
    366. 

  366. <h3 id="no-rpkiroa-and-internal-network-falls-into-dn42-range">No RPKI/ROA and Internal Network Falls Into DN42 Range</h3>
    367. 

  367. <div class="language-sh highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="c">##Build prefix list to match personal internal network</span>
    368. 

  368. <span class="nb">set </span>policy prefix-list BlockIPConflicts description <span class="s1">'Prevent Conflicting Routes'</span>
    369. 

  369. <span class="nb">set </span>policy prefix-list BlockIPConflicts rule 10 action <span class="s1">'permit'</span>
    370. 

  370. <span class="nb">set </span>policy prefix-list BlockIPConflicts rule 10 description <span class="s1">'Internal IP Space'</span>
    371. 

  371. <span class="nb">set </span>policy prefix-list BlockIPConflicts rule 10 le <span class="s1">'32'</span>
    372. 

  372. <span class="nb">set </span>policy prefix-list BlockIPConflicts rule 10 prefix <span class="s1">'10.10.0.0/16'</span>
    373. 

  373. 

  374. 

  375. <span class="c">##Build prefix list to match personal internal network</span>
    376. 

  376. <span class="nb">set </span>policy prefix-list6 BlockIPConflicts-v6 description <span class="s1">'Prevent Conflicting Routes'</span>
    377. 

  377. <span class="nb">set </span>policy prefix-list6 BlockIPConflicts-v6 rule 10 action <span class="s1">'permit'</span>
    378. 

  378. <span class="nb">set </span>policy prefix-list6 BlockIPConflicts-v6 rule 10 description <span class="s1">'Internal IP Space'</span>
    379. 

  379. <span class="nb">set </span>policy prefix-list6 BlockIPConflicts-v6 rule 10 le <span class="s1">'128'</span>
    380. 

  380. <span class="nb">set </span>policy prefix-list6 BlockIPConflicts-v6 rule 10 prefix <span class="s1">'fd42:4242:1111::/48'</span>
    381. 

  381. 

  382. 

  383. 

  384. <span class="c">##Build prefix list to match DN42's IPv4 network</span>
    385. 

  385. <span class="nb">set </span>policy prefix-list DN42-Network rule 10 action <span class="s1">'permit'</span>
    386. 

  386. <span class="nb">set </span>policy prefix-list DN42-Network rule 10 le <span class="s1">'32'</span>
    387. 

  387. <span class="nb">set </span>policy prefix-list DN42-Network rule 10 prefix <span class="s1">'172.20.0.0/14'</span>
    388. 

  388. <span class="nb">set </span>policy prefix-list DN42-Network rule 20 action <span class="s1">'permit'</span>
    389. 

  389. <span class="nb">set </span>policy prefix-list DN42-Network rule 20 le <span class="s1">'32'</span>
    390. 

  390. <span class="nb">set </span>policy prefix-list DN42-Network rule 20 prefix <span class="s1">'10.0.0.0/8'</span>
    391. 

  391. 

  392. 

  393. <span class="c">##Build prefix list to match DN42's IPv6 network</span>
    394. 

  394. <span class="nb">set </span>policy prefix-list6 DN42-Network-v6 rule 10 action <span class="s1">'permit'</span>
    395. 

  395. <span class="nb">set </span>policy prefix-list6 DN42-Network-v6 rule 10 le <span class="s1">'128'</span>
    396. 

  396. <span class="nb">set </span>policy prefix-list6 DN42-Network-v6 rule 10 prefix <span class="s1">'fd00::/8'</span>
    397. 

  397. 

  398. 

  399. <span class="c">##Block prefixes within internal network range, then allow everything else within DN42, then block everything else.</span>
    400. 

  400. <span class="nb">set </span>policy route-map Default-Peering rule 10 action <span class="s1">'deny'</span>
    401. 

  401. <span class="nb">set </span>policy route-map Default-Peering rule 10 description <span class="s1">'Prevent IP Conflicts'</span>
    402. 

  402. <span class="nb">set </span>policy route-map Default-Peering rule 10 match ip address prefix-list <span class="s1">'BlockIPConflicts'</span>
    403. 

  403. <span class="nb">set </span>policy route-map Default-Peering rule 11 action <span class="s1">'deny'</span>
    404. 

  404. <span class="nb">set </span>policy route-map Default-Peering rule 11 description <span class="s1">'Prevent IP Conflicts'</span>
    405. 

  405. <span class="nb">set </span>policy route-map Default-Peering rule 11 match ipv6 address prefix-list <span class="s1">'BlockIPConflicts-v6'</span>
    406. 

  406. <span class="nb">set </span>policy route-map Default-Peering rule 20 action <span class="s1">'permit'</span>
    407. 

  407. <span class="nb">set </span>policy route-map Default-Peering rule 20 description <span class="s1">'Allow DN42-Network'</span>
    408. 

  408. <span class="nb">set </span>policy route-map Default-Peering rule 20 match ip address prefix-list <span class="s1">'DN42-Network'</span>
    409. 

  409. <span class="nb">set </span>policy route-map Default-Peering rule 21 action <span class="s1">'permit'</span>
    410. 

  410. <span class="nb">set </span>policy route-map Default-Peering rule 21 description <span class="s1">'Allow DN42-Network'</span>
    411. 

  411. <span class="nb">set </span>policy route-map Default-Peering rule 21 match ipv6 address prefix-list <span class="s1">'DN42-Network-v6'</span>
    412. 

  412. <span class="nb">set </span>policy route-map Default-Peering rule 99 action <span class="s1">'deny'</span>
    413. 

  413. 

  414. 

  415. <span class="c">##Apply the route-map on import/export</span>
    416. 

  416. 

  417. <span class="nb">set </span>protocols bgp peer-group dn42 address-family ipv4-unicast route-map <span class="nb">export</span> <span class="s1">'Default-Peering'</span>
    418. 

  418. <span class="nb">set </span>protocols bgp peer-group dn42 address-family ipv4-unicast route-map import <span class="s1">'Default-Peering'</span>
    419. 

  419. <span class="nb">set </span>protocols bgp peer-group dn42 address-family ipv6-unicast route-map <span class="nb">export</span> <span class="s1">'Default-Peering'</span>
    420. 

  420. <span class="nb">set </span>protocols bgp peer-group dn42 address-family ipv6-unicast route-map import <span class="s1">'Default-Peering'</span> 
    421. 

  421. </code></pre></div></div>
    422. 

  422. 

  423. <h1 id="add-your-vyos-router-to-the-global-route-collector">Add your VyOS router to the <a href="/services/Route-Collector">Global Route Collector</a>!</h1>
    424. 

  424. <div class="language-sh highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="c"># The route collector should never export routes, so let's make a route-map to reject them if it does.</span>
    425. 

  425. <span class="nb">set </span>policy route-map Deny-All rule 1 action deny
    426. 

  426. <span class="nb">set </span>protocols bgp neighbor fd42:4242:2601:ac12::1 address-family ipv4-unicast route-map import <span class="s1">'Deny-All'</span>
    427. 

  427. <span class="nb">set </span>protocols bgp neighbor fd42:4242:2601:ac12::1 address-family ipv6-unicast route-map import <span class="s1">'Deny-All'</span>
    428. 

  428. <span class="nb">set </span>protocols bgp neighbor fd42:4242:2601:ac12::1 description <span class="s1">'https://lg.collector.dn42'</span>
    429. 

  429. <span class="nb">set </span>protocols bgp neighbor fd42:4242:2601:ac12::1 ebgp-multihop <span class="s1">'10'</span>
    430. 

  430. <span class="nb">set </span>protocols bgp neighbor fd42:4242:2601:ac12::1 remote-as <span class="s1">'4242422602'</span>
    431. 

  431. </code></pre></div></div>
    432. 

  432. 

  433. <h2 id="credits">Credits</h2>
    434. 

  434. <p>This How-To has to be considered a work-in-progress by <strong>Matwolf</strong> with parts co-authored by <strong>bri</strong></p>
    435. 

  435. 

  436. <p>It’s based on the original VyOS How-To made by <strong>Owens Research</strong>: <a href="/howto/vyos">How-To/VyOS</a>.</p>
    437. 

  437. 

  438. <p>The commands in this page have been adapted to be compatible with the new version of VyOS 1.4.x (sagitta) and to include configurations for IPv6 (MP-BGP over link-local and extended next-hop).</p>
    439. 

  439. 

  440. <p>If you have any questions or suggestions please reach out.</p>
    441. 

  441. 

  442. <h2 id="see-also">See also</h2>
    443. 

  443. <p><a href="https://docs.vyos.io/en/latest/configuration/interfaces/wireguard.html">WireGuard</a> and <a href="https://docs.vyos.io/en/latest/configuration/protocols/bgp.html">BGP</a> in the official VyOS documentation.</p>
    444. 

  444. 

  445. 

  446. 

  447.             <div id="menu-container" class="menu-container">
    448. 

  448.                 <hr>
    449. 

  449.                 <div id="menu" class="menu">
    450. 

  450.                     
    451. 

  451.                     <ul>
    452. 

  452.   <li><a href="/Home">Home</a>
    453. 

  453.     <ul>
    454. 

  454.       <li><a href="/howto/Getting-Started">Getting Started</a></li>
    455. 

  455.       <li><a href="/howto/Registry-Authentication">Registry Authentication</a></li>
    456. 

  456.       <li><a href="/howto/Address-Space">Address Space</a></li>
    457. 

  457.       <li><a href="/howto/BGP-communities">BGP communities</a></li>
    458. 

  458.       <li><a href="/FAQ">FAQ</a></li>
    459. 

  459.     </ul>
    460. 

  460.   </li>
    461. 

  461.   <li>How-To
    462. 

  462.     <ul>
    463. 

  463.       <li><a href="/howto/wireguard">Wireguard</a></li>
    464. 

  464.       <li><a href="/howto/openvpn">Openvpn</a></li>
    465. 

  465.       <li><a href="/howto/IPsec-with-PublicKeys">IPsec With Public Keys</a></li>
    466. 

  466.       <li><a href="/howto/tinc">Tinc</a></li>
    467. 

  467.       <li><a href="/howto/GRE-on-FreeBSD">GRE on FreeBSD</a></li>
    468. 

  468.       <li><a href="/howto/GRE-on-OpenBSD">GRE on OpenBSD</a></li>
    469. 

  469.       <li><a href="/howto/IPv6-Multicast">IPv6 Multicast (PIM-SM)</a></li>
    470. 

  470.       <li><a href="/howto/multicast">SSM Multicast</a></li>
    471. 

  471.       <li><a href="/howto/mpls">MPLS</a></li>
    472. 

  472.       <li><a href="/howto/Bird2">Bird2</a></li>
    473. 

  473.       <li><a href="/howto/frr">FRRouting</a></li>
    474. 

  474.       <li><a href="/howto/OpenBGPD">OpenBGPD</a></li>
    475. 

  475.       <li><a href="/howto/mikrotik">Mikrotik RouterOS</a></li>
    476. 

  476.       <li><a href="/howto/EdgeOS-Config">EdgeRouter</a></li>
    477. 

  477.       <li><a href="/howto/Static-routes-on-Windows">Static routes on Windows</a></li>
    478. 

  478.       <li><a href="/howto/networksettings">Universal Network Requirements</a></li>
    479. 

  479.       <li><a href="/howto/vyos1.4.x">VyOS</a></li>
    480. 

  480.       <li><a href="/howto/nixos">NixOS</a></li>
    481. 

  481.     </ul>
    482. 

  482.   </li>
    483. 

  483.   <li>Services
    484. 

  484.     <ul>
    485. 

  485.       <li><a href="/services/IRC">IRC</a></li>
    486. 

  486.       <li><a href="/services/Whois">Whois registry</a></li>
    487. 

  487.       <li><a href="/services/DNS">DNS</a></li>
    488. 

  488.       <li><a href="/services/IX-Collection">IX Collection</a></li>
    489. 

  489.       <li><a href="/services/Clearnet-Domains">Public DNS</a></li>
    490. 

  490.       <li><a href="/services/Looking-Glasses">Looking Glasses</a></li>
    491. 

  491.       <li><a href="/services/Automatic-Peering">Automatic Peering</a></li>
    492. 

  492.       <li><a href="/services/Repository-Mirrors">Repository Mirrors</a></li>
    493. 

  493.       <li><a href="/services/Distributed-Wiki">Distributed Wiki</a></li>
    494. 

  494.       <li><a href="/services/Certificate-Authority">Certificate Authority</a></li>
    495. 

  495.       <li><a href="/services/Route-Collector">Route Collector</a></li>
    496. 

  496.     </ul>
    497. 

  497.   </li>
    498. 

  498.   <li>Internal
    499. 

  499.     <ul>
    500. 

  500.       <li><a href="/internal/Internal-Services">Internal services</a></li>
    501. 

  501.       <li><a href="/internal/Interconnections">Interconnections</a></li>
    502. 

  502.       <li><a href="/internal/APIs">APIs</a></li>
    503. 

  503.       <li><a href="/internal/ShowAndTell">Show and Tell</a></li>
    504. 

  504.       <li><a href="/internal/Historical-Services">Historical services</a></li>
    505. 

  505.     </ul>
    506. 

  506.   </li>
    507. 

  507.   <li>Historical
    508. 

  508.     <ul>
    509. 

  509.       <li><a href="/historical/Bird">Bird 1</a></li>
    510. 

  510.       <li><a href="/historical/Quagga">Quagga</a></li>
    511. 

  511.     </ul>
    512. 

  512.   </li>
    513. 

  513.   <li>External Tools
    514. 

  514.     <ul>
    515. 

  515.       <li><a href="https://paste.dn42.us">Paste Board</a></li>
    516. 

  516.       <li><a href="https://git.dn42.dev">Git Repositories</a></li>
    517. 

  517.     </ul>
    518. 

  518.   </li>
    519. 

  519. </ul>
    520. 

  520. 

  521. <hr />
    522. 

  522. 

  523. 

  524.                 </div>
    525. 

  525.             </div>
    526. 

  526.         </main>
    527. 

  527.         
    528. 

  528.         <footer><div class="center">
    529. 

  529.     <div id="dn42_footer">
    530. 

  530.         
    531. 

  531.         <table>
    532. 

  532.   <tbody>
    533. 

  533.     <tr>
    534. 

  534.       <td>Hosted by: <a href="mailto:dn42@burble.com">BURBLE-MNT</a>, <a href="mailto:nurtic-vibe@grmml.net">GRMML-MNT</a>, <a href="mailto:xuu@dn42.us">XUU-MNT</a>, <a href="mailto:janeric@ortgies.it">JAN-MNT</a>, <a href="mailto:lare@lare.cc">LARE-MNT</a>, <a href="mailto:danny@saru.moe">SARU-MNT</a>, <a href="mailto:androw95220@gmail.com">ANDROW-MNT</a>, <a href="mailto:dn42@mk16.de">MARK22K-MNT</a></td>
    535. 

  535.       <td>Accessible via: <a href="https://wiki.dn42">dn42</a>, <a href="https://dn42.dev/">dn42.dev</a>, <a href="https://dn42.eu/">dn42.eu</a>, <a href="https://wiki.dn42.us/">wiki.dn42.us</a>, <a href="https://dn42.de/">dn42.de</a> (IPv6-only), <a href="https://dn42.cc/">dn42.cc</a> (wiki-ng), <a href="https://dn42.wiki/">dn42.wiki</a>, <a href="https://dn42.pp.ua/">dn42.pp.ua</a>, <a href="https://dn42.obl.ong/">dn42.obl.ong</a></td>
    536. 

  536.     </tr>
    537. 

  537.   </tbody>
    538. 

  538. </table>
    539. 

  539. 

  540.     </div>
    541. 

  541. </div>
    542. 

  542. </footer>
    543. 

  543. 

  544.         
    545. 

  545. 

  546.     </body>
    547. 

  547. 

  548. </html>
    549. 

  549.