# Refer: https://dn42.dev/howto/Bird2 # Refer: https://lantian.pub/article/modify-website/bird-confederation.lantian include "/etc/bird/net-info.conf"; include "/etc/bird/conf/net-info.conf"; router id OWNIP; protocol device { scan time 10; } /* * Utility functions */ function is_self_net() { return net ~ OWNNETSET; } function is_self_net_v6() { return net ~ OWNNETSETv6; } function is_valid_network() { return net ~ [ 172.20.0.0/14{21,29}, # dn42 172.20.0.0/24{28,32}, # dn42 Anycast 172.21.0.0/24{28,32}, # dn42 Anycast 172.22.0.0/24{28,32}, # dn42 Anycast 172.23.0.0/24{28,32}, # dn42 Anycast 172.31.0.0/16+, # ChaosVPN 10.100.0.0/14+, # ChaosVPN 10.127.0.0/16{16,32}, # neonetwork 10.0.0.0/8{15,24} # Freifunk.net ]; } roa4 table dn42_roa; roa6 table dn42_roa_v6; protocol static { roa4 { table dn42_roa; }; include "/etc/bird/roa_dn42.conf"; }; protocol static { roa6 { table dn42_roa_v6; }; include "/etc/bird/roa_dn42_v6.conf"; }; function is_valid_network_v6() { return net ~ [ fd00::/8{44,64} # ULA address space as per RFC 4193 ]; } function is_kas_network() { if net ~ KASNET_SET then accept; if is_valid_network() && source ~ [RTS_STATIC, RTS_BGP] then { accept; } else reject; } function is_kas_network_v6() { if net ~ KASNET_SETv6 then accept; if is_valid_network_v6() && source ~ [RTS_STATIC, RTS_BGP] then { accept; } else reject; } protocol kernel { scan time 20; ipv6 { import none; export filter { if source = RTS_STATIC then reject; krt_prefsrc = OWNIPv6; accept; }; }; }; protocol kernel { scan time 20; ipv4 { import none; export filter { if source = RTS_STATIC then reject; krt_prefsrc = OWNIP; accept; }; }; } protocol static { route OWNNET reject; ipv4 { import all; export none; }; } protocol static { route OWNNETv6 reject; ipv6 { import all; export none; }; } template bgp dn42_external_peer { local as OWNAS; path metric 1; ipv4 { import filter { if is_valid_network() && !is_self_net() then { if (roa_check(dn42_roa, net, bgp_path.last) != ROA_VALID) then { print "[dn42] ROA check failed for ", net, " ASN ", bgp_path.last; reject; } else accept; } else reject; }; export filter { bgp_path.delete(KASNET_ASSET); if is_valid_network() && source ~ [RTS_STATIC, RTS_BGP] then accept; else reject; }; import limit 1000 action block; }; ipv6 { import filter { if is_valid_network_v6() && !is_self_net_v6() then { if (roa_check(dn42_roa_v6, net, bgp_path.last) != ROA_VALID) then { print "[dn42] ROA check failed for ", net, " ASN ", bgp_path.last; reject; } else accept; } else reject; }; export filter { bgp_path.delete(KASNET_ASSET); if is_valid_network_v6() && source ~ [RTS_STATIC, RTS_BGP] then accept; else reject; }; import limit 1000 action block; }; } template bgp kas_edge_peer { local as KASNET_AS; confederation OWNAS; confederation member yes; path metric 1; direct; enable extended messages on; ipv4 { next hop self yes; import filter { is_kas_network(); }; export filter { is_kas_network(); }; }; ipv6 { next hop self yes; import filter { is_kas_network_v6(); }; export filter { is_kas_network_v6(); }; }; }; template bgp kas_internal_peer { local as KASNET_AS; path metric 1; direct; enable extended messages on; ipv4 { next hop self yes; import filter { is_kas_network(); }; export filter { is_kas_network(); }; }; ipv6 { next hop self yes; import filter { is_kas_network_v6(); }; export filter { is_kas_network_v6(); }; }; }; # Config for peering eBGPs include "/etc/bird/conf/peers/*.conf"; # Config for peering edges (those nodes peering with eBGP) include "/etc/bird/conf/edges/*.conf"; # Config for peering internals include "/etc/bird/conf/internals/*.conf";