All Pages > historical > Bird
Bird is a commonly used BGP daemon. This page provides configuration and help to run Bird for dn42. Compared to quagga, bird supports multiple routing tables, which is useful, if you also plan to peer with other federated networks such as freifunk. In the following a working configuration for dn42 is shown. If you want to learn the practical details behind routing protocols in bird, see the following guide
Bird 1.6.x will be EOL by the end of 2023, it's recommended to upgrade to 2.13.
Debian
In the Debian release cycle the bird packages may become outdated at times, if that is the case you should use the official bird package repository maintained by the developers of nic.cz.
This is not necessary for Debian Stretch, which currently ships the most recent version (1.6.3) in this repositories.
Example configuration
Note: This file covers the configuration of Bird 1.x. For an example configuration of Bird 2.x see howto/Bird2
- Replace
<AS>with your Autonomous System Number (only the digits) - Replace
<GATEWAY_IP>with your gateway ip (the internal dn42 ip address you use on the host, where dn42 is running) - Replace
<SUBNET>with your registered dn42 subnet - Replace
<PEER_IP>with the ip of your peer who is connected with you using your favorite vpn protocol (openvpn, ipsec, tinc, ...) - Replace
<PEER_AS>the Autonomous System Number of your peer (only the digits) - Replace
<PEER_NAME>a self chosen name for your peer
IPv6
device {
time 10;
}
include "/etc/bird/local6.conf";
/*
krt_prefsrc defines the source address for outgoing connections.
On Linux, this causes the "src" attribute of a route to be set.
Without this option outgoing connections would use the peering IP which
would cause packet loss if some peering disconnects but the interface
is still available. (The route would still exist and thus route through
the TUN/TAP interface but the VPN daemon would simply drop the packet.)
*/
kernel {
time 20;
none;
filter {
if source = RTS_STATIC then reject;
OWNIP;
;
};
}
static {
<SUBNET> reject;
all;
none;
}
bgp dnpeers {
as OWNAS;
metric 1;
keep filtered;
filter {
if ) && !) then {
;
}
;
};
filter {
if ) && source ~ [RTS_STATIC, RTS_BGP] then {
;
}
;
};
limit 1000 action block;
}
include "/etc/bird/peers6/*";
id <GATEWAY_IP>;
define OWNAS = <AS>;
define OWNIP = <GATEWAY_IP>;
function ) {
net ~ [<SUBNET>+];
}
function ) {
net ~ [
:/8{44,64} ];
}
bgp <PEER_NAME> from dnpeers {
<PEERING_IP> as <PEER_AS>;
};
IPv4
device {
time 10;}
static {
<SUBNET> reject;
all;
none;
};
include "/etc/bird/local4.conf";
/*
krt_prefsrc defines the source address for outgoing connections.
On Linux, this causes the "src" attribute of a route to be set.
Without this option outgoing connections would use the peering IP which
would cause packet loss if some peering disconnects but the interface
is still available. (The route would still exist and thus route through
the TUN/TAP interface but the VPN daemon would simply drop the packet.)
*/
kernel {
time 20;
none;
filter {
if source = RTS_STATIC then reject;
OWNIP;
;
};
};
bgp dnpeers {
as OWNAS;
metric 1;
keep filtered;
filter {
if ) && !) then {
;
}
;
};
filter {
if ) && source ~ [RTS_STATIC, RTS_BGP] then {
;
}
;
};
limit 1000 action block;
};
include "/etc/bird/peers4/*";
id <GATEWAY_IP>;
define OWNAS = <AS>;
define OWNIP = <GATEWAY_IP>;
function ) {
net ~ [<SUBNET>+];
}
function ) {
net ~ [
.20.0.0/14{21,29},.20.0.0/24{28,32},.21.0.0/24{28,32},.22.0.0/24{28,32},.23.0.0/24{28,32},.31.0.0/16+,.100.0.0/14+,.127.0.0/16{16,32},.0.0.0/8{15,24} ];
}
bgp <PEER_NAME> from dnpeers {
<PEERING_IP> as <PEER_AS>;
};
Bird communities
Communities can be used to prioritize traffic based on different flags, in DN42 we are using communities to prioritize based on latency, bandwidth and encryption. It is really easy to get started with communities and we encourage all of you to get the basic configuration done and to mark your peerings with the correct flags for improved routing. More information can be found here.
Route Origin Authorization
Route Origin Authorizations should be used in BIRD to authenticate prefix announcements. These check the originating AS and validate that they are allowed to advertise a prefix.
ROA Tables
The ROA table can be generated from the registry directly or you can use pre-built ROA tables.
Updating ROA tables
You can add cron entries to periodically update the tables:
*/15 * * * * curl -sfSLR {-o,-z}/var/lib/bird/bird6_roa_dn42.conf && chronic birdc6 configure
*/15 * * * * curl -sfSLR {-o,-z}/var/lib/bird/bird_roa_dn42.conf && chronic birdc configure
Debian version:
*/15 * * * * curl -sfSLR -o/var/lib/bird/bird6_roa_dn42.conf -z/var/lib/bird/bird6_roa_dn42.conf && /usr/sbin/birdc6 configure
*/15 * * * * curl -sfSLR -o/var/lib/bird/bird_roa_dn42.conf -z/var/lib/bird/bird_roa_dn42.conf && /usr/sbin/birdc configure
then create the directory to make sure curls can save the files:
Or use a systemd timer: (check the commands before copy-pasting)
[Unit]
Update DN42 ROA
[Service]
oneshot
curl -sfSLR -o /etc/bird/roa_dn42.conf -z /etc/bird/roa_dn42.conf
curl -sfSLR -o /etc/bird/roa_dn42_v6.conf -z /etc/bird/roa_dn42_v6.conf
birdc configure
[Unit]
Update DN42 ROA periodically
[Timer]
2m
15m
1m
[Install]
timers.target
then enable and start the timer with systemctl enable --now dn42-roa.timer.
More advanced script with error checking:
#!/bin/bash
roa4URL=""
roa6URL=""
roa4FILE="/etc/bird/roa/roa_dn42.conf"
roa6FILE="/etc/bird/roa/roa_dn42_v6.conf"
if ;then
fi
if ;then
fi
if ; then
else
fi
Use RPKI ROA in bird2
- Download gortr
https://github.com/cloudflare/gortr/releases
- Run gortr.
- Run with docker
- Add this to your bird configure file,other ROA protocol must removed.
rpki rpki_dn42{
roa4 { table dn42_roa; };
roa6 { table dn42_roa_v6; };
"<your rpki server ip or domain>" port 8282;
keep 90;
keep 900;
keep 172800;
}
Filter configuration
In your import filter add the following to reject invalid routes:
if (dn42_roa, net, bgp_path.last) != ROA_VALID) then {
"[dn42] ROA check failed for ", net, " ASN ", bgp_path.last;
;
}
Also, define your ROA table with:
table dn42_roa {
include "/var/lib/bird/bird_roa_dn42.conf";
};
NOTE: Make sure you setup ROA checks for both bird and bird6 (for IPv6).
Useful bird commmands
bird can be remote controlled via the birdc command. Here is a list of useful bird commands:
)
)
)
)
)
)
)
)
)
)
External Links
- detailed bird configuration from Mic92: https://github.com/Mic92/bird-dn42
- more bird commands: https://bird.network.cz/?get_doc&v=20&f=bird-4.html