자체 AS 실행: FRR, GRE 터널 및 정책 라우팅을 사용한 FreeBSD의 BGP
Running Your Own As: BGP on FreeBSD with FRR, GRE Tunnels, and Policy Routing
요약
이 글은 FreeBSD를 사용하여 공개 인터넷에서 자체 자율 시스템(AS)을 설정하고 실행하는 방법을 자세히 설명합니다. 스폰서 LIR로부터 AS 번호와 IPv6 접두사를 얻는 것, BGP를 위해 FRR을 사용하는 FreeBSD 라우터 구성, 원격 서버에 접두사를 배포하기 위한 GRE 및 GIF 터널 설정, 그리고 듀얼 스택 라우팅 문제를 관리하는 것에 대해 다룹니다.
댓글 (24)
Otherwise, getting to know the power of FreeBSD is awesome. Thanks for creating the blog!
The market is tight, but nowhere near the point where it was 4-5 years ago. Big cloud providers already bought enormous amounts of IPv4 while many regional ISPs and colocation providers went out of business.
There is no real pressure to buy IPv4 except for brand-new companies to get their initial /24 or /23 to start. Everything else is optional.
It cannot be used commercially and should be in the ‘spirit’ of amateur radio. Unfortunately there’s also a bit of a backlog it seems (a couple of months) right now.
Just running bird on my VPS to announce my routes to the upstream over a private link.
fee schedules FYI
- ARIN 2026 PDF: https://www.arin.net/resources/fees/images/2026feeschedule.p...
- RIPE 2026 : https://www.ripe.net/membership/payment/
Enthusiasts, trainees and small orgs are paying a lot more with RIPE.
Can this tunnel be avoided somehow? If I have to choose between owning my prefix and having 1500 MTU, I'd probably take the latter: MTU issues are so annoying to deal with, and MSS-clamping doesn't solve all of them.
The whole point of BGP is to influence your routing tables. This fundamentally makes very little sense to do when you have a bunch of routers whose routing policy you don't control between you and whoever you're speaking BGP to. eBGP is just TCP and supports knobs to run over multiple hops (so up to 255), but at that point you can't really do anything with the routing information you exchange because the moment you hand the traffic off, the other party can do with it how it pleases. Also, very few people have enough public IP addresses for this, and on the Internet you obviously can't route RFC1918 space. Therefore, you need tunnels, so that you can be one hop away even if the tunneled traffic is traversing the Internet, and so that you can reach peers that let you announce whatever IP space you want.
The other thing you can do, of course, is to just do the same thing internal to your lab. You can absolutely stand up multiple ASN at home. I'd even argue that if you really want to learn BGP, this is a great way to do it, especially if you use two different platforms (say, FRR on FreeBSD peering with a cheap Mikrotik running RouterOS). That way you learn the underlying protocol and not a specific implementation, which is something that is very hard to undo in junior network engineers that have only ever been exposed to one way of doing things.
That's different from some of the goals outlined in the article, but if your goal is to learn this stuff rather than have provider-independent IP space (which even for home labs isn't very valuable to most people), doing it all yourself works fine.
Why disable all offloading? It's not explained anywhere.
It's a great way to explore routing technologies and safely experiment with your own AS, running the same protocols as the "real" Internet, just in private space.
If you do get set up, give me a shout (https://markround.com/dn42), I'd be happy to peer with you if you want to expand beyond the big "autopeer" networks :)
I am always very curious why these operations exist. ISPs for the very specific niche of hobbyists who want to run ASNs.
from a risk side, running your own as is the ultimate digital sovereignty move, but the operational debt is huge. most people don't realize that when you stop renting the routing from a big carrier, you're also taking on 100% of the liability for your own uptime and 'fat finger' errors. it’s a high-stakes hobby for sure.