initial commit

bird.conf

@@ -0,0 +1,89 @@
+protocol device {
+	scan time 10;
+}
+
+protocol static {
+	route 172.20.170.192/28 reject;
+	import all;
+	export none;
+}
+
+include "/etc/bird/local4.conf";
+
+# filter helpers
+#################
+
+##include "/etc/bird/filter4.conf";
+
+protocol kernel {
+	scan time 20;
+	metric 64;	# Use explicit kernel route metric to avoid collisions
+			# with non-BIRD routes in the kernel routing table
+	import none;
+	#export all;	# Actually insert routes into the kernel routing table
+	export filter {
+		if source = RTS_STATIC then reject;
+		krt_prefsrc = OWNIP;
+		accept;
+	};
+}
+
+filter filter_OSPF {
+	if net = 172.20.170.192/28 then accept;
+        else reject;
+};
+
+protocol ospf {
+        import all;
+        export all; 
+
+        area 0 {
+                interface "wg-ospf-triton" {
+                        cost 10;
+			type pointopoint;
+                        hello 5; retransmit 2; wait 10; dead 20;
+                        authentication cryptographic; password "R5fg2d66hTuP";
+		};
+
+                interface "wg-ospf-mail" {
+                        cost 10;
+			type pointopoint;
+                        hello 5; retransmit 2; wait 10; dead 20;
+                        authentication cryptographic; password "R5fg2d66hTuP";
+		};
+
+                interface "lo" {
+                        stub;
+                };
+        };
+}
+
+template bgp dnpeers {
+	local as OWNAS;
+	# metric is the number of hops between us and the peer
+	path metric 1;
+	# this lines allows debugging filter rules
+	# filtered routes can be looked up in birdc using the "show route filtered" command
+	import keep filtered;
+	import filter {
+		# accept every subnet, except our own advertised subnet
+		# filtering is important, because some guys try to advertise routes like 0.0.0.0
+		if is_valid_network() && !is_self_net() then {
+			accept;
+		}
+		reject;
+	};
+
+	export filter {
+		# here we export the whole net
+		if is_valid_network() then {
+			accept;
+		}
+		reject;
+	};
+
+	import limit 1000 action block;
+	#source address 172.20.170.192;
+};
+
+include "/etc/bird/peers4/*";

bird6.conf

@@ -0,0 +1,57 @@
+protocol device {
+	scan time 10;
+}
+
+# local configuration
+######################
+
+include "/etc/bird/local6.conf";
+
+# filter helpers
+#################
+
+##include "/etc/bird/filter6.conf";
+
+protocol kernel {
+	metric 64;	# Use explicit kernel route metric to avoid collisions
+			# with non-BIRD routes in the kernel routing table
+	scan time 20;
+	import none;
+#	export all;	# Actually insert routes into the kernel routing table
+	export filter {
+		if source = RTS_STATIC then reject;
+		krt_prefsrc = OWNIP;
+		accept;
+	};
+}
+
+# static routes
+################
+
+protocol static {
+	route fd62:77fb:94bf::/48 reject;
+	import all;
+	export none;
+}
+
+template bgp dnpeers {
+	local as 4242423934;
+	path metric 1;
+	import keep filtered;
+	import filter {
+		if is_valid_network() && !is_self_net() then {
+			accept;
+		}
+		reject;
+	};
+
+	export filter {
+		if is_valid_network() then {
+			accept;
+		}
+		reject;
+	};
+	import limit 1000 action block;
+}
+
+include "/etc/bird/peers6/*";

envvars

@@ -0,0 +1,3 @@
+BIRD_RUN_USER=bird
+BIRD_RUN_GROUP=bird
+#BIRD_ARGS=

local4.conf

@@ -0,0 +1,21 @@
+router id 172.20.170.192;
+
+define OWNAS =  4242423934;
+define OWNIP = 172.20.170.192;
+
+function is_self_net() {
+  return net ~ [172.20.170.192/28+];
+}
+
+function is_valid_network() {
+  return net ~ [
+    172.20.0.0/14{21,29}, # dn42
+    172.20.0.0/24{28,32}, # dn42 Anycast
+    172.21.0.0/24{28,32}, # dn42 Anycast
+    172.22.0.0/24{28,32}, # dn42 Anycast
+    172.23.0.0/24{28,32}, # dn42 Anycast
+    172.31.0.0/16+,       # ChaosVPN
+    10.100.0.0/14+,       # ChaosVPN
+    10.0.0.0/8{15,24}     # Freifunk.net
+  ];
+}

local6.conf

@@ -0,0 +1,14 @@
+router id 172.20.170.192;
+
+define OWNAS = 4242423934;
+define OWNIP = fd62:77fb:94bf::;
+
+function is_self_net() {
+  return net ~ [fd62:77fb:94bf::/48+];
+}
+
+function is_valid_network() {
+  return net ~ [
+    fd00::/8{44,64} # ULA address space as per RFC 4193
+  ];
+}

peers4/filip

@@ -0,0 +1,3 @@
+protocol bgp filip from dnpeers {
+	neighbor 172.19.2.1 as 4242421404;
+};

peers6/filip

@@ -0,0 +1,3 @@
+protocol bgp filip from dnpeers {
+  neighbor fe80::feec:daff:fe46:d60e % 'wg-bgp-filip' as 4242421404;
+};