template bgp dnpeers { local as OWNAS; table T_BGP; # metric is the number of hops between us and the peer path metric 1; import all; export all; }; template bgp iBGP_Peer { local as OWNAS; hold time 15; igp table T_OSPF; path metric on; import keep filtered; # import where iBGP_import_peer_policy(); # export where iBGP_export_peer_policy(); import all; export all; source address OWNIP_IBGP; next hop self; } template pipe iBGP_Pipe { # table name will come from peer definition peer table master; import all; export all; } roa table dn42_roa { include "/var/lib/bird/bird_roa_dn42.conf"; }; protocol pipe { table master; peer table T_BGP; import filter { if (roa_check(dn42_roa, net, bgp_path.last) = ROA_INVALID) then { print "[dn42] ROA check failed for ", net, " ASN ", bgp_path.last; reject; } # accept every subnet, except our own advertised subnet # filtering is important, because some guys try to advertise routes like 0.0.0$ if is_valid_network() && !is_self_net() then { accept; } reject; }; export filter { # here we export the whole net if is_valid_network() then { accept; } reject; }; };