DN42 之旅：搭建多节点 BGP 网络

define OWNAS =  4242423322;
define OWNIP =  172.23.100.180;
define OWNIPv6 = fd48:8669:9f9f::8;
define OWNNET = 172.23.100.160/27;
define OWNNETv6 = fd48:8669:9f9f::/48;
define OWNNETSET = [172.23.100.160/27+];
define OWNNETSETv6 = [fd48:8669:9f9f::/48+];

router id OWNIP;

protocol device {
  scan time 10;
}

function is_self_net() {
  return net ~ OWNNETSET;
}

function is_self_net_v6() {
  return net ~ OWNNETSETv6;
}

function is_valid_network() {
  return net ~ [
  172.20.0.0/14{21,29}, # dn42
  172.20.0.0/24{28,32}, # dn42 Anycast
  172.21.0.0/24{28,32}, # dn42 Anycast
  172.22.0.0/24{28,32}, # dn42 Anycast
  172.23.0.0/24{28,32}, # dn42 Anycast
  172.31.0.0/16+,       # ChaosVPN
  10.100.0.0/14+,       # ChaosVPN
  10.127.0.0/16{16,32}, # neonetwork
  10.0.0.0/8{15,24}     # Freifunk.net
  ];
}

function is_valid_network_v6() {
  return net ~ [
  fd00::/8{44,64} # ULA address space as per RFC 4193
  ];
}

protocol kernel {
  scan time 20;
  ipv6 {
    import none;
    export filter {
      if source = RTS_STATIC then reject;
      krt_prefsrc = OWNIPv6;
      accept;
    };
  };
};

protocol kernel {
  scan time 20;
  ipv4 {
    import none;
    export filter {
      if source = RTS_STATIC then reject;
      krt_prefsrc = OWNIP;
      accept;
    };
  };
}

protocol static {
  route OWNNET reject;
  ipv4 {
    import all;
    export none;
  };
}

protocol static {
  route OWNNETv6 reject;
  ipv6 {
    import all;
    export none;
  };
}

include "rpki.conf";
include "ospf.conf";
include "ibgp.conf";
include "ebgp.conf";

roa4 table dn42_roa;
roa6 table dn42_roa_v6;

protocol rpki dn42_rpki {
  roa4 { table dn42_roa; };
  roa6 { table dn42_roa_v6; };
  remote "rpki.akae.re" port 8082;
  refresh 30;
  retry 5;
  expire 600;
}

template bgp dn42_peers {
  local as OWNAS;
  path metric 1;

  ipv4 {
    extended next hop;
    #import limit 1000 action block; #限制从他人哪里导入路由的数量
    import keep filtered;
    import filter {
      if is_valid_network() && !is_self_net() then {
        if (roa_check(dn42_roa, net, bgp_path.last) != ROA_VALID) then {
          print "[dn42] ROA check failed for ", net, " ASN ", bgp_path.last;
          reject;
        }
        accept;
      }
      reject;
    };
    export filter {
      if is_valid_network() && source ~ [RTS_STATIC, RTS_BGP] then accept;
      reject;
    };
  };

  ipv6 {
    #import limit 1000 action block;
    import keep filtered;
    import filter {
      if is_valid_network_v6() && !is_self_net_v6() then {
        if (roa_check(dn42_roa_v6, net, bgp_path.last) != ROA_VALID) then {
          print "[dn42] ROA check failed for ", net, " ASN ", bgp_path.last;
          reject;
        }
        accept;
      }
      reject;
    };
    export filter {
      if is_valid_network_v6() && source ~ [RTS_STATIC, RTS_BGP] then accept;
      reject;
    };
  };
}

include "dn42_peers/*";

auto dn42
iface dn42 inet static
    address 172.23.100.180
    netmask 255.255.255.255
    pre-up ip link add dn42 type dummy || true
    up ip link set dn42 up
iface dn42 inet6 static
    address fd48:8669:9f9f::8/128

protocol bgp <BGP 会话名> from dn42_peers {
    neighbor <对方的 LLA 地址> % '<WireGuard 隧道名>' external;
    description "<对方联系信息 非必需>";
}

protocol bgp <BGP 会话名> from dn42_peers {
    neighbor <对方的 LLA 地址> % '<WireGuard 隧道名>' external;
    description "<对方联系信息 非必需>";
    
    ipv4{
        extended next hop;
    };
}

protocol bgp <BGP 会话名> from dn42_peers {
    neighbor <对方的 IPv4/v6 地址> as <对方ASN>;
    description "<对方联系信息 非必需>";
}

protocol ospf v3 dn42_vcnet_ospf {
  ipv4 {
    import where is_self_net() && source != RTS_BGP;
    export where is_self_net() && source != RTS_BGP;
  };
  include "ospf-area.conf";
};

protocol ospf v3 dn42_vcnet_ospf6 {
  ipv6 {
    import where is_self_net_v6() && source != RTS_BGP;
    export where is_self_net_v6() && source != RTS_BGP;
  };
  include "ospf-area.conf";
};

area 0.0.0.0 {
  # Dummy 网卡名称
  interface "dn42" { stub; };
  # ZeroTier 网卡名称
  interface "ztugawjlkq" {
    cost 160;
    type broadcast;
  };
};

template bgp ibgpeers {
  local as OWNAS;
  ipv4 {
    import filter {
      import where source = RTS_BGP && is_valid_network() && !is_self_net();
      export where source = RTS_BGP && is_valid_network() && !is_self_net();
      next hop self;
      extended next hop;
    };
    ipv6 {
      import where source = RTS_BGP && is_valid_network_v6() && !is_self_net_v6();
      export where source = RTS_BGP && is_valid_network_v6() && !is_self_net_v6();
      next hop self;
    };
  };

include "ibgp/*";

protocol bgp '<BGP 会话名>' from ibgpeers {
  neighbor <其他节点的 IPv6 ULA 地址> as OWNAS;
}

define DN42_REGION = 52;   	# 52代表亚洲东部地区
define DN42_COUNTRY= 1344; 	# 1344代表香港

protocol bgp dn42_flapalerted {
  local as OWNAS; 

  # 修改成 FlapAlerted 设置的 ASN 和 BGP IP/端口。
  # 这里我们使用和自己网络相同的 ASN，是为了利用 BGP 协议不会把来自 iBGP 的路由（即自己其它节点的路由）转发给 iBGP Peer 的特点。
  # 除非你开启了 add paths 选项，否则来自自己其它节点的路由只会包含最优的路由，如果 Flapping 发生在次优路由就会被隐藏。
  # 因此建议有多个节点的用户在每个节点上都单独和 FlapAlerted 建立连接。
  
  neighbor <FlapAlerted 的地址> as OWNAS port 1790;

  ipv4 {
    # 开启 add paths 选项，把非最优路由也发给 FlapAlerted，让次优路由 Flapping 也可见。
    add paths on;
    export all;
    import none; # 不需要从 FlapAlerted 接收任何路由
  };

  ipv6 {
    add paths on;
    export all;
    import none;
  };
}

# 新建专用于 FlapAlerted 的 ROA 表
roa4 table roa_flap_v4;
roa6 table roa_flap_v6;

protocol rpki dn42_rpki_flapalerted {
  roa4 { table roa_flap_v4; };
  roa6 { table roa_flap_v6; };
  remote 10.22.44.5 port 8083; # 修改成 StayRTR 监听的端口
  max version 1;
  retry keep 15; # 如果连接中断，每 10 秒重连一次
};