BGP with OpenBSD

IMAGE HERE

Here we have five BGP nodes, all doing transit between peers, and obsd3 announcing a default route instead.

vpcs*

ip 10.0.0.1/24 10.0.0.254
ip 10.3.3.1/24 10.3.3.254
save

workstation (libvirt)

no need for static routes because we’re doing NAT within the PoC (on obsd3)

obsd*

hostname obsd1
hostname obsd2
hostname obsd3
hostname obsd4
hostname obsd5

vi /etc/myname

obsd1
obsd2
obsd3
obsd4
obsd5

vi /etc/hostname.vio0

inet 1.2.3.1/24
inet 1.2.3.2/24
inet 1.2.3.3/24
inet 10.1.1.1/24
inet 10.2.2.1/24

vi /etc/hostname.vio1

inet 10.1.1.245/24
inet 10.2.2.254/24
dhcp
inet 10.0.0.254/24
inet 10.3.3.254/24

rm -f /etc/mygate

sh /etc/netstart

    sysctl net.inet.ip.forwarding=1
    sysctl net.inet6.ip6.forwarding=1
    echo net.inet.ip.forwarding=1 >> /etc/sysctl.conf
    echo net.inet6.ip6.forwarding=1 >> /etc/sysctl.conf

vi /etc/bgpd.conf

    AS 65001
    AS 65002
    AS 65003
    AS 65004
    AS 65005
    router-id 1.2.3.1
    router-id 1.2.3.2
    router-id 1.2.3.3
    router-id 10.1.1.1
    router-id 10.2.2.1

    connect-retry 30
    log updates
    network inet connected

    neighbor 1.2.3.1 {
            remote-as 65001
            announce IPv4
    }

    neighbor 10.1.1.254 {
            remote-as 65001
            announce IPv4
    }

    neighbor 1.2.3.2 {
            remote-as 65002
            announce IPv4
    }

    neighbor 10.2.2.254 {
            remote-as 65002
            announce IPv4
    }

    neighbor 1.2.3.3 {
            remote-as 65003
            announce IPv4
    }

    neighbor 10.1.1.1 {
            remote-as 65004
            announce IPv4
    }

    neighbor 10.2.2.1 {
            remote-as 65005
            announce IPv4
    }

    allow from any
    allow to any

bgpd -nf /etc/bgpd.conf
    rcctl enable bgpd
    rcctl restart bgpd

bgpctl show
bgpctl show rib

obsd3 only

    vi /etc/bgpd.conf

network inet connected
network 0/0

mv /etc/pf.conf /etc/pf.conf.dist
    vi /etc/pf.conf

    pass out on vio1 from 10.0.0.0/24 to any nat-to (vio1)
    pass out on vio1 from 10.1.1.0/24 to any nat-to (vio1)
    pass out on vio1 from 10.2.2.0/24 to any nat-to (vio1)
    pass out on vio1 from 10.3.3.0/24 to any nat-to (vio1)
    pass out on vio1 from 1.2.3.0/24 to any nat-to (vio1)

    pfctl -nf /etc/pf.conf
    pfctl -f /etc/pf.conf

vpcs1

ping 10.3.3.1
trace 10.3.3.1

ping 192.168.122.1
trace 192.168.122.1

ping 1.1.1.1
trace 1.1.1.1

vpcs2

ping 192.168.122.1
trace 192.168.122.1

ping 1.1.1.1
trace 1.1.1.1

Advanced

# Martians IPv4
deny from any prefix 0.0.0.0/8 prefixlen >= 8
deny from any prefix 127.0.0.0/8 prefixlen >= 8
deny from any prefix 169.254.0.0/16 prefixlen >= 16
deny from any prefix 198.18.0.0/15 prefixlen >= 15

# Martians IPv6
deny from any prefix ::1/128
deny from any prefix ::/128
deny from any prefix ::ffff:0:0/96 prefixlen >= 96
deny from any prefix 64:ff9b::/96 prefixlen >= 96

# Filtering too specific prefixes
deny from any inet prefixlen > 24

# Default route filtering
deny from any inet prefix 0.0.0.0/0 prefixlen = 0
deny from any inet6 prefix ::/0 prefixlen = 0

# AS_PATH filtering
enforce neighbor-as yes