---
title: "Peering with burble.dn42"
geekdocDescription: "How to peer with burble.dn42"
weight: 10
aliases:
 - /peering
---

This page provides the information to get started on peering with the burble.dn42 network

burble.dn42 is a set of global POPs integrated to the [dn42](https://dn42.us/) network,
and new peering requests are welcome. A description of the network is available in the
[Overview](/network/overview) page.

burble.dn42 is a large network and there are some restrictions in place to protect the network and the rest of the DN42.<br/>
*Please ensure you read the information below before requesting to peer.*

## Peering Requests

Please mail **dn42@burble.com** if you'd like to peer with me.

### Peering Requirements

To peer with burble.dn42, you must meet the following requirements:

* You must have at least **two** peerings already established with other DN42 networks

  *Sorry, but burble.dn42 is not open to new starters. If you are a new starter in DN42
  please use the [peerfinder](https://dn42.us/peers) or ask on
  [IRC](https://dn42.dev/services/IRC); there are lots of other networks who will
  be happy to peer with you, and some even offer automatic peering.*
  
  *This is a tough restriction, but one that is in place to promote network diversity.*

* You must support IPv6
* You must implement ROA checks

* Contact information in the registry must always be up to date and admins must
  respond when contacted

  *Contacts must also be reachable in case of problems. In addition, the network
  is ever evolving and failure to respond to change notices may result in your
  peering being suspended.*

At a minimum, I'll need to know the following in order to establish a peering:

* The burble.dn42 node you would like to peer with
* Your ASN
* The public address of your host
* The tunnel and BGP parameters, e.g.
  * Port number, if using wireguard or OpenVPN
  * Public key for wireguard
  * Any special config you need that is different to my defaults
    * (see the [Supported Tunnel Types](https://wdev.burble.dn42:443/network/peering/#supported-tunnel-types) and [BGP Feature Support](https://wdev.burble.dn42/network/peering/#bgp-feature-support) sections)
* IP addresses of your end of the tunnel
  * Typically these will be a single IPv4/32 and Link-Local IPv6 address
<p> </p>

All peerings will be configured as a full transit session.

{{<hint info>}}
**Residential ISPs and Dynamic IP Addresses**

A 24/7 connection, with static IP addresses are the norm for DN42. If you are
connecting from a residential ISP or otherwise have a dynamic IP please let me
know so that I can configure my side appropriately. If you don't do tell me, the
peering may stop working when your IP address changes.
{{</hint>}}

{{<hint info>}}
**Peering in Multiple Locations**

If you have multiple nodes, you are welcome to peer in several locations
to provide additional redundancy and route choice. Routes exported from the
network include a latency based MED attribute to help peers
optimise their routing (See the [Routing Policy](https://wdev.burble.dn42:443/network/routing-policy/#bgp-med))

It's highly recommended to peer with multiple DN42 users though, it's
lots of fun and you should never rely on just one user for your connectivity.
{{</hint>}}

### Supported Tunnel Types

I prefer to use [wireguard](https://wireguard.io/), it's simple to set up and just works.
I also support OpenVPN tunnels. 

#### Wireguard

- The port number will be 2xxxx where xxxx is the last four digits of your ASN.
- Each peer is assigned a unique encryption key, pre-shared keys are also supported (but not enabled by default).
- Endpoint names and IP addresses are detailed in the [nodes](/network/nodes) page.

My wireguard AllowedIPs are:
```
AllowedIPs=fe80::/64
AllowedIPs=fd00::/8
AllowedIPs=0.0.0.0/0
```

{{<hint warning>}}
**Use of wg-quick**

Using wg-quick is not recommended as it does not support adding a peer address.
If you want to use wg-quick you will need to delete and re-add the wireguard
interface IP address and configure it as a point to point address or you will
run in to next-hop problems when using BGP. You must read the
[DN42 Wiki](https://dn42.dev/howto/wireguard) on how to set up wg-quick for use
within DN42.
{{</hint>}}
  
#### OpenVPN

- The port number will be 2xxxx where xxxx is the last four digits of your ASN.

By default I will configure the following OpenVPN parameters:
```
comp-lzo
cipher aes-256-cbc
auth sha256
```

## Tunnel Configuration

### Allowed Traffic

Only the following network ranges will be forwarded through the DN42 network, all other
traffic will be dropped.

IPv4
```
172.16.0.0/12
10.0.0.0/8
```

IPv6
```
fd00::/8
```

{{<hint info>}}
BGP peer addresses are more permissive to allow for link local or non-DN42
IP addresses within the tunnel, but these will not be forwarded through the
DN42 network.
{{</hint>}}

### Flow Control and BGP Rate Limiting

A typical BGP session in DN42 will use a trivial amount of traffic. However, for large networks like
burble.dn42 some transient events, such as BGP flapping, can generate multi MB/sec traffic flows that
damage the network and create instability across DN42.

To protect the network from misconfigurations and prevent excessive updates from propagating to the
rest of DN42, the burble.dn42 network implements rate limiting on BGP sessions. The rate limiting
activates when a large amount of BGP traffic is seen (typically 10's or 100's of thousands of
updates a second) over a sustained period and will typically reset automatically within an hour.

There are no other controls applied to transit or non-BGP traffic.

## BGP Configuration

|||
|---|---|
|**Network Name** |BURBLE|
|**BURBLE-MNT**|dn42@burble.com|
|**ASN**|AS4242422601|

### BGP Feature Support

The burble.dn42 network uses a custom build of
[bird 2](https://bird.network.cz/?get_doc&f=bird.html&v=20), and the
following features are supported:

* Multiprotocol BGP - [RFC 4760](https://www.rfc-editor.org/info/rfc4760)
* BGP Large Communities - [RFC 8092](http://www.rfc-editor.org/info/rfc8092)
* BGP Confederations - [RFC 5065](https://www.rfc-editor.org/info/rfc5065)
* Extended Next Hop - [RFC 5549](https://www.rfc-editor.org/info/rfc5549)
* Extended Messages - [RFC 8654](https://www.rfc-editor.org/info/rfc8654)
* DN42 Route Origin Authorisation (ROA - see below section on Route Filtering) 
* DN42 [BGP communities](https://wiki.dn42.us/howto/Bird-communities)
* burble.dn42 custom [large communities](/network/communities)
* burble.dn42 [Routing Policy](/network/routing-policy)

The source code for the custom bird used on the network is available on
[git.burble.dn42](https://git.burble.dn42/burble.dn42/bird)

#### Default Extensions

Multiprotocol BGP is preferred, however it is not enabled by default as not all
peers can support it. Please let me know when peering if you can support a
multiprotocol BGP session. 

Extended next hop and extended message support are both enabled by default.

### Route Filtering

The network applies strict Route Origin Authorisation (ROA) filtering to all
received and exported routes. This means any advertised route that does
not have a corresponding route{,6} object in the DN42 registry will be dropped.

{{<hint info>}}
ROA is implemented with updates through RPKI, using
[dn42regsrv](https://git.dn42.us/burble/dn42regsrv) and
[gortr](https://github.com/cloudflare/gortr).

The DN42 ROA data is provided as a public service, see the [Services](/services/public) page.
{{</hint>}}

#### Generic Allowed Prefixes:

IPv4
```
172.20.0.0/14+
10.0.0.0/8+
```

IPv6
```
fd00::/8{44,64}
```

## Testing

### Connectivity Testing

Within the tunnel, hosts respond to ping and traceroute, but also have the
echo (port 7) and daytime (port 13) services enabled. These can be used to check
the tunnel is up and configured correctly.

```
$ ping fe80::42:2601:32:1%wg0
PING fe80::42:2601:32:1%wg0(fe80::42:2601:32:1%wg0) 56 data bytes
64 bytes from fe80::42:2601:32:1%wg0: icmp_seq=1 ttl=64 time=4.44 ms
64 bytes from fe80::42:2601:32:1%wg0: icmp_seq=2 ttl=64 time=4.52 ms
64 bytes from fe80::42:2601:32:1%wg0: icmp_seq=3 ttl=64 time=4.96 ms
^C
--- fe80::42:2601:32:1%wg0 ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2003ms
rtt min/avg/max/mdev = 4.445/4.643/4.961/0.233 ms
$ netcat fe80::42:2601:32:1%wg0 13
Sun Sep 23 09:57:26 2018
^C
$
```

### Reachability Testing

Once peering is established I have a [BGP looking glass](https://lg.burble.com/) (public
internet link) and global route [collector](https://grc.burble.com) which can be used to
check routing configuration. Looking glasses are a key, self-service resource for you
to use when understanding how your routes are propagating around the DN42 network, please
take the time to learn how to use them. 

### Speed Test

burble.dn42 operates two speed test servers on central, high bandwidth nodes.<br/>
See the [services](/services/public) pages for more info. 

### Automated Tests

pingable.burble.dn42 (172.20.129.5 / fd42:4242:2601:ac05::1) is a dedicated address
that responds to ping and traceroute and may be used for automated reachability or
link quality testing.

{{<hint warning>}}
Please be considerate when configuring automated tests and set a reasonable test
frequency.

**In all cases, the frequency must not be more than once a second.**<br/>
Please consider this if your router automatically pings its tunnel endpoint for
stats purposes.
{{</hint>}}

