Skip to content

Instantly share code, notes, and snippets.

@vcaixeta

vcaixeta/BIRD_RTBH_Example

Last active May 11, 2018
Embed
What would you like to do?
# Configure logging
#log "/var/log/bird-rtbh.log" all;
log syslog { debug, trace, info, remote, warning, error, auth, fatal, bug };
define local_asn = 65001;
# Override router ID
router id 10.0.0.100;
# This pseudo-protocol performs synchronization between BIRD's routing
# tables and the kernel. If your kernel supports multiple routing tables
# (as Linux 2.2.x does), you can run multiple instances of the kernel
# protocol and synchronize different kernel tables with different BIRD tables.
protocol kernel {
learn; # Learn all alien routes from the kernel
persist; # Don't remove routes on bird shutdown
scan time 20; # Scan kernel routing table every 20 seconds
import none; # Default is import all
export none; # Default is export none
kernel table 5; # Kernel table to synchronize with (default: main)
}
table RTBH;
protocol kernel rtbh {
learn;
persist;
scan time 20;
import all;
export all;
table RTBH;
kernel table 100; # Kernel table to synchronize with (rtbh: 100)
}
# This pseudo-protocol watches all interface up/down events.
protocol device {
scan time 10; # Scan interfaces every 10 seconds
}
# Allow only /32 part of a specific prefix
# This function will only pass if the prefix is a /32 and part of the allowed_prefix list
function check_prefix()
prefix set allowed_prefix;
{
allowed_prefix = [ 203.0.113.128/25+, 1.1.1.0/24+ ];
if ! (net ~ allowed_prefix) then return false;
if net.len != 32 then return false;
return true;
}
#This Filter will be applied to BGP Export, it will check if check_prefix() is True and then set the Blackhole Community
filter EXPORT_BLACKHOLED_32
{
if ! (check_prefix()) then
reject;
bgp_community = -empty-;
bgp_community.add((local_asn,666));
accept;
}
#Peer BGP Settings. We explicity select table RTBH, which makes this BGP Peer sync with the Kernel Table RTBH Only.
protocol bgp EDGE {
table RTBH;
description "Peer with Edge Router to announce /32 Prefixes to be Blackholed";
local as local_asn;
neighbor 10.0.0.1 as local_asn;
import all;
export filter EXPORT_BLACKHOLED_32;
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment