Skip to content

Instantly share code, notes, and snippets.

Last active May 11, 2018 17:00
Show Gist options
  • Save vcaixeta/49f09dce3c80f6524a38e43d7e4cb5a4 to your computer and use it in GitHub Desktop.
Save vcaixeta/49f09dce3c80f6524a38e43d7e4cb5a4 to your computer and use it in GitHub Desktop.
# Configure logging
#log "/var/log/bird-rtbh.log" all;
log syslog { debug, trace, info, remote, warning, error, auth, fatal, bug };
define local_asn = 65001;
# Override router ID
router id;
# This pseudo-protocol performs synchronization between BIRD's routing
# tables and the kernel. If your kernel supports multiple routing tables
# (as Linux 2.2.x does), you can run multiple instances of the kernel
# protocol and synchronize different kernel tables with different BIRD tables.
protocol kernel {
learn; # Learn all alien routes from the kernel
persist; # Don't remove routes on bird shutdown
scan time 20; # Scan kernel routing table every 20 seconds
import none; # Default is import all
export none; # Default is export none
kernel table 5; # Kernel table to synchronize with (default: main)
table RTBH;
protocol kernel rtbh {
scan time 20;
import all;
export all;
table RTBH;
kernel table 100; # Kernel table to synchronize with (rtbh: 100)
# This pseudo-protocol watches all interface up/down events.
protocol device {
scan time 10; # Scan interfaces every 10 seconds
# Allow only /32 part of a specific prefix
# This function will only pass if the prefix is a /32 and part of the allowed_prefix list
function check_prefix()
prefix set allowed_prefix;
allowed_prefix = [, ];
if ! (net ~ allowed_prefix) then return false;
if net.len != 32 then return false;
return true;
#This Filter will be applied to BGP Export, it will check if check_prefix() is True and then set the Blackhole Community
if ! (check_prefix()) then
bgp_community = -empty-;
#Peer BGP Settings. We explicity select table RTBH, which makes this BGP Peer sync with the Kernel Table RTBH Only.
protocol bgp EDGE {
table RTBH;
description "Peer with Edge Router to announce /32 Prefixes to be Blackholed";
local as local_asn;
neighbor as local_asn;
import all;
export filter EXPORT_BLACKHOLED_32;
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment