6 ms·
Running Your Own AS: BGP on FreeBSD with FRR, GRE Tunnels, and Policy Routing
- tw04 9mo agoNot to nitpick, but the title should have AS capitalized. It’s confusing with the current capitalization.
- pickup191 9mo agoRight! I was confused for a bit until I started reading it. Otherwise, getting to know the power of FreeBSD is awesome. Thanks for creating the blog!
- ocdtrekkie 9mo agoI think HN tends to undo all caps words unless it's an acronym HN specifically recognizes. Guessing BGP, GRE, and FreeBSD are understood but AS is not.
- QuantumNomad_ 9mo agoIt’s too late now, but when submitting a post the poster has a window of time to edit the title. Useful for example when HN auto-edits to capitalisation get some words wrong. When you edit the title, those auto-edits are not applied to your edited title.
- easterncalculus 9mo agoI would imagine AS is as common as the software you'd use to run one (FRR) right?
- DarkFuture 9mo agoI looked into buying my own IP space from that IP auction site, an IPv4 C-class costs around $10,000. What stopped me was finding out I also to register with RIPE and pay the LIR annual fee, costing hundred Euros per month or so, even if I wasn't yet ready to use the IP space (I wanted to setup a basic Anycast IP without Cloudflare with help of VPS host who said they can help and had multiple locations around world).
- frantathefranta 9mo agoYeah for single person use, this only really makes sense with IPv6. I'm interested in doing this in the near future and I think the yearly price for all-in (IPv6 /48 allocation, AS allocation + necessary VPS connections) comes out to about $200. It goes up to $300-400 if you want a PI subnet instead of PA (PI follows you to another LIR, PA does not).
- rmoriz 9mo agoWhile I strongly support IPv6 migration, the current IPv4 pricing is a rip-off. All the brokers and auction sites are fantasizing. The market is tight, but nowhere near the point where it was 4-5 years ago. Big cloud providers already bought enormous amounts of IPv4 while many regional ISPs and colocation providers went out of business. There is no real pressure to buy IPv4 except for brand-new companies to get their initial /24 or /23 to start. Everything else is optional.
- direwolf20 9mo agoHow can an auction site fantasize? The price is what someone bid, and that's the real price.
- rmoriz 9mo agoThey keep details private. It's not something transparent like eBay or a public auction. I think it's just a scam to pressure buyers into offering more.
- greyface- 9mo agoWhen I bought my initial /24 on such a site, it was not a competitive auction. I was the only bidder, and I paid the opening bid price, which was set by the seller. It's true that it was a real price, in that I paid it, but the 'auction' aspect felt like a farce.
- alibarber 9mo agoIf you have a ham radio licence (anywhere in the world) you can request a /24 if IPv4 space from AMPR for free. It cannot be used commercially and should be in the ‘spirit’ of amateur radio. Unfortunately there’s also a bit of a backlog it seems (a couple of months) right now.
- candiddevmike 9mo agoI was hoping with IPv6, getting an address space as an individual would go back to how it was in the early IPv4 days, but alas you need to be a multihomed individual with tons of usage instead of just a sophisticated netzien that wants to own their block.
- deleted 9mo ago[deleted]
- dogcow 9mo agoYes, same here. Very frustrating. It is almost as if the powers that be don't want lowly netizens controlling their own destiny.
- direwolf20 9mo agoActually, they don't want to pollute the internet routing table with routes that are fully subsumed into other routes. The effect on address ownership is a side effect.
- zhouzhao 9mo agoActually, they just want to milk the money out of you. It's a matter of how much your willing to pay, as a business customer, it's all possible. Most ISP do not have such pure goals, as to protect the global routing tables ;)
- direwolf20 9mo agoRIRs, not ISPs, allocate addresses at the top level, they make money on each address allocation, and they still won't allocate addresses to you if you don't multihome because they have a duty to conserve resources. When you get PI addresses your LIR/ISP just passes your data on to the RIR.
- dboreham 9mo agoJust like many industries there's a retail side and a wholesale side. You're asking to get a wholesale product from a retail channel. If you become a wholesale customer you can get what you want, for a price.
- shon 9mo ago[flagged]
- dorianmariecom 9mo agohow much does it cost?
- deleted 9mo ago[deleted]
- rmoriz 9mo agoI do a "light" version of this, but without running a public AS and using WireGuard for tunneling my public IPv4 subnet into my homelab (proxmox cluster). Just running bird on my VPS to announce my routes to the upstream over a private link.
- matthews3 9mo agoI'd love to read about your setup!
- rmoriz 9mo agoJust a reminder, that the basic fees at RIPE are 2-3x the fees at ARIN which hurts individuals, SOHO and multihomed not-for-profit institutions. fee schedules FYI - ARIN 2026 PDF: https://www.arin.net/resources/fees/images/2026feeschedule.p https://www.arin.net/resources/fees/images/2026feeschedule.p... - RIPE 2026 : https://www.ripe.net/membership/payment/ https://www.ripe.net/membership/payment/ Enthusiasts, trainees and small orgs are paying a lot more with RIPE.
- nazcan 9mo agoGood to know. As someone on the ARIN side, I always found the fees reasonable.
- icedchai 9mo agoYou can get better deals with the right LIR. As a hobbyist it was cheaper for me to go with a RIPE LIR over ARIN. See: https://lagrange.cloud/products/lir https://lagrange.cloud/products/lir
- rmoriz 9mo agoIt's not comparable. You will lose your AS and PA if your sourcing-LIR goes out of business or increases prices against you. It's ab big difference to become a LIR or just a downstream customer.
- icedchai 9mo agoFor a hobbyist it’s perfectly fine, I think? I’ve been doing this for years. If I was a major corporation I might be more concerned.
- rmoriz 9mo agoI don't want to blame anyone for using this setup except RIPE for their fee schedule. For example, I don't have IPv6 because that would double my running costs just for RIPE.
- rnhmjoj 9mo ago> MSS clamping is non-negotiable with tunnels. Every layer of encapsulation eats into the MTU. Can this tunnel be avoided somehow? If I have to choose between owning my prefix and having 1500 MTU, I'd probably take the latter: MTU issues are so annoying to deal with, and MSS-clamping doesn't solve all of them.
- bc569a80a344f9c 9mo agoKind of but not really. The whole point of BGP is to influence your routing tables. This fundamentally makes very little sense to do when you have a bunch of routers whose routing policy you don't control between you and whoever you're speaking BGP to. eBGP is just TCP and supports knobs to run over multiple hops (so up to 255), but at that point you can't really do anything with the routing information you exchange because the moment you hand the traffic off, the other party can do with it how it pleases. Also, very few people have enough public IP addresses for this, and on the Internet you obviously can't route RFC1918 space. Therefore, you need tunnels, so that you can be one hop away even if the tunneled traffic is traversing the Internet, and so that you can reach peers that let you announce whatever IP space you want. The other thing you can do, of course, is to just do the same thing internal to your lab. You can absolutely stand up multiple ASN at home. I'd even argue that if you really want to learn BGP, this is a great way to do it, especially if you use two different platforms (say, FRR on FreeBSD peering with a cheap Mikrotik running RouterOS). That way you learn the underlying protocol and not a specific implementation, which is something that is very hard to undo in junior network engineers that have only ever been exposed to one way of doing things. That's different from some of the goals outlined in the article, but if your goal is to learn this stuff rather than have provider-independent IP space (which even for home labs isn't very valuable to most people), doing it all yourself works fine.
- direwolf20 9mo agoYou can use who you're physically connected to. If you have a physical or point–to–point connection to iFog and Lagrange Cloud, you don't need tunnels to reach them. Both these companies offer VPS services. If your goal is to learn this stuff join dn42, the global networking lab, instead of wasting money with real allocations.
- mvanbaak 9mo ago`-rxcsum -txcsum -rxcsum6 -txcsum6 -lro -tso` Why disable all offloading? It's not explained anywhere.
- mark_round 9mo agoIf you'd like to experiment with running your own AS in private address space, connecting to a friendly network of geeks over wireguard tunnels, check out DN42 https://dn42.dev/Home https://dn42.dev/Home. It's a great way to explore routing technologies and safely experiment with your own AS, running the same protocols as the "real" Internet, just in private space. If you do get set up, give me a shout (https://markround.com/dn42 https://markround.com/dn42), I'd be happy to peer with you if you want to expand beyond the big "autopeer" networks :)
- kjs3 9mo agoThis is really an amazing resource. If you don't know BGP and how to grok AS's, you aren't a fully actualized IP networking human.
- b112 9mo agoThis phrasing made me envision a future where I have 90% android replacement parts, and I actually need to know.
- kjs3 8mo agoThere's a sci-fi story in there about an android manual injecting routes to get around a failed limb. It's been fun explaining to our cloud engineers that BGP is pretty useful in AWS. Most had never touched it after they got their CCNP/CCIE. My networking cred went up a bit.
- direwolf20 9mo agoiFog and Lagrange Cloud, naturally. I am always very curious why these operations exist. ISPs for the very specific niche of hobbyists who want to run ASNs.
- deleted 9mo ago[deleted]
- smartbit 9mo agoPresentation How to become your own ISP at What Hackers Yarn camp 2025 Highly recommended for those interested https://media.ccc.de/v/why2025-9-how-to-become-your-own-isp https://media.ccc.de/v/why2025-9-how-to-become-your-own-isp https://youtube.com/watch?v=raHBq0rUdJQ https://youtube.com/watch?v=raHBq0rUdJQ