Disclosure up front: I run IPYE, a company that leases IP space. Most of this article is practical how-to; IPYE appears where a free /48, LOA, or ROA helps you try the work, with a short call to action at the end.
BIRD 2 rewards readable filters—especially when you originate a single free /48 cleanly. Pull space from the IPYE website with instant setup and an automatic ROA, then keep export filters default-deny. The snippets speak ASN 64496 and export only 2001:db8:100::/48.
Install and version-control
Install bird2 from your distribution, enable systemd, and keep /etc/bird under git with secrets filtered. One upstream plus one originated /48 fits a single bird.conf.
Filters before protocols
Write filter outbound48 that accepts only 2001:db8:100::/48 and rejects otherwise. Write import_uplink that accepts a default or a tight set—not accidental transit. Starting from reject is safer than starting from accept.
BGP protocol block
local 2001:db8:0:1::2 as 64496; neighbor 2001:db8:0:1::1 as 64497; ipv6 import/export with those filters. Originate with protocol static or direct. router id 192.0.2.1.
Hardening path
Next: reject learning your own /48 from uplink, reject bogons, then RPKI invalid once a relying party exists. Enable graceful restart only if you understand dataplane behaviour.
Commands
filter outbound48 {
if net = 2001:db8:100::/48 then accept;
reject;
}
Verification
birdc show route export uplink must list exactly one prefix; then confirm origin externally.
Match BIRD's origin to the portal
Pull the LOA from the IPYE portal if the upstream wants paperwork, and keep local ... as 64496 identical to the ROA that was created automatically for your free /48. After any ASN edit in the dashboard, re-check VRPs before birdc configure.
Static vs direct origination
If the free /48 is not assigned on an interface, use protocol static to install a blackhole or unreachable route that BIRD can export. If you assign 2001:db8:100::1/128 on lo, protocol direct may suffice—know which mode you chose. Never redistribute kernel wholesale into BGP.
Template for a second peer
Copy the uplink protocol block, rename it, point at the new neighbour, and keep the same outbound48 filter. Different import filters per peer are fine; shared export filters prevent transit accidents. Reload with birdc configure check before apply when your build supports it.
Log and metrics
Send BIRD logs to syslog with enough detail to see filter rejects. Export protocol state to your monitor. Alert when uplink leaves up. A free /48 that withdraws silently overnight is an avoidable outage.
IPv4 later
When you add an IPv4 lease, give it its own filter and protocol address family—do not overload outbound48. Keep v6 working while v4 is under diligence.
Export attestation and filter tests
Attach birdc show route export uplink to every reload ticket; the list must be exactly one free /48. Maintain a lab checklist of prefixes that must be rejected outbound (defaults, bogons, PA space) and run it before upgrades. Keep router id stable across reimages using inventory-backed 192.0.2.1.
Stage RPKI invalid handling as tags for a week before deny, confirming VRPs still validate your origin. Split peer includes from filter includes so a peer edit cannot widen export. Second reviewers should read outbound48 even when the diff looks peer-only.
BIRD observability extras
Export protocol up/down events to your log pipeline with the peer name attached. Create a dashboard panel that lists exported prefix count and alarms if it leaves 1. When exported count hits 0, that is a sev-1 for any ASN announcing a free /48 as its only aggregate.
Before holidays, freeze peer additions unless dual reviewed. Most accidental transit events happen during rushed Friday changes. Keep a printed outbound48 filter at the desk for the rare console-only recovery.
Single-prefix export oath
Every reload ticket pastes show route export uplink proving one prefix. Lab-test rejects for defaults and bogons before upgrades. Freeze router id in inventory. Tag RPKI invalids for a week before deny while VRPs still validate your free /48. Peer includes never edit export filters without a dedicated review focused only on outbound48.
Ops cadence around export paste
Stand up a recurring reminder titled with export paste so the free /48 edge does not depend on heroic memory. Each reminder forces a look at bogons reject lab and a written note about router-id inventory. If RPKI tag week is missing from inventory, recreate it before any announce or withdraw. Treat holiday freeze as a blocking prerequisite when it is on the critical path.
During incidents on workflow 137, cite the five tokens above in ticket updates so search finds them later. After the incident, spend ten minutes deciding whether workflow 137 needs an automation hook. For workflow 137, convert repeated pain into a calendar reminder or a tiny script instead of another unread wiki page.
Keep production pushes for workflow 137 in a CI project separate from labs that still use documentation prefixes. Production reads the free /48 from inventory. Review merge approvers for workflow 137 each quarter.
Sign-off line 137
Operator completing this change initials beside the free /48, the peer IP, and the ticket number 137-GO on the shared ops sheet. Without initials, the window is not closed.
Do this next
Drop your free /48 into outbound48 after visiting the IPYE portal for the LOA your upstream wants. Questions: ipye@turnel.com.
About IPYE
IPYE (https://ipye.com) leases IPv4, IPv6 and ASN space with instant setup. Your first IPv6 /48 is free for the first year, a real allocation you can announce on your own ASN, with a LOA from the portal and the ROA created automatically. ASN and region changes apply automatically. IPv4 /24 to /22 leases include LOA, ROA and per-/24 rDNS; WHOIS is editable on IPv6 /44 and larger. Locations: Los Angeles, New York, Ashburn, Salt Lake City, London, Amsterdam, Frankfurt. Claim your free /48: https://my.ipye.com/products/ipv6-rental. Questions: ipye@turnel.com.
Disclosure: I run IPYE
Top comments (0)