Play around: BGP and the DN42

As far as I am concerned, networking is one of the most fascinating aspects of computing. Connecting people and systems sounds like an easy problem to solve, but looking into the details and the scale of something like the internet, shows that networking is far from easy. While most developers and administrators understand the basics of local IP routing and maybe even OSPF, not many understand how global scale, carrier focused networking works. To understand how the internet works one has to understand routing. To understanding routing on a global, internet scale level, one has to understand the exterior Border Gateway Protocol (eBGP).

Now with our local setup’s, BGP isn’t really something that we use on a daily base (unless you work on the DE-CIX, ASM-IX or at Level3). We need to a bigger network to learn about the details. While we are obviously not being able to learn about BGP on the real internet, we want to build something similiar to the internet to help us learn and hack on this stuff.

welcome to the dn42

The dn42 is a darknet build by members of the German Chaos Computer Club. It connects people on a ISP level and somewhat replicate common internet services like a registry, anycast DNS, whois, etc. The project aims to facilitate understanding how the internet works and build up a darknet at the same time.

The dn42 uses the 172.22.0.0/15 address range out of IANAs reserved, non-publicly routed subnets. A participant of the dn42 usually allocates a /24 from this 172.22.0.0/15 pool by entering the necessary information into the registry. The registry is build similar to the RIPE/ANIC registry. Once a subnet is allocated, a participant has to start peering and announcing the network. The participant has a role similar to a e.g. an ISP in the internet, who announces his allocated subnet to the internet. Just like ISPs and Tier3 up to Tier1 carriers, participants in the DN42 talk eBGP with each other over a secured line.

how the internet works (for dummies and simple..blabla)

So how does your computer know how to get to youtube.com? Your PC got a gateway address from your ISP, so your computer is simply sending everything he doesn’t know how to route to the gateway. But how does the ISP know where the youtube.com computer is? The internet folks thought about this for a very long time before they came up with “BGP”. In BGP, an internet router advertises which routes he can handle himself to his neighbors. For example the German Telekom asks the European Internet Registry for a subnet. Once it got his subnet allocated, their routers start to announce to their peering partners (e.g. French Telecom, Austrian Telecom, Google, etc) that they are now capable of routing the subnet. The neighbors itself announce this new route to their neighbors and so on. Routes are handled by autonomous systems (AS). The German Telekom owns an autonomous system and within the autonomous system, they do whatever routing necessary to get to the right computer. For other autonomous systems like French Telecoms all that matters is that subnet W.X.Y.Z/NN is handled by the German Telekom AS, so they know to sent a package designated for that subnet to the German Telecom AS and don’t have to deal with it any further.. So if the French Telecom sees a package in their network that they know the German Telekom can handle, they are just forwarding it to it, and be done with it.

In DN42 this the network works just like that, just in small scale. You are a big ISP. You have an AS number, a number of peering AS and you announce the subnet that you can route. All autonomous systems will deliver packages for that subnet to you. It’s your responsibility to route them properly. In addition if you can reach an AS faster (in less hops) than another, your peers will start sending your packages to forward to the appropriate AS. So as an ISP you handle traffic designated for you, but also forward packages to others AS if necessary.

your first subnet

So you allocated your new /24 subnet. As an owner of the fresh subnet, one has to start announcing the subnet within the dn42 by telling all other participants in the network that your router is responsible for routing the whole subnet, therefore “announcing” the particular route to the network. Like in the internet, this is done using the exterior Border Gateway Protocol (eBGP). Common software implementations for small scale purposes like the DN42 are Bird and Quagga. To establish a first connection the network, a participant will need a trusted peer that is willing to start peering with him. The connection to the peer is established using a VPN tunnel, usually OpenVPN or IPsec. Once the tunnel is established the participant configures his BIRD to start announcing the his subnet (172.23.217.0/24):

# Configure logging
log syslog { debug, trace, info, remote, warning, error, auth, fatal, bug };

# Override router ID
router id 172.23.217.1;

# This pseudo-protocol performs synchronization between BIRD's routing
# tables and the kernel. If your kernel supports multiple routing tables
# (as Linux 2.2.x does), you can run multiple instances of the kernel
# protocol and synchronize different kernel tables with different BIRD tables.
protocol kernel {
	scan time 20;		# Scan kernel routing table every 20 seconds
	import all;
	export where source != RTS_STATIC;
}

# This pseudo-protocol watches all interface up/down events.
protocol device {
	scan time 10;		# Scan interfaces every 10 seconds
}

Posted September 16th, 2013 in Open Source.

Comments are closed.