Import and export policy for my DN42 AS

Outbound: one exact prefix

I announce fd14:e78e:db29::/48 and nothing else. On the router the /48 exists only as a static blackhole route. redistribute=static on each BGP connection picks it up, and the outbound filter lets through exactly that prefix.

I went with an explicit allow rule because there’s only one prefix to announce. Any other route fails the condition, so it can’t turn into an accidental announcement.

Inbound: only prefixes that look like DN42

The inbound filter accepts a prefix only if it’s inside fd00::/8 and between /44 and /64 long, and rejects the rest. It’s the fd00::/8{44,64} check from the DN42 BIRD 2 guide, written as a RouterOS filter rule and used on all three sessions.

There’s no VRF. DN42 routes go into the main table next to my normal routes, so this same filter is what stops a peer from handing me a default route or a public prefix.

BGP and both filters run on RouterOS itself. There’s no FRR or BIRD, and I don’t run my own looking glass.

Scope and gaps

This is a side project for running and testing BGP policy on real DN42 sessions. It isn’t a commercial or client network. The work so far has been peering and routing and firewall troubleshooting, including earlier visibility problems that showed up in looking glasses and traceroute.

Known gaps: all three sessions go to one network, over one uplink, from one router. There’s no ROA/RPKI validation and no prefix limit, and the inbound filter doesn’t reject more-specifics of my own /48.