Dynamic routing (BGP)

OpenBSD bgpd(8) router: peer with neighbouring routers and originate your prefixes. OSPF →

{{#DRIFT_BADGE}}{{#B_UNSAVED}}Unsaved edits{{/B_UNSAVED}}{{#B_DRIFT}}{{B_LABEL}}{{/B_DRIFT}}{{#B_OK}}In sync{{/B_OK}}{{/DRIFT_BADGE}}

This can take up to a couple of minutes (bgpd -n runs on the router); the page will update when it completes.

Confirm BGP change

A live BGP change by {{PENDING_ACTOR}} is awaiting confirmation and reverts automatically in {{PENDING_REMAINING}} seconds unless you keep it. If the change severed your own path to this box, simply do nothing — the previous routing configuration restores itself.

Automatic revert failed — the routing configuration may be in an inconsistent state. The change keeps retrying in the background; if it persists, resolve it from the console.

A confirm window is open on {{PENDING_OTHER_SVC}} — resolve it on that page before applying routing changes.

Existing routing configuration detected

This router has an unmanaged routing configuration. Applying from this page takes ownership of it. Any existing bgpd config is preserved to bgpd.conf.preadopt before the first overwrite, and shown read-only here — it is never imported automatically.

{{LIVE_PREVIEW}}

Preview truncated — the full file is preserved on adoption.

Configured {{ENABLED_LABEL}} bgpd {{RUNNING_LABEL}} Route policy {{POSTURE_LABEL}}

The bgpd service state does not match the configuration — applying re-synchronizes it.

A confirm window is open — the live /etc/bgpd.conf intentionally differs from the saved configuration until the change is confirmed or reverted.

⚠ BGP is enabled but IPv4 forwarding is off — this router peers and announces routes but will not forward transit traffic. Enable it under Setup → Network tuning.

Route policy

How this router treats routes it learns from peers. The posture is the single most important BGP safety setting.

Originate-only (recommended) — announce only the prefixes you list under Networks; never re-announce routes learned from peers. Leak-safe by default. {{#CAP_BGP_TRANSIT}} Apply policy (advanced) — accept and shape learned routes with import rules, but still announce only your own prefixes. Exports stay anchored to your Networks, so this is leak-safe. Allow transit (advanced) — re-announce learned routes according to your export policy. This can leak a transit table; the daemon requires an explicit acknowledgement. {{/CAP_BGP_TRANSIT}} {{#NO_TRANSIT}} Allow transit (advanced) — not yet available: transit needs the route-policy engine (planned). Until then this router only originates its own prefixes and never re-announces learned routes. {{/NO_TRANSIT}}

Peering is by IP address. Each neighbour shows a 🔒 MD5 or ⚠ no auth chip: assign a TCP-MD5 session key (RFC 2385) in the Neighbours tab to protect a session against on-path injection or reset. Manage keys under Authentication below.

BGP router

Run BGP on this router

Editing a neighbor description reloads bgpd without dropping BGP sessions; adding or removing neighbors, or changing the router ID, AS numbers, MD5 keys, filters, or other options restarts it, briefly resetting sessions.

Local AS number Router ID (optional) Connect-retry (seconds, optional)

A private AS (64512–65534, or 32-bit 4200000000–4294967294) is the usual choice unless an upstream assigned you one. Connect-retry (1–3600s, default 120) is how long bgpd waits before retrying a failed outbound connection.

Install learned routes into the kernel (fib-update) — uncheck to exchange routes but not change the routing table. {{BGP_MGMT_ADVISORY}}

Neighbours

Each peer's IP address and AS number. Passive waits for the peer to connect (never initiates) — use it when this router should not dial out, or for safe testing. The eBGP/iBGP chip is derived from the remote AS versus your local AS.

Peer groups

A group sets common session defaults (remote AS, max-prefix, enforce-neighbor-as, TCP-MD5) once; member neighbours inherit them unless they set their own. Assign a neighbour to a group with the Group selector on its card. A dynamic-peer template (a neighbour entered as a CIDR, e.g. 198.51.100.0/24) accepts sessions from any host in the range and must belong to a group; an open template (no remote AS anywhere) must carry TCP-MD5, or enforce-neighbor-as plus a max-prefix.

Networks to advertise

Prefixes this router originates (e.g. 10.50.0.0/24), one per row. bgpd announces a prefix only when a matching route exists in the kernel.

Route policy

Import/export filter rules, plus the named prefix-sets and as-sets they match on. Rules only take effect under the Apply policy or Allow transit posture (set on the Router tab); under Originate-only the leak-safe default applies. Export of a named prefix-set is a transit shape the daemon gates unless every entry is one of your originated Networks.

Prefix-sets

A named group of CIDRs (max 16 each) a policy rule can match. Space-separate the entries.

AS-sets

A named group of origin ASNs (max 32 each) an import rule can match.

Filter rules

Each rule targets a neighbour or a peer group, matches an optional prefix-set/as-set, and applies an action (allow / deny / match) plus optional route attributes. match is import-only. Rules apply in order; the leading deny-base always stays first.

Live status

Live BGP sessions from bgpctl show summary — state, prefixes received against each peer's configured cap, and uptime. Refreshed every few seconds while this tab is open. Read-only telemetry — it changes nothing.

Live status requires JavaScript.

BGP RIB

Routes from bgpctl show rib, refreshed every few seconds while this tab is open. Read-only telemetry. A full table can be ~1M routes — it is capped; filter by prefix (pushed down to bgpctl) to find a specific route. Each row's Detail button opens the route's full attributes (complete AS path, communities, nexthop validity, best-path state).

Live RIB requires JavaScript.

Read-only /etc/bgpd.conf rendered from the saved configuration (re-rendered after each save; unsaved edits are not reflected).

{{BGP_RENDERED_PREVIEW}}

Preview truncated for display — validation and drift always use the full render.

No BGP configuration to preview yet — set a local AS number and save to render /etc/bgpd.conf.

{{#ADOPTION}} {{#WRITE}} Take ownership of the existing routing configuration (any bgpd.conf is preserved to bgpd.conf.preadopt, then replaced) {{/WRITE}} {{/ADOPTION}} {{#TRANSIT_CONFIRM}} Enable transit — I understand that re-announcing a named prefix-set that is not one of my originated networks can leak a learned-route transit table to peers. The daemon still blocks malformed transit shapes (no import rule, an unconstrained export); this acknowledges the intentional learned-route re-announce only. {{/TRANSIT_CONFIRM}} {{#WRITE}} Apply with an auto-revert safety window — the change goes live but reverts by itself unless you confirm it within seconds. A routing change that severs your own path to this box undoes itself (the revert restarts bgpd, which can pulse a carp demotion); leave unchecked to apply immediately. {{/WRITE}} {{#WRITE}} {{/WRITE}}

BGP authentication keys {{BGP_KEY_COUNT}}

TCP-MD5 (RFC 2385) session keys, held in the secret store. Assign a key to a neighbour in the Neighbours tab — the value is write-only and is never displayed here or in the rendered config. Both ends of a session must share the same key. Changing a key's value takes effect only after you re-apply BGP (the session is reset to pick up the new key).

Live peer event log (bgpd)

Open to stream bgpd events.

Time	Source	Program	Message

Scoped to the bgpd tag in /var/log/daemon. Apply a change above, then watch handshake / notification events here in real time. Requires the log:*:read capability.