Advanced setup - BGP + BYOIP

Announce your own IP Prefix via a BGP session.

⚠️
This guide assumes you have a working knowledge of BGP, IRR, and RPKI. If these terms are unfamiliar, use the Residential Connectivity guide instead.

Supported combinations

This guide covers BGP with your own IP prefixes. The following Access types are supported:

  • Tunnel + BGP + BYOIP: over a GRE, L2TP, or IPSec tunnel
  • Residential + BGP + BYOIP: over Residential Connectivity (FTTP or FTTN)

The steps below use a tunnel as the example. For Residential Connectivity, substitute the tunnel subscription and Access steps with the Residential equivalents from the Residential Connectivity guide.

Both address families are carried over a single IPv6 session. For IPv4 without a BGP session, see SLAAC below.

Prerequisites

  • 🔢 Your own ASN (verified ownership required)
  • 🌐 IP Prefix to announce (RIR-allocated, internet eligible, IPv4 or IPv6)
  • 🖥️ Router capable of BGP over IPv6 (FRR, BIRD, JunOS, RouterOS, etc.)
  • 📡 Existing Internet connection with public IPv4 for tunnel transport
  • 🔐 IRR and RPKI records for your prefix (or ability to create them)
1

Account and Tunnel Subscription

  1. Create an account, verify your email, and complete the questionnaire
  2. Wait for account approval
  3. Go to Subscriptions -> Add Tunnel
  4. Complete checkout
Checkpoint: Tunnel subscription shows in Subscriptions as Active.
2

Create Access Method (Tunnel)

  1. Go to Access
  2. Click Create Tunnel
  3. Select a tunnel type and router:
    • L2TP or IPSec: select type and router, then submit
    • GRE: also enter your tunnel source IP (your public IPv4)
  4. Note the tunnel endpoint and credentials shown after creation
Tunnel type not available?

New accounts are granted L2TP tunnels by default. If you need IPSec or GRE, or if the type you need shows as full, ask on Discord to request access.

Checkpoint: Tunnel appears in Access with endpoint details.
3

Register your ASN

  1. Go to LIR Allocations
  2. Under "Your Autonomous System Numbers", click Add ASN
  3. Enter your ASN
  4. Wait for verification
  5. Wait for your ASN to appear in our AS-SET (see note below)
How ASN verification works

We verify ASN ownership by matching your account's verification emails against the RDAP contact emails for the ASN. Add your RDAP contact email via Profile -> Verification Emails before adding your ASN.

Why do I need to wait after verification?

After verification, your ASN must be added to our AS-SET before upstream providers will accept your announcements. We update our AS-SET daily, and upstream providers typically refresh their filters daily as well. Allow up to 48 hours after verification before your announcements will propagate.

Checkpoint: Your ASN shows as Verified in the Subscriber Portal and appears in our AS-SET.
4

Register your Prefix (BYOIP)

  1. Go to LIR Allocations
  2. Click Request New Allocation
  3. Select BYOIP
  4. Enter your prefix exactly (e.g., 2001:db8::/32)
  5. Wait for status to show Active
Checkpoint: BYOIP Allocation shows as Active in the Subscriber Portal.
5

Configure IRR and RPKI

ℹ️
We validate all announcements against IRR and RPKI. Announcements without valid IRR objects and ROAs will be filtered.

In your RIR/IRR:

  1. Create route/route6 object for your prefix with your ASN as origin
  2. Create ROA authorising your ASN to announce your prefix

In the Subscriber Portal:

  1. Go to your Allocation -> Manage Allocation
  2. Click Refresh from RIR to pull IRR/RPKI data
  3. Verify the displayed IRR objects and ROAs show your ASN as origin
Example IRR/RPKI configuration
route6 object (RADB/RIR IRR)
route6:     2001:db8::/32
origin:     AS12345
mnt-by:     YOUR-MAINTAINER
ROA (RIR RPKI portal)
Prefix: 2001:db8::/32
Max Length: /48
Origin ASN: 12345

Replace AS12345 with your actual ASN and the example prefix with your actual Allocation.

These records name your ASN because your router originates the Prefix over the BGP session. For SLAAC, or for a BGP session from a private ASN, they name AS30265 as origin instead, and you add the registry remark shown on the Allocation page.
IRR propagation typically takes 15-30 minutes. RPKI propagation can take up to 24 hours.
Checkpoint: The Manage Allocation page shows your IRR objects and ROAs after refresh.
6

Create Connection Profile with BGP

  1. Go to Connection Profiles
  2. Click Create Profile
  3. Select your tunnel from "Access"
  4. Enable BGP
  5. Select your ASN
  6. Set neighbour IP (your router's loopback address)
  7. When you announce an IPv4 Prefix, set router IPv4 address (an address of that Prefix your router holds)
  8. Select the peering router for the BGP session
  9. Select prefixes to announce (your BYOIP Allocation)
  10. Save
Checkpoint: Connection Profile shows BGP enabled with your prefix listed.
7

Configure your router

  1. Configure the tunnel (L2TP/IPSec/GRE) using credentials from Step 2
  2. Assign the neighbour IP you specified, and the router IPv4 address when you set one, to a loopback interface on your router
  3. Add a static route for the peering router address via the tunnel interface (required for multihop), and one for the IPv6 next hop when your Connection Profile shows one
  4. Configure BGP session:
    • Neighbour: the peering router address (shown in the Connection Profile)
    • Remote AS: 30265
    • Local AS: your ASN
    • Hop limit: your Connection Profile names what the peering router you chose takes - eBGP multihop with a TTL of 2 or higher, or TTL security, which sends 255
    • Update source: your loopback interface
    • Address families: IPv6 unicast, plus IPv4 unicast when you announce an IPv4 Prefix
    • For IPv4: set the next hop of your IPv4 announcements to your router IPv4 address
  5. Announce your prefix
BGP sessions use multihop between loopbacks.
Done: BGP session established, your prefix propagates to the DFZ.

SLAAC

SLAAC on a Connection Profile routes your Prefixes to your Access Methods without a BGP session. You need no ASN of your own.

  • Prefixes from AS30265: your IPv6 Allocation or any of its Subnets, or an IPv4 /32 you request under LIR Allocations, which an administrator approves
  • Your own Prefixes: add the Allocation as Bring-your-own-IP (BYOIP) under LIR Allocations. The Allocation must be internet eligible
  • At your RIR: add the SLAAC remark the Allocation page shows to the remarks of its network record, and create a ROA and a route or route6 object with origin AS30265. RADB objects are not accepted. Then press Refresh from RIR in the Routing Security section

In Connection Profiles, select your Access Methods, enable SLAAC, choose an IPv6 Prefix, an IPv4 Prefix, or both, save, and press Sync. On IDC Connectivity, point your hosts at the gateway address your Connection Profile shows for IPv4.

Verification

BGP Session
Check session state in your router
Prefix Propagation
Check bgp.he.net or bgp.tools
RPKI Validity
Check RIPE RPKI Validator

Troubleshooting

  • BGP session not establishing? Check tunnel is up, IPs are correct, and there are no firewall rules blocking TCP/179.
  • Prefix not propagating? Verify IRR and RPKI are configured correctly and have propagated. Run "Refresh from RIR" in the Subscriber Portal.
  • ASN verification failed? Add your RDAP contact email via Profile -> Verification Emails, then click "Verify" on your ASN.
  • Prefix filtered? We only accept prefixes with valid IRR route objects and RPKI ROAs where your ASN is the origin.

For other issues, email [email protected] or ask in our Discord community.

An unhandled error has occurred. Reload ✕

Rejoining the server...

Rejoin failed... trying again in seconds.

Failed to rejoin.
Please retry or reload the page.

The session has been paused by the server.

Failed to resume the session.
Please retry or reload the page.