Advanced Setup (BGP + BYOIP)

Announce your own IP prefix with BGP.

⚠ī¸
This guide assumes you have a working knowledge of BGP, IRR, and RPKI. If these terms are unfamiliar, use the Home Internet guide instead.

Supported Combinations

This guide covers BGP with your own IP addresses. The following access types are supported:

  • Tunnel + BGP + BYOIP — Use L2TP, IPSec, or GRE tunnel for connectivity
  • Residential + BGP + BYOIP — Use residential fibre for connectivity

The steps below use tunnel as an example. For residential, substitute the tunnel subscription and access steps with the residential equivalents from the Home Internet guide.

Prerequisites

  • đŸ”ĸ Your own ASN (verified ownership required)
  • 🌐 IP prefix to announce (RIR-allocated, IPv4 or IPv6)
  • đŸ–Ĩī¸ Router capable of BGP over IPv6 (FRR, BIRD, JunOS, RouterOS, etc.)
  • 📡 Existing Internet connection with public IPv4 for tunnel transport
  • 🔐 IRR and RPKI records for your prefix (or ability to create them)
1

Account and Tunnel Subscription

  1. Create an account, verify your email, and complete the questionnaire
  2. Wait for account approval
  3. Go to Subscriptions → Add Tunnel
  4. Complete checkout
Checkpoint: Tunnel subscription shows in Subscriptions as active.
2

Create Tunnel Access

  1. Go to Access Management
  2. Click Create Tunnel
  3. Select a tunnel type and router:
    • L2TP or IPSec: select type and router, then submit
    • GRE: also enter your tunnel source IP (your public IPv4)
  4. Note the tunnel endpoint and credentials shown after creation
Tunnel type not available?

New accounts are granted L2TP tunnels by default. If you need IPSec or GRE, or if the type you need shows as full, ask on Discord to request access.

Checkpoint: Tunnel appears in Access Management with endpoint details.
3

Register Your ASN

  1. Go to LIR IPv6 Allocations
  2. Under "Your Autonomous System Numbers", click Add ASN
  3. Enter your ASN
  4. Wait for verification
  5. Wait for your ASN to appear in our AS-SET (see note below)
How ASN verification works

We verify ASN ownership by matching your account's verification emails against the RDAP contact emails for the ASN. Add your RDAP contact email via Profile → Verification Emails before adding your ASN.

Why do I need to wait after verification?

After verification, your ASN must be added to our AS-SET before upstream providers will accept your announcements. We update our AS-SET daily, and upstream providers typically refresh their filters daily as well. Allow up to 48 hours after verification before your announcements will propagate.

Checkpoint: Your ASN shows as verified in the portal and appears in our AS-SET.
4

Register Your Prefix (BYOIP)

  1. Go to LIR IPv6 Allocations
  2. Click Request New Allocation
  3. Select BYOIP
  4. Enter your prefix exactly (e.g., 2001:db8::/32)
  5. Wait for status to show Active
Checkpoint: BYOIP allocation shows as Active in the portal.
5

Configure IRR and RPKI

ℹī¸
We validate all announcements against IRR and RPKI. Announcements without valid IRR objects and ROAs will be filtered.

In your RIR/IRR:

  1. Create route/route6 object for your prefix with your ASN as origin
  2. Create ROA authorising your ASN to announce your prefix

In the portal:

  1. Go to your allocation → Manage Allocation
  2. Click Refresh from RIR to pull IRR/RPKI data
  3. Verify the displayed IRR objects and ROAs show your ASN as origin
Example IRR/RPKI configuration
route6 object (RADB/RIR IRR)
route6:     2001:db8::/32
origin:     AS12345
mnt-by:     YOUR-MAINTAINER
ROA (RIR RPKI portal)
Prefix: 2001:db8::/32
Max Length: /48
Origin ASN: 12345

Replace AS12345 with your actual ASN and the prefix with your actual allocation.

IRR propagation typically takes 15-30 minutes. RPKI propagation can take up to 24 hours.
Checkpoint: The allocation page shows your IRR objects and ROAs after refresh.
6

Create Connection Profile with BGP

  1. Go to Connection Profiles
  2. Click Create Connection
  3. Select your tunnel from "Access"
  4. Enable BGP
  5. Select your ASN
  6. Set neighbour IP (your router's loopback address)
  7. Select the router for BGP session
  8. Select prefixes to advertise (your BYOIP allocation)
  9. Save
Checkpoint: Connection profile shows BGP enabled with your prefix listed.
7

Configure Your Router

  1. Configure the tunnel (L2TP/IPSec/GRE) using credentials from Step 2
  2. Assign the neighbour IP you specified to a loopback interface on your router
  3. Add a static route for our router's IP via the tunnel interface (required for multihop)
  4. Configure BGP session:
    • Neighbour: our router's IPv6 (shown in connection profile)
    • Remote AS: 30265
    • Local AS: your ASN
    • Multihop: enable with TTL of 2 or higher
    • Update source: your loopback interface
    • Address families: IPv6 unicast (IPv4 unicast optional via extended next-hop)
  5. Announce your prefix
BGP sessions are IPv6-only and use multihop between loopbacks. IPv4 routes can be carried via extended next-hop capability.
Done: BGP session established, your prefix propagates to the DFZ.

Verification

BGP Session
Check session state in your router
Prefix Propagation
Check bgp.he.net or bgp.tools
RPKI Validity
Check RIPE RPKI Validator

Troubleshooting

  • BGP session not establishing? Check tunnel is up, IPs are correct, and there are no firewall rules blocking TCP/179.
  • Prefix not propagating? Verify IRR and RPKI are configured correctly and have propagated. Run "Refresh from RIR" in the portal.
  • ASN verification failed? Add your RDAP contact email via Profile → Verification Emails, then click "Refresh from RIR" on your ASN.
  • Prefix filtered? We only accept prefixes with valid IRR route objects and RPKI ROAs where your ASN is the origin.

For other issues, ask on Discord.