FreeTransit Learning Centre

A practical learning path for running BGP safely before you request public Internet number resources or a FreeTransit tunnel.

Learn before you apply

A public ASN, an IP prefix and a BGP session are production Internet resources, and a poor place to learn BGP for the first time. One wrong export policy can take your own network offline, leak one provider's routes to another, or announce address space that isn't yours. Other networks notice within minutes.

FreeTransit helps community networks get and use Internet number resources, and we expect you to know what you are taking on. You don't need to be an expert. You should be able to build a small BGP setup, filter it, check what it announces and notice when something breaks, all before it touches a public network.

Recommended learning path

1. Learn IP routing and BGP fundamentals

Start with routing tables, longest-prefix matching, CIDR, IPv4 and IPv6 subnetting, static routes, and how an interior routing protocol differs from BGP.

Good starting points:

APNIC Academy: Routing Fundamentals, free and self-paced, written for beginners.
APNIC Academy: Introduction to BGP covers BGP messages, attributes, best-path selection and IPv4/IPv6 address families.
DE-CIX Academy offers training on BGP, peering and interconnection.
DE-CIX BGP video playlist: short practical videos on BGP, prefixes, autonomous systems and peering.
Interconnection Academy has self-paced courses on the technical and the business side of peering.

2. Build an isolated lab

Build at least three autonomous systems in a local virtual lab. Configure eBGP with explicit import and export policy, prefix filters, a prefix limit, local preference, AS-path prepending and communities. Then leak a route on purpose and check that your filters stop it.

Lab resources:

BGP Labs, open-source exercises, and their source repository
Containerlab FRRouting example
FRRouting BGP documentation
BIRD documentation; FreeTransit's own routers run BIRD 3
DE-CIX Academy BGPLab, lab material and exercises from the DE-CIX Academy team

3. Practise in DN42

DN42 is a large private network that works much like the public Internet. You can practise peering, transit, routing policy and coordinating with other operators without announcing public address space.

Don't start there, though. DN42's own getting-started guide assumes you already understand routing, BGP and a daemon such as BIRD or FRRouting. Build the local lab first.

4. Learn routing policy and registration

Before your first public announcement you should know what these are for:

aut-num, route, route6 and as-set objects in an Internet Routing Registry
RPSL, the language those objects use to describe routing policy
RPKI Route Origin Authorisations (ROAs) and their maxLength
ASPA, which lists the providers your ASN uses
PeeringDB and accurate operational contacts

Then continue with:

5. Plan the first production change

For your first public BGP session, have these ready:

explicit inbound and outbound policy
the exact list of prefixes you will announce
the routes you expect to receive
a prefix limit
correct IRR objects, ROAs and an ASPA
monitoring from outside your own network
out-of-band access to the router
a saved configuration and a way to roll back
if possible, a second person who has read the policy

What FreeTransit checks

Before a FreeTransit session goes live we check several things, and the request page shows each one as passed, pending or needing action:

that you control the ASN in PeeringDB
that your aut-num contains direct import and export lines for AS41051 (see RIPE Database, IRR and routing policy)
that a published ASPA lists AS41051 as one of your providers, where your registry supports ASPA (see ASPA and route leaks)
that Never via route servers is switched off in your PeeringDB record, because we pass your routes on through IXP route servers.

After activation, we accept only prefixes originated by your own ASN that have route or route6 objects, and we reject anything RPKI-invalid, including your own prefixes when the ROA is wrong.

Readiness checklist

You should be able to answer these before you request activation:

What is the difference between eBGP and iBGP?
Why does longest-prefix matching matter?
What do AS_PATH, NEXT_HOP, LOCAL_PREF, MED and BGP communities do?
Which exact IPv4 and IPv6 prefixes will your router export?
What stops your router from exporting routes learned from another upstream?
What happens if your router receives far more routes than expected?
How does an IRR route object differ from an RPKI ROA?
What does the ROA maxLength allow?
Which ASNs are your providers, and are they all, including AS41051, in your ASPA?
How will you notice an accidental withdrawal, a hijack, an RPKI-invalid announcement or a route leak?
How do you roll back if reachability fails?

If some answers are still missing, that's fine. Work through the next pages in order rather than experimenting on the public Internet.