FreeTransit Learning Centre

Practise BGP locally, then use DN42 as a realistic private network before you announce anything in public.

Build a safe lab and use DN42

Start with a lab you can wipe and rebuild without bothering anyone. Move to DN42 once a small isolated topology no longer surprises you.

Stage 1: local and disposable

A good lab:

• is isolated from your production routing table
• can be rebuilt from configuration files
• has a separate management path
• is small enough to inspect every route
• lets you simulate failures and leaks
• runs IPv6 from day one

Platforms:

• BGP Labs
• Containerlab
• FRRouting
• GNS3, if you prefer a graphical topology

DE-CIX Academy BGPLab has exercises that go well with the DE-CIX training videos.

Stage 2: DN42

DN42 is a private network run by its participants, built with tunnels, BGP, DNS and the other pieces of the real Internet. You can practise peering, transit and coordination with real people.

Because it behaves like a real inter-domain network, your mistakes reach real people too. Treat it as a shared training network and be as careful there as you would be in public.

Getting started

• DN42 overview
• Getting started
• FAQ
• DN42 registry
• Global route collector
• BGP communities in DN42

Keep DN42 separate

• Keep DN42 routes out of your public routing table. A dedicated VRF, network namespace or separate router works best.
• Never redistribute DN42 routes into a public eBGP session, and never send public routes into DN42.
• Build filters from the current DN42 registry, not from prefix ranges in an old blog post.
• Use only the resources the DN42 registry assigned to you. Don't register your public ASN there as a shortcut.
• Put explicit import and export filters and a prefix limit on every DN42 peer.
• Write down which peers give you transit and which are plain peers.
• Check your announcements in the DN42 route collector.

Exercises

1. Register your resources in the DN42 registry.
2. Set up a WireGuard tunnel and an eBGP session.
3. Announce one IPv4 and one IPv6 prefix.
4. Find your route in the global route collector.
5. Add a second peer and compare which path wins.
6. Use communities to mark link properties or steer policy.
7. Offer transit only once you can reliably prevent leaks.
8. Run a small service and test reaching it over different paths.
9. Withdraw your route and check that it disappears elsewhere.
10. Break something on purpose and write a short incident note about it.

Talks about DN42

• Routing and DN42 (Easterhegg 2010), an early introduction to DN42 as a network for learning.
• BGP und OSPF (FrOSCon 2016), in German: how Internet routing works and how to try it out on DN42.

Both are good for concepts and history. For registration, addressing and configuration today, follow the DN42 wiki.

What DN42 does not teach

DN42 doesn't cover everything public operation needs:

• correct RIPE Database and IRR objects
• ROAs and an ASPA
• public abuse and NOC contacts that someone actually reads
• monitoring through public route collectors
• change planning and rollback
• filters based on your real provider and customer relationships

The next pages cover these.