Networking Azure

BIRD Internet Routing Daemon on Ubuntu 24.04 on Azure User Guide

Last updated: 2026-07-27 | Product: BIRD Internet Routing Daemon on Ubuntu 24.04 LTS on Azure

Overview

This guide covers the deployment and configuration of BIRD Internet Routing Daemon on Ubuntu 24.04 on Azure using cloudimg Azure Marketplace images. BIRD is a full featured dynamic IP routing daemon for Linux and UNIX, developed by CZ.NIC Labs. It speaks the core internet routing protocols, including BGP for IPv4 and IPv6, OSPFv2 and OSPFv3, RIP, Babel, BFD and static routing, driven by a single clear text configuration and controlled through the birdc command line client. It turns a Linux host into a capable, lightweight software router, route server or route reflector for a cloud network, an on premises site or a routing lab, with no database and no web console.

The image installs BIRD 2.x from the Ubuntu 24.04 repository (the bird2 package, archive signed and tracked by unattended upgrades), configured as a systemd managed routing node.

Security by design — a credential less daemon. BIRD has no network facing login. It is managed locally as root with birdc over its unix control socket, /run/bird/bird.ctl, which is owned root:bird mode 0660. There is nothing routable to attack and no default password anywhere in the image. The shipped configuration establishes no session to any peer — there is no baked BGP neighbour and no baked MD5 or TCP-AO secret. BIRD is an internal VNet routing node, so the Network Security Group needs only TCP 22 for administration by default. You open the specific protocol ports (BGP tcp/179, OSPF IP protocol 89, and so on) to your own peers inside your VNet when you configure real routing.

A per VM identity, set on first boot. BIRD's router id identifies this node to its routing peers. Rather than baking a fixed value into the image, first boot resolves this VM's own IP and writes it as the router id in /etc/bird/bird.conf before the daemon serves. The daemon is gated on a first boot marker, so it does not start until that per VM identity is in place.

A self contained demo that works the moment it boots. So the image is provably a working router on a single VM with nothing attached, it ships a small static routing demo. BIRD announces three RFC 5737 documentation prefixes (192.0.2.0/24, 198.51.100.0/24, 203.0.113.0/24) as blackhole routes, and its kernel protocol programs them into the Linux kernel forwarding table. So birdc show route shows BIRD's routing table and ip route show proto bird shows those routes actually installed in the kernel FIB on first boot, proving BIRD is routing for real and not merely running. You replace the demo with your own routing when you are ready.

What is included:

BIRD 2.x (the bird2 package from Ubuntu 24.04), run under systemd as bird.service
Managed with birdc over a root only local unix control socket — nothing is exposed off box
No baked login credential and no baked peer secret — BIRD is a credential less daemon
A per VM router id set from the VM's own IP on first boot, with the daemon gated on a first boot marker
A self contained routing demo that programs real routes into the kernel FIB, live on first boot with no external peers
BGP, OSPF, RIP and Babel all available, with a commented BGP template ready for your own peers
Kernel IP forwarding enabled and the full networking module set installed, so the VM is a correct router
Unattended security upgrades left enabled, covering both the OS and BIRD

Prerequisites

Active Azure subscription, SSH public key, VNet + subnet in the target region
Subscription to the BIRD listing on Azure Marketplace
Network Security Group rules allowing TCP 22 for administration, plus whichever routing protocol ports you will use with your own peers (for example BGP tcp/179) restricted to those peers

Recommended virtual machine size: Standard_B2s (2 vCPU, 4 GB RAM) for a control plane router or route server. Routers handling high traffic or many peers should use Standard_D2s_v5 or larger.

Step 1: Deploy from the Azure Portal

Search BIRD in Marketplace, select the cloudimg publisher, and click Create. Configure the Network Security Group to allow TCP 22 for administration. BIRD is an internal routing node, so do not expose protocol ports to the internet; open ports such as BGP tcp/179 only to your own peers inside your VNet (see Step 8).

Step 2: Deploy from the Azure CLI

RG="net-prod"; LOCATION="eastus"; VM_NAME="bird-node"
GALLERY_IMAGE_ID="/subscriptions/<sub-id>/resourceGroups/azure-cloudimg/providers/Microsoft.Compute/galleries/cloudimgGallery/images/bird-ubuntu-24-04/versions/<version>"
SSH_KEY="$(cat ~/.ssh/id_rsa.pub)"
az group create --name "$RG" --location "$LOCATION"
az vm create \
  --resource-group "$RG" --name "$VM_NAME" \
  --image "$GALLERY_IMAGE_ID" \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values "$SSH_KEY" \
  --public-ip-sku Standard
# Administration only. Open routing protocol ports to your own peers separately (Step 8):
az vm open-port --resource-group "$RG" --name "$VM_NAME" --port 22 --priority 1001

Step 3: First boot

On first boot the image resolves this VM's IP, writes it as the BIRD router id, starts BIRD, confirms the demo routes are programmed into the kernel FIB, and writes /root/bird-credentials.txt. This completes within a minute. SSH in as azureuser and read the per VM node details:

sudo cat /root/bird-credentials.txt

There is no password in this file — BIRD is a credential less daemon. It records this node's per VM details: the resolved host IP, the router id, the configured protocols, and the state of the demo routes.

Step 4: Confirm BIRD is running

bird.service is active, birdc show status reports the daemon is up with this VM's router id, and birdc show protocols lists the configured routing protocols, all in the up state.

systemctl is-active bird.service
sudo birdc show status
sudo birdc show protocols

Expected output:

active
BIRD 2.14 ready.
BIRD 2.14
Router ID is 10.0.0.11
Daemon is up and running

Name       Proto      Table      State  Since         Info
dev1       Device     ---        up     20:39:36.400
kernel4    Kernel     master4    up     20:39:36.400
kernel6    Kernel     master6    up     20:39:36.400
demo_static Static    master4    up     20:39:36.400

bird.service reports active, birdc show status reports BIRD 2.14 with the daemon up and running and this VM's router id, and birdc show protocols lists the device, kernel4, kernel6 and demo_static protocols all in the up state

Step 5: See BIRD program the kernel forwarding table

This is the proof BIRD is a working router, not just a running daemon. The static protocol announces three documentation prefixes as blackhole routes into BIRD's table, and the kernel protocol installs them into the Linux kernel forwarding table. birdc show route shows BIRD's view; ip route show proto bird shows the same routes actually programmed into the kernel by BIRD.

sudo birdc show route
ip -4 route show proto bird

Expected output:

Table master4:
198.51.100.0/24      blackhole [demo_static 20:39:36.400] * (200)
192.0.2.0/24         blackhole [demo_static 20:39:36.400] * (200)
203.0.113.0/24       blackhole [demo_static 20:39:36.400] * (200)

blackhole 192.0.2.0/24 metric 32
blackhole 198.51.100.0/24 metric 32
blackhole 203.0.113.0/24 metric 32

birdc show route lists the three demo prefixes as blackhole routes in BIRD's master4 table from the demo_static protocol, and ip -4 route show proto bird shows the same three prefixes actually installed as blackhole routes in the Linux kernel forwarding table by BIRD

Step 6: Inspect a protocol in detail

birdc show protocols all <name> gives full detail for any protocol. For the demo static protocol you can see it imported three routes into table master4 — the routes that were then exported to the kernel in Step 5.

sudo birdc show protocols all demo_static

birdc show protocols all demo_static shows the demo_static protocol up on its ipv4 channel bound to table master4, with three routes imported and three preferred, and the import update statistics confirming three routes accepted

Step 7: Secure by default — a credential less daemon

This is the key security property. BIRD's control interface is a local unix socket owned root:bird, not a network port, so management never leaves the box. No bird process listens on any TCP port, and the per VM details file holds no password.

ls -l /run/bird/bird.ctl
sudo ss -tlnp | grep -i bird || echo "no bird TCP listener"
sudo stat -c '%a %U:%G %n' /root/bird-credentials.txt

Expected output:

srw-rw---- 1 bird bird 0 /run/bird/bird.ctl
no bird TCP listener
600 root:root /root/bird-credentials.txt

ls of the bird control socket shows srw-rw with owner and group bird, ss reports no bird process listening on any TCP port so management is the local unix socket only, and the per VM credentials file is mode 600 owned root root and contains node details but no password

Step 8: Configure your own routing

Replace the demo with your own routing. BIRD reads /etc/bird/bird.conf. The image ships a commented BGP template — uncomment it and set your own local AS, neighbour and optional per VM MD5 password (never a shipped constant). For example, to peer BGP with a router at 10.1.0.5 in AS 65010:

protocol bgp customer_peer {
    local as 65000;
    neighbor 10.1.0.5 as 65010;
    ipv4 {
        import all;
        export none;
    };
}

Validate the configuration and apply it live with a reconfigure that does not drop existing sessions:

sudo bird -p -c /etc/bird/bird.conf   # parse-check before applying
sudo birdc configure                  # reload the running daemon
sudo birdc show protocols

The demo static protocol uses documentation prefixes that do not touch your real interfaces; it is safe to leave in place or remove once you have your own routing.

Step 9: Open protocol ports to your peers

BIRD only needs TCP 22 exposed for administration. When you configure real routing, open the relevant protocol ports to your specific peers, never to the internet:

BGP    TCP 179             from each BGP peer's address
OSPF   IP protocol 89      from each OSPF neighbour's address (multicast within the subnet)
RIP    UDP 520             from each RIP neighbour
Babel  UDP 6696            from each Babel neighbour

Add narrowly scoped Network Security Group rules for exactly the peers and protocols you use. Because management is a local unix socket (Step 7), the control plane is never exposed even when a protocol port is open to a peer.

Step 10: Manage BIRD with birdc

birdc is the single management client. Common operations:

sudo birdc show status
sudo birdc show protocols
sudo birdc show route
sudo birdc show route protocol demo_static
sudo birdc configure          # reload /etc/bird/bird.conf

Run sudo birdc on its own for an interactive session. After editing /etc/bird/bird.conf, always sudo bird -p -c /etc/bird/bird.conf to parse-check, then sudo birdc configure to apply.

Step 11: Security recommendations

Keep management local. Manage BIRD with birdc over its unix socket. Do not add a routable listen bgp or expose any control interface off box.
Restrict the NSG. Expose only TCP 22 for administration, and open routing protocol ports (BGP 179, OSPF, RIP, Babel) only to the specific peers that need them, never to the internet.
Authenticate your routing sessions. For production peering, configure BGP MD5 / TCP-AO and OSPF authentication so neighbours are cryptographically verified. Set any such secret per VM — never reuse a shipped constant.
Filter your routes. Apply import and export filters to your BGP neighbours so you only accept and advertise the prefixes you intend to.
Keep the OS and BIRD patched. Unattended security upgrades remain enabled on the running VM and cover both Ubuntu and the BIRD package.

Step 12: Support and Licensing

BIRD is developed by CZ.NIC Labs and is distributed under the GPL 2.0 or later license. This cloudimg image installs the unmodified official bird2 package from the Ubuntu repository. cloudimg provides the packaging, the credential less secure defaults, the per VM router id, the self contained kernel routing demo, and 24/7 support with a guaranteed 24 hour response SLA.

cloudimg is not affiliated with or endorsed by CZ.NIC or the BIRD project. BIRD is a mark of its respective owner and is used here only to identify the software.

Deploy on Azure

Find BIRD Internet Routing Daemon on Ubuntu 24.04 LTS on the Azure Marketplace, published by cloudimg. Deploy from the Portal or the Azure CLI as shown above.

Need Help?

Email support@cloudimg.co.uk for deployment help, configuration questions, or licensing enquiries.