Op
Networking Azure

OpenBGPD on Ubuntu 24.04 on Azure User Guide

| Product: OpenBGPD on Ubuntu 24.04 LTS on Azure

Overview

OpenBGPD is the OpenBSD project's implementation of BGP, the routing protocol that ties networks together across the internet and inside large data centres. It is built around a small, auditable code base with a strong focus on security and correctness. It runs as a single daemon, bgpd, that you configure with a clear, readable text file and operate with a companion control utility, bgpctl, that shows sessions, routes and policy at a glance. It speaks BGP to your routers as a peer, learns and advertises routes, and can act as a route server, a route reflector, an edge speaker or an RPKI-validating router.

A bare BGP daemon has nothing to show on its own, so the cloudimg image ships a complete, self-contained, provably-working BGP reference deployment on the one VM:

  • A primary bgpd (AS 65001) — the daemon you drive with bgpctl — with its BGP listener bound to the internal address 10.255.255.1 only.
  • A demo peer bgpd (AS 65002, on 10.255.255.2) that it peers with over a pair of internal loopback-range addresses.
  • A real eBGP session between them, authenticated with a per-VM TCP-MD5 key, that reaches Established, with routes propagating and an import policy filtering.

The moment the VM boots, bgpctl show summary shows an Established session and bgpctl show rib shows real routes — so you can see BGP working before you point the daemon at your own routers.

What is included:

  • OpenBGPD 9.2 (the bgpd daemon and bgpctl control utility) at /usr/local/sbin, built from the pinned official upstream source release and verified by SHA-256
  • A primary bgpd (AS 65001) with its control socket at /var/run/bgpd.sock.0
  • A demo peer bgpd (AS 65002) on control socket /var/run/bgpd-peer.sock, authenticated with a per-VM TCP-MD5 key
  • A demonstrated import filter that blackholes 198.51.100.0/24
  • Per-VM TCP-MD5 key generated at first boot, at /root/openbgpd-credentials.txt (root-only)
  • Secure by default: bgpd keeps its own privilege separation and chroot, its control interface is a local socket, and BGP listens only on the internal demo link — nothing on eth0
  • 24/7 cloudimg support

Deploying on Azure

Launch the image from the Azure Marketplace on a Standard_B2s (or larger) VM. OpenBGPD is lightweight; Standard_B2s (2 vCPU / 4 GB) is ample for the reference deployment and for a modest production route server. SSH in as azureuser with the key you selected at launch:

ssh azureuser@<vm-ip>

On first boot the appliance generates this VM's unique TCP-MD5 session key, renders both bgpd configurations, brings the reference deployment up, and proves the session establishes and the policy filters before it writes its first-boot sentinel. No two VMs ever share a key, and the captured image contains no key at all.

bgpctl talks to the daemon over a root-owned control socket, so prefix the commands below with sudo.

Step 1: The Authenticated eBGP Session is Established

bgpctl show summary lists the daemon's peers and their session state. The demo peer (AS 65002) is up with two prefixes received. bgpctl show neighbor <address> shows the full session detail — the negotiated capabilities, timers and that the session is authenticated with md5sig:

sudo bgpctl show summary
sudo bgpctl show neighbor 10.255.255.2

The session only reaches Established because both ends share this VM's TCP-MD5 key.

bgpctl show summary with the demo peer up, and the neighbor detail showing the Established md5sig-authenticated session

Step 2: Routes Propagate

bgpctl show rib shows the daemon's routing table. The primary has learned 192.0.2.0/24 from the demo peer and originates 203.0.113.0/24 itself. Query the demo peer's control socket with -s /var/run/bgpd-peer.sock to see the reverse direction — it has learned 203.0.113.0/24 from the primary:

sudo bgpctl show rib
sudo bgpctl -s /var/run/bgpd-peer.sock show rib

The primary RIB with the learned and self-originated routes, and the demo peer's view of the propagated route

Step 3: The Import Policy Filters

The primary applies an import filter that rejects 198.51.100.0/24. The demo peer genuinely advertises it — you can see it in the peer's own RIB — but it is absent from the primary's RIB because the deny from any prefix 198.51.100.0/24 rule dropped it. OpenBGPD enforces RFC 8212 default-deny on eBGP, so the accept and announce rules are explicit too:

sudo bgpctl -s /var/run/bgpd-peer.sock show rib 198.51.100.0/24
sudo bgpctl show rib 198.51.100.0/24
sudo grep -E 'allow|deny' /etc/openbgpd/bgpd.conf

The middle command prints only the RIB header with no route line — the primary never installed the blackholed prefix.

The peer advertising 198.51.100.0/24, the primary's RIB with no such route, and the deny-prefix filter rule

Step 4: Secure by Default

The BGP listeners are bound to the internal demo addresses (10.255.255.1 and 10.255.255.2) only — nothing is exposed on the VM's routable interface, so no BGP port is open to the network until you add a peer of your own. The control interfaces are local UNIX sockets, never network ports. This VM's TCP-MD5 key lives only in /root/openbgpd-credentials.txt, readable by root alone:

sudo ss -lntH | awk '{print $1, $4}' | grep -E ':179$|:22$' | sort -u
sudo grep -v '^#' /root/openbgpd-credentials.txt

ss showing BGP bound to the internal demo link only, and the per-VM TCP-MD5 key record

Peering With Your Own Routers

The primary daemon's configuration is at /etc/openbgpd/bgpd.conf. To peer with your own routers, add a listen on line for this VM's private address, add a neighbor block for each router, then reload the daemon. A minimal example:

AS 65001
router-id <your-router-id>
listen on <this-vm-private-ip>

neighbor <remote-peer-ip> {
    descr "core-router-1"
    remote-as <remote-as>
    tcp md5sig password "<a-shared-md5-key>"
}

allow from any
allow to any

Open TCP 179 to those peers in your Azure Network Security Group, then apply the change with sudo systemctl restart openbgpd. You can validate the configuration before reloading with sudo bgpd -n -f /etc/openbgpd/bgpd.conf. Full command help is available in the bgpd.conf(5) and bgpctl(8) manual pages.

Managing the Service

sudo systemctl status openbgpd
sudo journalctl -u openbgpd -n 50 --no-pager

The demo peer (openbgpd-peer.service) exists purely to make the shipped image a working reference deployment. Once you have configured your own peers you can disable it if you prefer a clean single-daemon setup with sudo systemctl disable --now openbgpd-peer.service.

Support

Every cloudimg deployment ships fully patched with unattended security updates enabled, and includes 24/7 cloudimg support. For help with this image, contact support through the Azure Marketplace listing or at cloudimg.co.uk.