OpenBGPD on Ubuntu 24.04 on Azure User Guide
Overview
OpenBGPD is the OpenBSD project's implementation of BGP, the routing protocol that ties networks together across the internet and inside large data centres. It is built around a small, auditable code base with a strong focus on security and correctness. It runs as a single daemon, bgpd, that you configure with a clear, readable text file and operate with a companion control utility, bgpctl, that shows sessions, routes and policy at a glance. It speaks BGP to your routers as a peer, learns and advertises routes, and can act as a route server, a route reflector, an edge speaker or an RPKI-validating router.
A bare BGP daemon has nothing to show on its own, so the cloudimg image ships a complete, self-contained, provably-working BGP reference deployment on the one VM:
- A primary
bgpd(AS 65001) — the daemon you drive withbgpctl— with its BGP listener bound to the internal address10.255.255.1only. - A demo peer
bgpd(AS 65002, on10.255.255.2) that it peers with over a pair of internal loopback-range addresses. - A real eBGP session between them, authenticated with a per-VM TCP-MD5 key, that reaches Established, with routes propagating and an import policy filtering.
The moment the VM boots, bgpctl show summary shows an Established session and bgpctl show rib shows real routes — so you can see BGP working before you point the daemon at your own routers.
What is included:
- OpenBGPD 9.2 (the
bgpddaemon andbgpctlcontrol utility) at/usr/local/sbin, built from the pinned official upstream source release and verified by SHA-256 - A primary
bgpd(AS 65001) with its control socket at/var/run/bgpd.sock.0 - A demo peer
bgpd(AS 65002) on control socket/var/run/bgpd-peer.sock, authenticated with a per-VM TCP-MD5 key - A demonstrated import filter that blackholes
198.51.100.0/24 - Per-VM TCP-MD5 key generated at first boot, at
/root/openbgpd-credentials.txt(root-only) - Secure by default:
bgpdkeeps its own privilege separation and chroot, its control interface is a local socket, and BGP listens only on the internal demo link — nothing oneth0 - 24/7 cloudimg support
Deploying on Azure
Launch the image from the Azure Marketplace on a Standard_B2s (or larger) VM. OpenBGPD is lightweight; Standard_B2s (2 vCPU / 4 GB) is ample for the reference deployment and for a modest production route server. SSH in as azureuser with the key you selected at launch:
ssh azureuser@<vm-ip>
On first boot the appliance generates this VM's unique TCP-MD5 session key, renders both bgpd configurations, brings the reference deployment up, and proves the session establishes and the policy filters before it writes its first-boot sentinel. No two VMs ever share a key, and the captured image contains no key at all.
bgpctl talks to the daemon over a root-owned control socket, so prefix the commands below with sudo.
Step 1: The Authenticated eBGP Session is Established
bgpctl show summary lists the daemon's peers and their session state. The demo peer (AS 65002) is up with two prefixes received. bgpctl show neighbor <address> shows the full session detail — the negotiated capabilities, timers and that the session is authenticated with md5sig:
sudo bgpctl show summary
sudo bgpctl show neighbor 10.255.255.2
The session only reaches Established because both ends share this VM's TCP-MD5 key.

Step 2: Routes Propagate
bgpctl show rib shows the daemon's routing table. The primary has learned 192.0.2.0/24 from the demo peer and originates 203.0.113.0/24 itself. Query the demo peer's control socket with -s /var/run/bgpd-peer.sock to see the reverse direction — it has learned 203.0.113.0/24 from the primary:
sudo bgpctl show rib
sudo bgpctl -s /var/run/bgpd-peer.sock show rib

Step 3: The Import Policy Filters
The primary applies an import filter that rejects 198.51.100.0/24. The demo peer genuinely advertises it — you can see it in the peer's own RIB — but it is absent from the primary's RIB because the deny from any prefix 198.51.100.0/24 rule dropped it. OpenBGPD enforces RFC 8212 default-deny on eBGP, so the accept and announce rules are explicit too:
sudo bgpctl -s /var/run/bgpd-peer.sock show rib 198.51.100.0/24
sudo bgpctl show rib 198.51.100.0/24
sudo grep -E 'allow|deny' /etc/openbgpd/bgpd.conf
The middle command prints only the RIB header with no route line — the primary never installed the blackholed prefix.

Step 4: Secure by Default
The BGP listeners are bound to the internal demo addresses (10.255.255.1 and 10.255.255.2) only — nothing is exposed on the VM's routable interface, so no BGP port is open to the network until you add a peer of your own. The control interfaces are local UNIX sockets, never network ports. This VM's TCP-MD5 key lives only in /root/openbgpd-credentials.txt, readable by root alone:
sudo ss -lntH | awk '{print $1, $4}' | grep -E ':179$|:22$' | sort -u
sudo grep -v '^#' /root/openbgpd-credentials.txt

Peering With Your Own Routers
The primary daemon's configuration is at /etc/openbgpd/bgpd.conf. To peer with your own routers, add a listen on line for this VM's private address, add a neighbor block for each router, then reload the daemon. A minimal example:
AS 65001
router-id <your-router-id>
listen on <this-vm-private-ip>
neighbor <remote-peer-ip> {
descr "core-router-1"
remote-as <remote-as>
tcp md5sig password "<a-shared-md5-key>"
}
allow from any
allow to any
Open TCP 179 to those peers in your Azure Network Security Group, then apply the change with sudo systemctl restart openbgpd. You can validate the configuration before reloading with sudo bgpd -n -f /etc/openbgpd/bgpd.conf. Full command help is available in the bgpd.conf(5) and bgpctl(8) manual pages.
Managing the Service
sudo systemctl status openbgpd
sudo journalctl -u openbgpd -n 50 --no-pager
The demo peer (openbgpd-peer.service) exists purely to make the shipped image a working reference deployment. Once you have configured your own peers you can disable it if you prefer a clean single-daemon setup with sudo systemctl disable --now openbgpd-peer.service.
Support
Every cloudimg deployment ships fully patched with unattended security updates enabled, and includes 24/7 cloudimg support. For help with this image, contact support through the Azure Marketplace listing or at cloudimg.co.uk.