Op

OpenBGPD on Ubuntu 24.04

Azure Networking

OpenBGPD, the OpenBSD project's secure, robust BGP-4 routing daemon, driven by a plain configuration file and the bgpctl control utility.

Base
Hardened build
minimal ports, security patches applied at build time
Access
Unique credentials
generated on first boot, readable only by root
Verified
Boots working
services pass a health gate before release
Support
24/7, 365 days
by email and live chat, 24 hour response SLA

Overview

OpenBGPD is a free implementation of BGP, the routing protocol that ties networks together across the internet and inside large data centres, written by the OpenBSD project with a strong focus on security, correctness and a small, auditable code base. It runs as a single daemon, bgpd, that you configure with a clear, readable text file and operate with a companion control utility, bgpctl, that shows sessions, routes and policy at a glance. It speaks BGP to your routers as a peer, learns and advertises routes, and can act as a route server, a route reflector, an edge speaker or an RPKI validating router that filters routes against signed origin data. It uses privilege separation and a chroot so the network facing code runs with almost no privilege, keeps its routing tables in memory, supports IPv4 and IPv6, and gives you a powerful filter language for controlling exactly what it accepts and announces.

Why the cloudimg image

A bare BGP daemon has nothing to show on its own, so the cloudimg image ships a complete working reference deployment: the daemon built from the pinned official source release and verified by checksum, a second BGP speaker it peers with, and a real authenticated session that reaches established with routes propagating and an import policy filtering, all visible from the command line the moment the machine boots. It is secure by default: the daemon keeps its own privilege separation and chroot, its control interface is a local socket rather than a network port, and the BGP listener is kept off the public interface until you add a peer of your own. Nothing usable is baked into the image: OpenBGPD has no login of its own, and the one secret on the appliance, the key that authenticates the demo session, is generated uniquely on every first boot and written to a file only root can read, so no two instances share a secret. Every deployment ships fully patched with unattended security updates enabled, a paired deploy guide that walks through pointing it at your own routers, and 24/7 cloudimg support.

Common uses

  • Run a secure route server, route reflector or edge BGP speaker from a readable config file
  • Filter and validate routes with a powerful policy language, including RPKI origin validation
  • Peer with your own routers to exchange, steer or blackhole traffic across your network