Added a section on how to run the gortr container on the vyos host itself Changed code blocks to shell blocks

We will configure firewall access lists for inbound connections on our peer Wireguard interfaces as well as block all inbound connections to our router with the exception of BGP. This should be a good baseline firewall ruleset to filter inbound traffic on your network's edge. Modifications may be needed depending on your specific goals. If your router has an uplink back to a larger internal network (outside of DN42), an outbound firewall ruleset will need to be applied to that interface.

By default, VyOS is a **stateless** firewall. To enable **stateful** packet inspection globally enter the following commands.

set firewall state-policy established action 'accept'

set firewall state-policy related action 'accept'

```

We also need to accept invalids on our network's edge. However, this should not become common practice elsewhere.

set firewall state-policy invalid action 'accept'

```

The below commands create **in** and **local** baseline templates to be applied to all Wireguard interfaces that are facing peers. In this example, **172.20.20.0/24** and **fd88:9deb:a69e::/48** are your assigned address spaces.

#Create Groups v4

set firewall group network-group Allowed-Transit-v4 network '10.0.0.0/8'

set firewall group network-group Allowed-Transit-v4 network '172.20.0.0/14'

To retrieve keys later, use the op-mode command `show interfaces wireguard wg4242424242 public-key`.

Example:

vyos@vyos$ show interfaces wireguard wg4242424242 public-key

UcqcZsJvq1MlYgo3gObjaJ8FH+N7wkfV+EH3YDAMyRE=

```

### Configure First Peer's tunnel

This example assumes that your ASN is 4242421234 and your peer's ASN is 4242424242

set interfaces wireguard wg4242424242 description 'AS4242424242 - My First Peer'

# Common practice on DN42 is for peers to use 2+the last four digits of your peer's ASN as the port.

set firewall interface wg4242424242 interface-group name 'Tunnels_In_v4'

set firewall interface wg4242424242 local ipv6-name 'Tunnels_Local_v6'

set firewall interface wg4242424242 local name 'Tunnels_Local_v4'

```

## BGP

Now that we have a tunnel to our peer and theoretically can ping them, we can setup BGP.

### Initial Router Setup

# Set your ASN and IP blocks

set protocols bgp system-as '4242421234'

### Neighbor Up With Peers

#### Option 1: MP-BGP (with Multi Protocol) - with Extended Next-Hop

MP-BGP peerings over IPv6 are recommended on DN42.

# For these examples, your peer's link-local address is fe80::4242

set protocols bgp neighbor fe80::4242 update-source 'wg4242424242'

```

#### Option 2: BGP (no Multi Protocol) - no Extended Next-Hop

# First, we set the ipv6 part.

set protocols bgp neighbor fe80::4242 remote-as '4242424242'

set protocols bgp neighbor fe80::4242 address-family ipv6-unicast

You can now check your BGP summary:

IPv4 Unicast Summary (VRF default):

BGP router identifier 172.20.20.1, local AS number 4242421234 vrf-id 0

Setting up peer-groups might help standardize multiple peerings:

# One peer group for all IPv6 MP-BGP link-local extended-nexthop peers

set protocols bgp peer-group dn42 address-family ipv4-unicast

set protocols bgp peer-group dn42 address-family ipv6-unicast

delete protocols bgp neighbor fe80::4242 capability

```

## RPKI/ROA Checking

```

```

set protocols rpki cache <ip address of your GoRTR instance> port '8082'

set protocols rpki cache <ip address of your GoRTR instance> preference '1'

```

### Create Route Map

set policy route-map DN42-ROA rule 10 action 'permit'

set policy route-map DN42-ROA rule 10 match rpki 'valid'

set policy route-map DN42-ROA rule 20 action 'permit'

You can also consider to combine within the same route-map the RPKI and one or more a prefix lists containing your internal network prefixes, as described later (The example "No RPKI/ROA and Internal Network Falls Into DN42 Range").

### Assign Route Map to Neighbor

set protocols bgp neighbor fe80::1234 address-family ipv4-unicast route-map export 'DN42-ROA'

set protocols bgp neighbor fe80::1234 address-family ipv4-unicast route-map import 'DN42-ROA'

set protocols bgp neighbor fe80::1234 address-family ipv6-unicast route-map export 'DN42-ROA'

## Example Route Map

### No RPKI/ROA and Internal Network Falls Into DN42 Range

##Build prefix list to match personal internal network

set policy prefix-list BlockIPConflicts description 'Prevent Conflicting Routes'

set policy prefix-list BlockIPConflicts rule 10 action 'permit'

# Add your VyOS router to the [Global Route Collector](/services/Route-Collector)!

# The route collector should never export routes, so let's make a route-map to reject them if it does.

set policy route-map Deny-All rule 1 action deny

set protocols bgp neighbor fd42:4242:2601:ac12::1 address-family ipv4-unicast route-map import 'Deny-All'

If you have any questions or suggestions please reach out.

## See also