rewrite all links to make wiki more compatiple with wiki-ng use <http(s)://link> instead of plain http(s)://link use absolute links + remove https://internal.dn42 and https//wiki.dn42 prefixes

]

}

```

### Can I update the wiki?

## About this wiki

### DN42 Logo

This is a small list of links. Some of them are informative, some educational, some funny and some entertaining. You know a link you want to share? Then edit the page and add it!

Books:

Tutorials:

Examples and Blogs:

Videos:

- English

- German

Funny:

## Other Lists

## Anonymity

- **CRXN**

## AnoNet

## TINC Clouds

The [filter.txt](https://git.dn42.dev/dn42/registry/src/master/data/filter.txt) and [filter6.txt](https://git.dn42.dev/dn42/registry/src/master/data/filter6.txt) files within the registry detail the network wide constraints on what address ranges are in use together with the global limits on what can be announced.

In addition to the native DN42 address ranges, the registry also contains allocations for the address space used by affiliate networks. These are updated by a regular [sync script](https://git.dn42.dev/dn42/registry-sync).

The diagram below shows the allocation policies for the DN42 address space.

Specific policy restrictions:

ROA files generated by [dn42regsrv](https://git.burble.com/burble.dn42/dn42regsrv) are available from burble.dn42:

ROA files generated by [roa_wizard](https://git.dn42.dev/Kioubit/roa_wizard) are available:

|URL|&nbsp;IPv4/IPv6&nbsp;|Description|

### Updating ROA tables

```

# External Links

# Bird2 Version <2.0.8 / Debian

Additionally Bird2 before 2.0.8 cannot automatically update filtered bgp routes when an used RPKI source changes.

# Example configuration

* At least one peer should operate his own (Sub-)CA.

## How to configure a GRE tunnel on FreeBSD

## How to configure IPsec on FreeBSD

## How to configure GRE + IPsec on Debian

In dn42, there is no real distinction between peering and transit: in most cases, everybody serves as an upstream provider to all its peers. Note that if you have very slow connectivity to the Internet, you may want to avoid providing transit between your peers, which can be done by filtering or prepending your ASN. For the sake of sane routing, try to peer with people on the same continent to avoid inefficient routing, <50ms is a good rule of thumb. You can also look into Bird communities if you are using Bird to mark the latency for the [link](/howto/Bird-communities).

You can then contact them on IRC or by email. In case you're really at loss, you can also ask for peers on the mailing list.

Unless your dn42 peers are on the same network, you must establish tunnels. Choose anything you like: Wireguard, OpenVPN, GRE, GRE + IPSec, IPIP, Tinc, ...

## Running a routing daemon

You need a routing daemon to speak BGP with your peers. People usually run Quagga or Bird, but you may use anything (OpenBGPD, XORP, somebody even used an old [hardware router](BGP-on-Extreme-Summit1i) ). See the relevant [FAQ entry](/FAQ#frequently-asked-questions_what-bgp-daemon-should-i-use).

## Configuration Examples

* VPN/Tunnel:

* [Wireguard](/howto/wireguard)

* [Bird](/howto/Bird)

* [Quagga](/howto/Quagga)

* Router specific:

# Configure DNS

* The [insecure][1] [IKE][2] [aggressive mode][3] must be used to support distinct PSKs for multiple dynamic peers, or

* All dynamic peers must use the same PSK in order to use the more secure IKE main mode

### Public keys are _better_

* They can be transmitted over insecure channels without compromising security

### Conversion tool

Different implementations use different formats to represent public keys, and it's necessary to be able to convert between them. Here is a script for that purpose:

### How-To examples

| Implementation | Key format |

| [strongSwan < 5.0.0][e] | Base64 RFC 3110 |

| [VyOS/EdgeOS][g] | Base64 RFC 3110 |

### Notes

1. Best practice is to generate the private key on the router itself, and not transfer it to another machine. This part should be kept secret!

2. Convert your peer's public key to the hexadecimal DER format using the [pubkey-converter][pubkey-converter] script, if necessary.

## Configuration

### Configure the phase 1 IKE parameters

3. Convert your peer's public key to the PEM format using the [pubkey-converter][pubkey-converter] script, if necessary.

## Configuration

### Configure the phase 1 IKE parameters

2. Convert your peer's public key to the Base64 RFC 3110 format using the [pubkey-converter][pubkey-converter] script, if necessary.

## Configuration

### Configure the phase 1 IKE parameters

2. Convert your peer's public key to the Base64 RFC 3110 format using the [pubkey-converter][pubkey-converter] script, if necessary.

## Configuration

### Configure the phase 1 IKE parameters

2. Convert your peer's public key to the PEM format using the [pubkey-converter][pubkey-converter] script, if necessary.

## Configuration

### Configure the phase 1 IKE parameters

rightid=NATIP

# See also

The following guide illustrates how to set up an IPv6 multicast router using [PIM-SM](https://en.wikipedia.org/wiki/Protocol_Independent_Multicast#Sparse_mode) (Protocol Independent Multicast in Sparse Mode) with your own personal multicast prefix.

## Quickstart

```sh

cd /usr/src

git clone https://github.com/troglobit/pim6sd.git

* ???

* Profit!

## What can i do on DN42-v6 ?

A fair share of the services are available through IPv6. However some of the well known addresses might not work, so you'll have to find alternative services.

Quick list of some native-IPv6-capable services:

* DNS, including anycast

* Media boards, including DN42-Chan

* torrents.dn42

## Graph routes and activity for every neighbour

This munin-plugin makes it very easy to graph the announced routes and activity for each neighbour over time:

It's also possible to get notified by Munin when a problem with the peering persists. You have to define a critical value in line 138:

```

```

Example installation:

|URL|&nbsp;IPv4/IPv6&nbsp;|

|---|---|

`/etc/dn42.roa-set` is the generated set:

roa-set {

fd00:12:34::/48 source-as 4242421234

fd00:ab:cd::/44 maxlen 64 source-as 4242427890

This is mostly OpenBSD specific since [bgplg(8)](http://man.openbsd.org/bgplg.8) and [httpd(8)](http://man.openbsd.org/httpd.8) ship as part of the operating system.

The **bgplg** manual contains the few steps and example [httpd.conf(5)](http://man.openbsd.org/httpd.conf.5) required to enable the looking glass.

option forward ACCEPT

## DNS

### dn42regsrv

Instructions on how to host dn42regsrv yourself can be found on the git repo of [dn42regsrv](https://git.burble.com/burble.dn42/dn42regsrv).

./build.sh

docker-compose up -d

### gortr

burble kindly provides ready-to-use files for gortr here:

You can use these to simply run gortr via docker:

listen = ["0.0.0.0:323", "[::]:323"]

unit = "dn42-json"

### Other tools / generators

### This is all to complicated, is there an easy all-in-one package for RTR?

| Option | Meaning |

|----------|:-------------|

|database|Array of database URLs to initialize database chain|

|messages.preamble|String preamble for whois responses|

|messages.help|String help message for help requests|

|process.user|User to change after initialization|

to do inter-as-mpls-vpn on top of it, you can enable rr-to-rr, asbr-to-asbr or rr-to-asbr vpnv4/vpnv6/vpls/evpn peerings

participating networks:

vlc rtp://[email protected]:1234/

public multicast to unicast relay with vlc4 and above:

### BGP Routing with bird2

#### ROA Updating script

### Sample configuration

Then, for each client, generate a private key and a certificate: ```./build-key myclient```. The Common Name is the only important information (it will be used to identify the client, for instance in the logs).

# See also

# External Links

* multicast:

# VyOS 1.4.x sagitta

VyOS is an open source software router. It is feature rich and supports multiple deployment options such as physical hardware (Old PC's) or a VPC/VM. The developers have a nightly rolling release that includes all the latest features such as Wireguard.

## Firewall Baseline

We will configure firewall access lists for inbound connections on our peer Wireguard interfaces as well as block all inbound connections to our router with the exception of BGP. This should be a good baseline firewall ruleset to filter inbound traffic on your network’s edge. Modifications may be needed depending on your specific goals. If your router has an uplink back to a larger internal network (outside of DN42), an outbound firewall ruleset will need to be applied to that interface.

## RPKI/ROA Checking

### Setup RPKI Caching Server

```

sudo docker run -ti -p 8082:8082 cloudflare/gortr -cache https://dn42.burble.com/roa/dn42_roa_46.json -verify=false -checktime=false -bind :8082

The commands in this page have been adapted to be compatible with the new version of VyOS 1.4.x (sagitta) and to include configurations for IPv6 (MP-BGP over link-local and extended next-hop).

A public instance of the API and associated explorer web app is available at the following URLs:

## Network-related

* [net.smrsh.dn42/routes/d3js.html](http://net.smrsh.dn42/routes/d3js.html) aka 172.23.174.1 (dn42) or [dn42.smrsh.net/routes/d3js.html](http://dn42.smrsh.net/routes/d3js.html) (Internet)

* DN42 Toplevel domain DNS monitoring: [gatuno.dn42/dns](http://gatuno.dn42/dns)

* Free DNS Hosting. You can host any toplevel or subdomain from dn42: [gatuno.dn42/managed](http://gatuno.dn42/managed/)

* Nixnodes original Map of the network: [map.nixnodes.net](http://map.nixnodes.net)

Currently this system only supports IPv4.

### Getting your current dn42 IPv4/IPv6 address

* What is my IP: [ip4.dn42](http://ip4.dn42/), [ip6.dn42](http://ip6.dn42/)

* What is my IP: [whatismyip.dn42](http://whatismyip.dn42/)

wieistmeineip.dn42 also provides a telnet service that returns the address you connected with. This service only shows you the address of the preferred protocol, but there are also ipv4.wieistmeineip.dn42 and ipv6.wieistmeineip.dn42 that accept only connections via IPv4/IPv6.

## Search engines

| Hostname / IP | Remarks |

|:------------------------------------------------- |:-------------------------------------------------------- |

| _Configuring Yacy Network settings:_ |[YaCy Network Configuration](http://yacy.dn42/yacy.network.dn42.unit) |

## Radio and Video Streaming

| Hostname / IP | Remarks |

|:------------------------------------------------- |:--------------------------------------------------------------- |

## Images, E-Books, Videos and other Media

| Hostname / IP | Remarks |

|:------------------------------------------------- |:-------------------------------------------------------- |

## File Sharing

| Hostname / IP | Space | Speed | Remarks |

|:----------------------------------------------------------- |:----- |:----------- |:---------------------------------- |

### Tahoe LAFS

Some people runs [Tahoe LAFS](/services/Tahoe-LAFS) nodes to provide a secure decentralized crypted file storage but in dn42.

### Torrent Search Engine

### Torrent Index

### Torrent Tracker

| Hostname / IP | Port | Protocol | Remarks | Announce URL |

|:---------------------|:-----|:------------|:---------------|:----------------------------------------|

## NTP

| Hostname / IP | What's Available: | Updates

|:------------------------------------------------- |:----------------------------------- |:----------------------------------- |

| ~~http://files.twink0r.dn42~~(OFFLINE 2016-08-24) | Debian, Ubuntu | |

| ~~http://freebsd.e-utp.dn42~~(OFFLINE 2016-08-24) | FreeBSD Homepage mirror | |

## Misc

| Hostname / IP | Remarks |

| ------------------------------------------------- | ------------------------------------------------------------------------------ |

| ~~http://zerobin.e-utp.dn42~~ | AES-encrypted pastebin-like, second one ([zerobin](https://github.com/sebsauvage/ZeroBin)) |

| nntp://news.blacksheep.dn42 | Martin's newsgroup server (ping MB-DN42 for a rw account or a nntp/uucp feed) |

| mumble://shard.smrsh.dn42:64738 | [Mumble](http://mumble.sourceforge.net/) Voice Chat |

| ts3.kai-server.dn42 / ts3.fastnameserver.eu | Teamspeak 3 Server (also reachable over clearnet) |

| [pgp.dn42](http://pgp.dn42) | PGP keyserver, [synchronizes](http://pgp.dn42/pks/lookup?op=stats) with the SKS keyservers |

| https://git.dn42[.us]/pubkeys/[username] | Get ssh public keys from Git Users of git.dn42. |

| http://teams.dn42[.us]/dn42 | Mattermost (Slack clone) instance: get notifications for wiki/CA changes here |

## Gaming

## ChaosVPN

* Check your IP and reverse lookup: [ifconfig.hack](http://ifconfig.hack)

## Freifunk

### Augsburg

(Upload is not fast, most probably DSL speed only)

| Network | v4 | v6 | TLDs | Remarks |

|:-------------------------------------------------------|:-- |:-- |:-------------- |:----------------------------------- |

| [ChaosVPN](https://wiki.hamburg.ccc.de/ChaosVPN) | X | | .hack | Few active hosts |

#### API

Results are in JSON format.

http://ipip.map.dn42/whois?ip=[DN42_IP]&lang=en

http://ipip.map.dn42/whois?asn=AS[DN42_ASN]

#### Client

There is a client software using above apis to provide GeoIP-based traceroute.

Windows only, no virus scan report available, but our DLL source is provided with the modified client. It's highly recommended to run this tool in a sandbox.

### ASN Authentication Solution

Authenticate your users by having them verify their ASN ownership with KIOUBIT-MNT using their registry-provided methods in an automated way. An example of this is the automatic peering system for the Kioubit Network.

| Hostname / IP | Remarks |

|:--------------|:--------|

## Images, E-Books, Videos and other Media

| Hostname / IP | Remarks |

|:------------------------------------------------- |:-------------------------------------------------------- |

## Radio and Video Streaming

| Hostname / IP | Remarks |

|:------------------------------------------------- |:-------------------------------------------------------------- |

## File Sharing

| Hostname / IP | Space | Speed | Remarks |

|:----------------------------------------------------------- |:----- |:----------- |:---------------------------------------------- |

## VPN

DN42 Network Access over Automatic Wireguard VPN Service (IPv6 only, fd00::/8)

## Proxies

### Telegram

A MTProxy server is available at [mtp.jerry.dn42:8044](https://t.me/proxy?server=mtp.jerry.dn42&port=8044&secret=ee1419944c0a129dbba2beb2636fcf361a616e64726f69642e676f6f676c65736f757263652e636f6d).

|Hostname / IP | Remarks |

|:---------------------|:---------------------|

## VOIP/SIP Endpoints

## Challenges

| Start here | Remarks |

|:------------------------------------------------- |:---------------------------------- |

| Website | Description |

| ------------------------------------------------- | ------------------------------------------------------------------------------ |

## Misc

| Hostname / IP | Remarks |

| ------------------------------------------------- | ------------------------------------------------------------------------------ |

| [Clearnet](https://flapping.p2p-node.de/dashboard/), [dn42](https://flapping.bandura.dn42/dashboard), [NeoNetwork](https://flapping.bandura.neo/dashboard/) | FlapAlertedPro by Kioubit hosted by mark22k |

| [Clearnet](https://monkic.mk16.de/), [dn42](https://monkic.mk16.de/) | Monkic (Game in German) |

| [dn42](https://draw.bandura.dn42/),[NeoNetwork](http://draw.bandura.neo/), [CRXN](http://draw.bandura.crxn/) | Excalidraw instance |

## SIM cards / Home cable connections (in NL)

# Other networks

## Public Internet

- 04dco: At a maximum theoretical speed of a whopping 28.8 Kbps, web browsing and IRC chatting were done. My site still loads faster than everyone else's :)

- grawity: Lacking a physical modem, configured VirtualBox to attach the Windows 98 serial port to a TCP modem emulator at dialup.burble.dn42. Listening to a shoutcast stream of local FM radio station.

## Things that use dn42

- Fun stuff that you've done with dn42

_Note that the same warnings above also apply to the following proxies._

| Suffix Change | Bandwidth | Contact |

|---------------------------------------|-------------|-------------|

Server certificates are signed for 45 days. To renew follow the steps above starting from number 3.

*Certificate Revocations*

[Read more on this mailing list thread][libssl-1]

### X.509 nameConstraints on certificates not supported on OS X

Read more on this [stack exchange post][osx-2]

## How to Run

ASN | Network | Autopeer URL |

:------------:|:--------:|--------------|

Sort by AS number

# SSL Certificate Authority

internal.dn42 is signed by an internally maintained CA that is only allowed to sign *.dn42 domains.

The CA certificate ([dn42](https://ca.dn42/crt/root-ca.crt), [iana](https://ca.dn42.us/crt/root-ca.crt)):

## PKI Store

DNS records for these domains are managed by a gitea repository:

The repository uses the registry drone CI service and [DNSControl](https://stackexchange.github.io/dnscontrol/) to automatically build and push changes. This provides a degree of independence for the domains and allows them to be updated by any of the registry maintainers.

# this page is outdated and need update

The idea is to deploy mirrors across dn42 using [anycast](https://en.wikipedia.org/wiki/Anycast) addressing (BGP), thus providing redundancy, load-balancing and improved access times to the wiki. Sites are powered by [gollum](https://github.com/gollum/gollum) which has no native SSL support, so Nginx acts as a reverse proxy and handles the encryption.

## Prerequisites

**Free E-Mail Addresses for DN42 Users.**

* Free, easy to sign up, unlimited internal emailing. Hosted by zane_reick

### Simplelogin server:

* a selfhosted [Simplelogin](https://simplelogin.io/) server for dn42.cc

* create aliases that forward to your real e-mail

* signup at <https://simplelogin.dn42/auth/register> with a clearnet e-mail address (dn42 mail addresses are for some reason not supported by simplelogin)

* also available via <https://sl.dn42.cc/> (except signup)

A few people have provided exchanges previously on DN42, however they created single

points of failure and are no longer operating

Its generally recommended to only announce prefixes from your own network and that of your transit customers.

| **Name** | **Service address** | **Protocol/port** | **Comment** |

| ---------------------- | ------------------------- | ----------------- | ----------------------------- |

| Whois Database | `fd42:d42:d42:43::1/64` | TCP/43 | |

| TOR SOCKS5 Proxy | `fd42:d42:d42:9050::1/64` | TCP/9050 | |

| internal Wiki | `fd42:d42:d42:80::1/64` | TCP/80, TCP/443 | |

| myip.dn42 | `fd42:d42:d42:81::1/64` | TCP/80 | |

### Future services

| Network | Hostname | SSL | IPv4 | IPv6 |

|:--------|:------------------------------------------|:------ |:-------------------------- |:------------ |

### via public internet

we're planning to have a mcast-ix.dn42 somewhere in the cloud at #dn42 for years now...

the main goal is to have a shared lan where ases can peer to each other with the following conditions:

* pure ethernet

| rtr1-nop | 1955 | 172.23.124.122/27 | fde0:93fa:7a0:c1ca::1955/64 | fe80::200:ccff:fe1e:c0de | telnet sandbox.freertr.org |

| rtr1-catgirls | 1411 | 172.23.124.101/27 | fde0:93fa:7a0:c1ca:581a:fc3f:a2d0:828c/64 | fe80::1411:5 | TBD: SOON |

| rtr1-catgirls2 | 1411 | TBD | TBD | TBD | TBD: SOON |

| rtr1-bri | 2825 | TBD | TBD | TBD | TBD |

| rtr1-jlu5 | 1080 | TBD | TBD | TBD | TBD |

| rtr1-fl | 1975 | TBD | TBD | TBD | TBD |

| bad-corp-rtr1 | telnet ix.nop.dn42 20003 |

| AS | URL |

|:--:|:--- |

## Down

| AS | URL |

|:--:|:--- |

| 4242420151 | ext: ssh [email protected] <br> restricted bird shell |

* Reliability and Consistency to avoid debugging very obscure issues that are also hard to reproduce.

* Low maintenance burden on operators.

* Proper DNSSEC support for everything.

# See also

# List of Usenet servers

| **Person** | **Status** | **Address** | **Posting** | **Newsgroups** | **Binaries** |

|----|----|----|----|----|----|

# List of Usenet WebFrontends

| **Person** | **Status** | **Address** | **Posting** | **Newsgroups** | **Binaries** |

|----|----|----|----|----|----|

| UFO | _down_ | [UCIS.ano news](http://cgiproxy.ucis.dn42/nph-proxy.cgi/00/http/www.ucis.ano/news/) | _no_ | anonet, dn42 | _limited_ |

| SeekingFor | _down_ | [AnoNet News](http://cgiproxy.ucis.dn42/nph-proxy.cgi/00/http/news.sfor.ano/) | _yes_ | anonet, dn42 | _no_ |

***

**<name>.dn42-servers.arpa** - This server is authoritative for RFC 2317 delegations. For any inetnum object smaller than /24 and whos parent has no nameserver records, a C class parent zone is created (all its subnetworks are delegated to appropriate nameservers with CNAME)

## Setup

# Original DNS (deprecated)

***

## DNS services for other networks

## Providing DNS services

This is a new effort to build a DNS system that mirrors how DNS was designed to work in clearnet.

## Ubuntu

Hosted by:

* mephisto

## mirror.yandex.ru proxy

Hosted by:

* ne-vlezay80

## mirrors.nia.dn42

## mirror.z.dn42

Not hosting repositories itself, it collects other mirrors

The collector runs a looking glass based on [bird-lg-go](https://github.com/xddxdd/bird-lg-go).

### MRT Dumps

[MRT Dumps](https://tools.ietf.org/html/rfc6396) are produced by the collector every 10 minutes. Bird produces MRT dumps corresponding to tables, so two separate dumps are created, one for IPv4 (master4) and one for IPv6 (master6). The 10 minutes dumps are available for one week before being reduced down to one a day.

The latest dumps can always be found at the following URLs:

### Prometheus Metrics

The collector runs [bird_exporter](https://github.com/czerwonk/bird_exporter) and prometheus style metrics are available at the following URL:

### ~~Flapping routes~~ (In maintenance)

## IRC

## Scripts

To provide storage to the cloud you have to run a node.

## Install and configuration

Before the first start you have to create a node with `bin/tahoe create-node` or a client (doesn't provide storage) with `bin/tahoe create-client`. This will create the folder .tahoe in your home dir. In the file .tahoe/tahoe.cfg you have to enter on `introducer.furl` the link to our introducer node (UPDATED):

You can reach the local node via web browser at [http://localhost:3456](http://localhost:3456).

## Further informations

## DNS zones

Note that other TLDs should also be usable from dn42, most notably from Freifunk and ChaosVPN. A tentative list is available at [External DNS](/services/dns/External-DNS).

The gitea instance hosting the registry has an associated [Drone CI/CD](https://drone.io/) service:

Users are free to add drone pipelines to their own repositories. Repositories can be enabled using the Drone server [user interface](https://drone.git.dn42/).

# Web interface and REST API

The service is provided by [dn42regsrv](https://git.burble.com/burble.dn42/dn42regsrv) which can also be run locally.

The Python code for generating the zone from the registry is available on the monotone repository.

# Software

```

## Whois restful API

Note: this service is in beta testing, use at your own risk.

## NeoNetwork

The NeoNetwork also has a recursive DNS server at `10.127.255.54` and `fd10:127:53:53::`.

## Configuration

You may want to participate in the anycast DNS cloud.

If you want to run your own recursive DNS server, you must find upstream servers that are authoritative for the dn42 zones.

## Configuration