BIRD

Search for BIRD in Marketplace, select the SecureAnyCloud publisher, and click Create. Configure the Network Security Group to allow TCP 22 for administration.

BIRD is an internal routing node, so do not expose protocol ports to the internet. Open ports such as BGP tcp/179 only to your own peers inside your VNet (see Step 8).

RG="net-prod"; LOCATION="eastus"; VM_NAME="bird-node" IMAGE_URN="sac1647283583153:bird-ubuntu-24-04:default:latest" SSH_KEY="$(cat ~/.ssh/id_rsa.pub)" az group create --name "$RG" --location "$LOCATION"
# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:bird-ubuntu-24-04:default:latest
az vm create \
  --resource-group "$RG" --name "$VM_NAME" \
  --image "$IMAGE_URN" \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values "$SSH_KEY" \
  --public-ip-sku Standard
# Administration only. Open routing protocol ports to your own peers separately (Step 8):
az vm open-port --resource-group "$RG" --name "$VM_NAME" --port 22 --priority 1001

On first boot the image resolves this VM's IP, writes it as the BIRD router id, starts BIRD, confirms that the demo routes are programmed into the kernel FIB, and writes /root/bird-credentials.txt. This completes within a minute.

SSH in as azureuser and read the per-VM node details:

sudo cat /root/bird-credentials.txt

There is no password in this file, because BIRD is a credential-less daemon. The file records this node's per-VM details: the resolved host IP, the router id, the configured protocols, and the state of the demo routes.

Run the following commands. bird.service should be active, birdc show status should report that the daemon is up with this VM's router id, and birdc show protocols should list the configured routing protocols, all in the up state.

systemctl is-active bird.service
sudo birdc show status
sudo birdc show protocols

Expected output:

active BIRD 2.14 ready. BIRD 2.14 Router ID is 10.0.0.11 Daemon is up and running Name Proto Table State Since Info dev1 Device --- up 20:39:36.400 kernel4 Kernel master4 up 20:39:36.400 kernel6 Kernel master6 up 20:39:36.400 demo_static Static master4 up 20:39:36.400

This step proves that BIRD is a working router, not just a running daemon. The static protocol announces three documentation prefixes as blackhole routes into BIRD's table, and the kernel protocol installs them into the Linux kernel forwarding table.

birdc show route shows BIRD's view. ip route show proto bird shows the same routes actually programmed into the kernel by BIRD.

sudo birdc show route ip -4 route show proto bird

Expected output:

Table master4: 198.51.100.0/24 blackhole [demo_static 20:39:36.400] * (200) 192.0.2.0/24 blackhole [demo_static 20:39:36.400] * (200) 203.0.113.0/24 blackhole [demo_static 20:39:36.400] * (200) blackhole 192.0.2.0/24 metric 32 blackhole 198.51.100.0/24 metric 32 blackhole 203.0.113.0/24 metric 32

birdc show protocols all <name> gives full detail for any protocol. For the demo static protocol, you can see that it imported three routes into table master4. Those are the routes that were then exported to the kernel in Step 5.

sudo birdc show protocols all demo_static

This is the key security property. BIRD's control interface is a local unix socket owned root:bird, not a network port, so management never leaves the box. No bird process listens on any TCP port, and the per-VM details file holds no password.

ls -l /run/bird/bird.ctl
sudo ss -tlnp | grep -i bird || echo "no bird TCP listener"
sudo stat -c '%a %U:%G %n' /root/bird-credentials.txt

Expected output:

srw-rw---- 1 bird bird 0 /run/bird/bird.ctl no bird TCP listener 600 root:root /root/bird-credentials.txt

Replace the demo with your own routing. BIRD reads /etc/bird/bird.conf. The image ships a commented BGP template. Uncomment it and set your own local AS, neighbour and optional per-VM MD5 password (never a shipped constant).

For example, to peer BGP with a router at 10.1.0.5 in AS 65010:

protocol bgp customer_peer { local as 65000; neighbor 10.1.0.5 as 65010; ipv4 { import all; export none; }; }

Validate the configuration, then apply it live with a reconfigure that does not drop existing sessions:

sudo bird -p -c /etc/bird/bird.conf
# parse-check before applying
sudo birdc configure
# reload the running daemon
sudo birdc show protocols

The demo static protocol uses documentation prefixes that do not touch your real interfaces. It is safe to leave in place, or to remove once you have your own routing.

BIRD only needs TCP 22 exposed for administration. When you configure real routing, open the relevant protocol ports to your specific peers, never to the internet:

BGP TCP 179 from each BGP peer's address OSPF IP protocol 89 from each OSPF neighbour's address (multicast within the subnet) RIP UDP 520 from each RIP neighbour Babel UDP 6696 from each Babel neighbour

Add narrowly scoped Network Security Group rules for exactly the peers and protocols you use. Management is a local unix socket (Step 7), so the control plane is never exposed, even when a protocol port is open to a peer.

birdc is the single management client. Common operations:

sudo birdc show status
sudo birdc show protocols
sudo birdc show route
sudo birdc show route protocol demo_static
sudo birdc configure
# reload /etc/bird/bird.conf

Run sudo birdc on its own for an interactive session. After you edit /etc/bird/bird.conf, always run sudo bird -p -c /etc/bird/bird.conf to parse-check it. Then run sudo birdc configure to apply the change.

• Keep management local. Manage BIRD with birdc over its unix socket. Do not add a routable listen bgp, and do not expose any control interface off box.
• Restrict the NSG. Expose only TCP 22 for administration. Open routing protocol ports (BGP 179, OSPF, RIP, Babel) only to the specific peers that need them, never to the internet.
• Authenticate your routing sessions. For production peering, configure BGP MD5 / TCP-AO and OSPF authentication so that neighbours are cryptographically verified. Set any such secret per VM, and never reuse a shipped constant.
• Filter your routes. Apply import and export filters to your BGP neighbours so that you accept and advertise only the prefixes you intend to.
• Keep the OS and BIRD patched. Unattended security upgrades remain enabled on the running VM and cover both Ubuntu and the BIRD package.

BIRD is developed by CZ.NIC Labs and is distributed under the GPL 2.0 or later license. This SecureAnyCloud image installs the unmodified official bird2 package from the Ubuntu repository.

SecureAnyCloud provides the packaging, the credential-less secure defaults, the per-VM router id, the self-contained kernel routing demo, and 24/7 support with a guaranteed 24-hour response SLA.

SecureAnyCloud is not affiliated with or endorsed by CZ.NIC or the BIRD project. BIRD is a mark of its respective owner and is used here only to identify the software.

Deploy on Azure

Find BIRD Internet Routing Daemon on Ubuntu 24.04 LTS on the Azure Marketplace, published by SecureAnyCloud. Deploy from the Portal or the Azure CLI as shown above.

Need Help?

Email sales@secureanycloud.com for deployment help, configuration questions, or licensing enquiries.

Deploy on Azure

Launch BIRD Internet Routing Daemon on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com