Deployment guide

OpenBGPD

Overview

OpenBGPD is the OpenBSD project's implementation of BGP, the routing protocol that connects networks across the internet and inside large data centres. Its code base is small and auditable, with a strong focus on security and correctness. It runs as a single daemon, bgpd, that you configure with a readable text file and operate with the bgpctl utility, which shows sessions, routes and policy at a glance.

OpenBGPD peers with your routers, learns and advertises routes, and can act as a route server, a route reflector, an edge speaker or an RPKI-validating router. A bare BGP daemon has nothing to show on its own, so this SecureAnyCloud image ships a self-contained BGP reference deployment on one VM. When the VM boots, bgpctl show summary shows an Established session and bgpctl show rib shows real routes, so you can see BGP working before you point the daemon at your own routers.

What you get:

OpenBGPD 9.2 (the bgpd daemon and bgpctl control utility) at /usr/local/sbin, built from the pinned official upstream source release and verified by SHA-256
A primary bgpd (AS 65001), the daemon you drive with bgpctl, with its BGP listener bound to the internal address 10.255.255.1 only and its control socket at /var/run/bgpd.sock.0
A demo peer bgpd (AS 65002, on 10.255.255.2) that peers with the primary over a pair of internal loopback-range addresses, with its control socket at /var/run/bgpd-peer.sock
A real eBGP session between the two bgpd daemons, authenticated with a per-VM TCP-MD5 key, that reaches Established, with routes propagating and an import policy filtering
A demonstrated import filter that blackholes 198.51.100.0/24
A per-VM TCP-MD5 key, used by both bgpd daemons, generated at first boot and stored in the root-only file /root/openbgpd-credentials.txt
Secure defaults: bgpd keeps its own privilege separation and chroot, its control interface is a local socket, and BGP listens only on the internal demo link, with nothing on eth0
24/7 SecureAnyCloud support

Deploying on Azure

Launch the image from the Azure Marketplace on a Standard_B2s (or larger) VM. OpenBGPD is lightweight, and Standard_B2s (2 vCPU / 4 GB) is ample for the reference deployment and for a modest production route server. Connect over SSH as azureuser with the key you selected at launch:

ssh azureuser@<vm-ip>

On first boot the appliance generates a unique TCP-MD5 session key for the VM, renders both bgpd configurations and brings the reference deployment up. It then confirms that the session establishes and the policy filters before it writes its first-boot sentinel. No two VMs share a key, and the image itself contains no key.

bgpctl talks to the daemon over a root-owned control socket, so run the commands below with sudo.

Check that the authenticated eBGP session is established

Run bgpctl show summary to list the daemon's peers and their session state. The demo peer (AS 65002) is up, with two prefixes received. Run bgpctl show neighbor <address> for the full session detail, including the negotiated capabilities, the timers and the md5sig authentication:

sudo bgpctl show summary
sudo bgpctl show neighbor 10.255.255.2

The session reaches Established only because both ends share this VM's TCP-MD5 key.

Check that routes propagate

Run bgpctl show rib to view the daemon's routing table. The primary has learned 192.0.2.0/24 from the demo peer and originates 203.0.113.0/24 itself. To see the reverse direction, query the demo peer's control socket with -s /var/run/bgpd-peer.sock. The demo peer has learned 203.0.113.0/24 from the primary:

sudo bgpctl show rib
sudo bgpctl -s /var/run/bgpd-peer.sock show rib

Verify the import policy

The primary applies an import filter that rejects 198.51.100.0/24. The demo peer advertises this prefix, and you can see it in the peer's own RIB. It is absent from the primary's RIB because the deny from any prefix 198.51.100.0/24 rule drops it. OpenBGPD enforces RFC 8212 default-deny on eBGP, so the accept and announce rules are explicit as well:

sudo bgpctl -s /var/run/bgpd-peer.sock show rib 198.51.100.0/24
sudo bgpctl show rib 198.51.100.0/24
sudo grep -E 'allow|deny' /etc/openbgpd/bgpd.conf

The middle command prints only the RIB header and no route line, because the primary never installed the blackholed prefix.

Confirm the secure defaults

The BGP listeners are bound to the internal demo addresses (10.255.255.1 and 10.255.255.2) only. Nothing is exposed on the VM's routable interface, so no BGP port is open to the network until you add a peer of your own. The control interfaces are local UNIX sockets, not network ports. This VM's TCP-MD5 key is stored only in /root/openbgpd-credentials.txt, which only root can read:

sudo ss -lntH | awk '{print $1, $4}' | grep -E ':179$|:22$' | sort -u sudo grep -v '^#' /root/openbgpd-credentials.txt

Peer with your own routers

The primary daemon's configuration is at /etc/openbgpd/bgpd.conf. To peer with your own routers, add a listen on line for this VM's private address and a neighbor block for each router, then reload the daemon. A minimal example:

AS 65001 router-id <your-router-id> listen on <this-vm-private-ip> neighbor <remote-peer-ip> { descr "core-router-1" remote-as <remote-as> tcp md5sig password "<a-shared-md5-key>" } allow from any allow to any

Open TCP 179 to those peers in your Azure Network Security Group, then apply the change with sudo systemctl restart openbgpd. To validate the configuration first, run sudo bgpd -n -f /etc/openbgpd/bgpd.conf. For full command help, see the bgpd.conf(5) and bgpctl(8) manual pages.

Manage the service

sudo systemctl status openbgpd
sudo journalctl -u openbgpd -n 50 --no-pager

The demo peer (openbgpd-peer.service) exists only to make the image a working reference deployment. After you configure your own peers, you can disable it for a single-daemon setup with sudo systemctl disable --now openbgpd-peer.service.

Support

Every SecureAnyCloud deployment is patched at build time, ships with unattended security updates enabled, and includes 24/7 SecureAnyCloud support. For help with this image, contact support through the Azure Marketplace listing or at secureanycloud.com.

Deploy on Azure

Launch OpenBGPD on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on Azure