Skip to content

Converged routers and firewalls

In this workshop you will work together in small groups to run two converged routers and firewalls for your own AS, peer with other AS to achieve reachability with each other and the whole Internet.

pod peering overview

Info

When setting up your pods and establish connectivity, they will become reachable from the Internet all over the world. Please keep this in mind while configuring the pods. For security reasons, the carriers providing the Internet transit have the following stateless filters engaged:

inbound

  • permit HTTP (80/tcp) and HTTPS (443/tcp)
  • permit UDP & TCP ephemeral ports (32768-65535)
  • permit ICMP and ICMPv6
  • deny any other traffic

outbound

  • deny SMTP (25/tcp)
  • allow any other traffic

Software Stack

The routers are Linux-based using the following software stack:

  • RouterKit RKOS - an Alpine Linux derivate for software-defined routers and firewalls
  • IfState - to manage interface settings in a declarative manner
  • BIRD - the BIRD Internet Routing Daemon
  • nftables - framework for packet filtering and classification

Building Teams

Please team up in groups of two people. Each pod will operate two edge routers and a small server simulating a cloud workload.