What communities are
Tag routes with large communities, steer inbound traffic with AS-path prepending (and see why providers' local preference limits it), and stop a DDoS at your provider's edge with remotely triggered blackholing. Built on VyOS with two transit providers, including the two RTBH mistakes the lab made first.
By the end you will be able to:
- Explain standard, large and well-known communities, and design a tagging scheme
- Tag routes on import by source and filter on the tags
- Use AS-path prepending to steer inbound traffic, and explain why local preference limits it
- Trigger an RTBH blackhole with the BLACKHOLE community, and avoid the NO_EXPORT and community-list mistakes
Prerequisites: Setting up VyOS with basic BGP
A community is a tag attached to a BGP route. It doesn't change how routers choose paths by itself; it's a label that your own policy, or someone else's, can act on later. Communities are how networks say things like "this route came from transit", "don't send this to peers", or "please drop all traffic to this address".
There are three kinds:
| Kind | Format | Example | Typical use |
|---|---|---|---|
| Standard (RFC 1997) | ASN:value, two 16-bit numbers | 64496:100 | Most provider "action" communities |
| Large (RFC 8092) | ASN:function:parameter, three 32-bit numbers | 64500:100:1 | Your own tags; works with 32-bit ASNs |
| Well-known | Reserved values with names | no-export (65535:65281), blackhole (65535:666) | Behaviour every BGP speaker understands |
Large communities exist because standard ones can't hold a 32-bit AS number in their first half. Use them for your own tagging scheme, and write the scheme down (for example, 64500:100:x = "learnt from transit x").
This lesson's lab gives R1 (VyOS, AS64500) two transit providers: upstream1 (AS64496) on eth0, and upstream2 (AS64497) on eth1. Behind both sits "the internet" (AS64511), which originates 203.0.113.128/25 and can reach us through either provider. That's enough to see three things: tagging routes on the way in, steering traffic coming in with AS-path prepending, and remotely triggered blackholing (RTBH). Every output is from that lab.
- Tag on the way in. Every route from transit A gets 64500:100:1, every route from transit B 64500:100:2.
- Inbound traffic: a tie-break. The internet sees two equal-length paths to us and picks one arbitrarily: via upstream2.
- Prepend towards transit B. Announcing 64500 64500 64500 to upstream2 makes that path longer, so the internet now comes in via upstream1.
- RTBH. R1 announces 198.51.100.10/32 with BLACKHOLE. upstream1 points it at a discard address, so attack traffic dies inside the provider.
set system host-name 'R1'
set interfaces ethernet eth0 address '203.0.113.1/31'
set interfaces ethernet eth0 description 'TRANSIT-A'
set interfaces ethernet eth1 address '203.0.113.3/31'
set interfaces ethernet eth1 description 'TRANSIT-B'
set interfaces ethernet eth2 address '198.51.100.1/25'
set interfaces ethernet eth2 description 'LAN'
set protocols static route 198.51.100.0/24 blackhole
set policy prefix-list OUR-PREFIXES rule 10 action 'permit'
set policy prefix-list OUR-PREFIXES rule 10 prefix '198.51.100.0/24'
set policy route-map TRANSIT-OUT rule 10 action 'permit'
set policy route-map TRANSIT-OUT rule 10 match ip address prefix-list 'OUR-PREFIXES'
set policy route-map TRANSIT-OUT rule 100 action 'deny'
set protocols bgp system-as '64500'
set protocols bgp parameters router-id '198.51.100.1'
set protocols bgp address-family ipv4-unicast network 198.51.100.0/24
set protocols bgp neighbor 203.0.113.0 remote-as '64496'
set protocols bgp neighbor 203.0.113.0 description 'TRANSIT-A upstream1'
set protocols bgp neighbor 203.0.113.0 address-family ipv4-unicast route-map export 'TRANSIT-OUT'
set protocols bgp neighbor 203.0.113.2 remote-as '64497'
set protocols bgp neighbor 203.0.113.2 description 'TRANSIT-B upstream2'
set protocols bgp neighbor 203.0.113.2 address-family ipv4-unicast route-map export 'TRANSIT-OUT'- Lines 2–5: Transit A and transit B.
- Line 8: Blackhole for the aggregate.
- Lines 11–13: The same export policy to both: only our /24.
- Lines 17–19: upstream1, AS64496.
- Lines 20–22: upstream2, AS64497.
vyos@R1:~$ show ip bgp summary
IPv4 Unicast Summary:
BGP router identifier 198.51.100.1, local AS number 64500 VRF default vrf-id 0
BGP table version 3
RIB entries 3, using 480 bytes of memory
Peers 2, using 60 KiB of memory
Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd PfxSnt Desc
203.0.113.0 4 64496 6 4 3 0 0 00:00:15 2 1 TRANSIT-A upstream1
203.0.113.2 4 64497 6 4 3 0 0 00:00:15 2 1 TRANSIT-B upstream2
Total number of neighbors 2
vyos@R1:~$ show ip bgp
BGP table version is 3, local router ID is 198.51.100.1, vrf id 0
Default local pref 100, local AS 64500
Status codes: s suppressed, d damped, h history, u unsorted, * valid, > best, = multipath,
i internal, r RIB-failure, S Stale, R Removed
Nexthop codes: @NNN nexthop's vrf id, < announce-nh-self
Origin codes: i - IGP, e - EGP, ? - incomplete
RPKI validation codes: V valid, I invalid, N Not found
Network Next Hop Metric LocPrf Weight Path
*> 0.0.0.0/0 203.0.113.2 0 0 64497 i
* 203.0.113.0 0 0 64496 i
*> 198.51.100.0/24 0.0.0.0 0 32768 i
*> 203.0.113.128/25 203.0.113.2 0 64497 64511 i
* 203.0.113.0 0 64496 64511 i
Displayed 3 routes and 5 total paths- Lines 10–11: Both transits up.
- Lines 24–25: A default from each…
- Lines 27–28: …and the internet's prefix from each.
Check your understanding
Why use large communities for your own tags rather than standard ones?
- They hold a full 32-bit ASN plus two 32-bit values
- Routers prefer routes with large communities
- Standard communities are deprecated
- Only large communities survive eBGP