The design
Build a VyOS edge router from scratch: one upstream transit provider, one Internet Exchange route server, and the import and export policy that keeps both safe. Every command and output comes from a real VyOS lab.
By the end you will be able to:
- Explain the roles of an upstream transit provider and an IX route server, and what each should send you
- Configure VyOS interfaces, a blackhole aggregate and an eBGP session to an upstream
- Peer with an IX route server and explain why its routes have the member's next hop
- Write export policy that announces only your prefixes, and import policy that drops bogons and your own space and prefers the IX
- Verify sessions, received versus accepted routes, best paths and the forwarding path
- Bind SSH to a management address with key-only login, and protect the router with an input firewall
- Recognise the FRR defaults VyOS changes, and troubleshoot common session and policy problems
Prerequisites: BGP Fundamentals
This lesson builds a real edge router: R1, running VyOS, for a small network with its own AS number (AS64500) and one public prefix (198.51.100.0/24). It connects to the internet two ways:
- An upstream transit provider (AS64496). You pay them to carry your traffic to everywhere. They send you a default route (or a full table) and announce your prefix to the rest of the internet.
- An Internet Exchange (IX): a shared switch where many networks meet. You connect to its peering LAN and exchange traffic directly with other members, usually free of charge beyond the port fee. Instead of setting up a session with every member, you peer with the IX's route servers, which pass routes between all members that use them.
Traffic to IX members takes the short, cheap path across the IX. Everything else goes via transit. If the IX fails, transit still reaches everyone, so you lose nothing but some efficiency.
| Upstream transit | IX route server | |
|---|---|---|
| They send you | The whole internet (default route or full table) | Only the routes of other IX members |
| You send them | Your prefixes | Your prefixes |
| You pay | Per Mbps, usually | A port fee, often nothing per Mbps |
| If it fails | You lose the internet (unless you have a second upstream) | Traffic shifts to transit |
The configuration patterns in this lesson come from a production VyOS edge router, rebuilt with documentation addresses and AS numbers. Everything runs in a lab: VyOS (rolling 2026.10.16) as a virtual machine, with FRR containers playing the upstream, the IX route server and another IX member, and a Linux host on R1's LAN. Every output is copied from that lab.
- R1 announces its prefix to both. R1 originates 198.51.100.0/24 and sends it to the upstream and to the IX route server. Outbound filters make sure nothing else is ever announced.
- The upstream sends the internet. The upstream sends a default route plus its own prefixes. With a full table it would be over a million routes.
- The route server passes on members' routes. The route server relays 203.0.113.64/26 from the member without adding its own AS, and leaves the next hop as the member itself (192.0.2.40). It's a matchmaker, not a router.
- Traffic to the member goes direct. Packets from the host to 203.0.113.64/26 cross the IX LAN straight to the member. The route server never sees traffic: it only exchanges routes.
- Everything else goes via transit. Any destination not learnt at the IX falls through to the upstream's routes or default. If the IX went down, IX destinations would follow the same path.
Check your understanding
A member of the IX also buys transit from your upstream. Their prefix reaches you both ways. Which path should R1 use, and why?
- Transit, because the upstream is more reliable
- The IX, because it's direct and usually free beyond the port fee
- Both equally, to balance load
- Neither, because the route is duplicated