Intermediate · Setting up VyOS with basic BGP · section 3 of 9

The upstream session

✓ Lab-tested 17 October 2026 on VyOS 2026.10.16-0024-rolling, FRR 10.2.1

The upstream session is a plain External BGP (eBGP) session across a point-to-point /31: R1 is 203.0.113.1, the upstream is 203.0.113.0. Your provider gives you these addresses, their AS number, and usually an MD5 password.

Before the session itself, three pieces of plumbing:

A blackhole route for the aggregate. 198.51.100.0/24 blackhole gives the prefix a home in the routing table. The LAN only uses 198.51.100.0/25, so a packet from the internet for 198.51.100.200 would otherwise match R1's default route and be sent straight back to the upstream, which sends it back to R1, until its Time To Live (TTL) runs out. The blackhole drops it on arrival instead. More-specific routes (the connected /25, and any you add later) still win, because longest prefix always wins.
A prefix list of what you own: OUR-PREFIXES, an exact match on 198.51.100.0/24.
An export route-map: TRANSIT-OUT permits that list and denies everything else. This is the single most important line of defence. Without it, R1 would also announce everything it learns from the IX to the upstream, offering to carry traffic for networks that aren't yours (a route leak).

Then the session: the local AS, a fixed router ID, the network statement that originates the /24, and the neighbor with its export map. soft-reconfiguration inbound keeps an unfiltered copy of everything the neighbor sends, so you can see what you rejected with received-routes later.

Stage 2: the upstream

set protocols static route 198.51.100.0/24 blackhole
set protocols static route 198.51.100.0/24 description 'Anchor our aggregate; discard unused space'
set policy prefix-list OUR-PREFIXES rule 10 action 'permit'
set policy prefix-list OUR-PREFIXES rule 10 prefix '198.51.100.0/24'
set policy route-map TRANSIT-OUT rule 10 action 'permit'
set policy route-map TRANSIT-OUT rule 10 match ip address prefix-list 'OUR-PREFIXES'
set policy route-map TRANSIT-OUT rule 100 action 'deny'
set protocols bgp system-as '64500'
set protocols bgp parameters router-id '198.51.100.1'
set protocols bgp address-family ipv4-unicast network 198.51.100.0/24
set protocols bgp neighbor 203.0.113.0 remote-as '64496'
set protocols bgp neighbor 203.0.113.0 description 'UPSTREAM transit'
set protocols bgp neighbor 203.0.113.0 address-family ipv4-unicast route-map export 'TRANSIT-OUT'
set protocols bgp neighbor 203.0.113.0 address-family ipv4-unicast soft-reconfiguration inbound

Lines 1–2: The blackhole route: anything in 198.51.100.0/24 that isn't matched by a more specific route is dropped here instead of following the default route back out.
Lines 3–4: Exactly the prefix we announce. Without le/ge, a prefix-list rule is an exact match.
Lines 5–7: The export map: permit our prefix, deny everything else. Rule 100's explicit deny makes the intent obvious (a route-map ends with an implicit deny anyway).
Lines 8–9: Our AS and a fixed router ID. Pick an address you own that won't change: here the LAN address.
Line 10: Originate the aggregate.
Lines 11–12: The upstream's address and AS, from the provider. remote-as different from system-as makes this eBGP.
Line 13: Apply the export map. Never bring up an eBGP session without one.
Line 14: Keep an unfiltered copy of what the upstream sends, so received-routes works.

The session comes up (real output)

vyos@R1:~$ show ip bgp summary

IPv4 Unicast Summary:
BGP router identifier 198.51.100.1, local AS number 64500 VRF default vrf-id 0
BGP table version 7
RIB entries 3, using 480 bytes of memory
Peers 1, using 30 KiB of memory

Neighbor        V         AS   MsgRcvd   MsgSent   TblVer  InQ OutQ  Up/Down State/PfxRcd   PfxSnt Desc
203.0.113.0     4      64496        19        11        7    0    0 00:00:07            2        1 UPSTREAM transit

Total number of neighbors 1
vyos@R1:~$ show ip bgp
BGP table version is 7, local router ID is 198.51.100.1, vrf id 0
Default local pref 100, local AS 64500
Status codes:  s suppressed, d damped, h history, u unsorted, * valid, > best, = multipath,
               i internal, r RIB-failure, S Stale, R Removed
Nexthop codes: @NNN nexthop's vrf id, < announce-nh-self
Origin codes:  i - IGP, e - EGP, ? - incomplete
RPKI validation codes: V valid, I invalid, N Not found

     Network          Next Hop            Metric LocPrf Weight Path
 *>  0.0.0.0/0        203.0.113.0              0             0 64496 i
 *>  198.51.100.0/24  0.0.0.0                  0         32768 i
 *>  203.0.113.128/25 203.0.113.0              0             0 64496 i

Displayed 3 routes and 3 total paths
vyos@R1:~$ show ip bgp neighbors 203.0.113.0 advertised-routes
BGP table version is 7, local router ID is 198.51.100.1, vrf id 0
Default local pref 100, local AS 64500
Status codes:  s suppressed, d damped, h history, u unsorted, * valid, > best, = multipath,
               i internal, r RIB-failure, S Stale, R Removed
Nexthop codes: @NNN nexthop's vrf id, < announce-nh-self
Origin codes:  i - IGP, e - EGP, ? - incomplete
RPKI validation codes: V valid, I invalid, N Not found

     Network          Next Hop            Metric LocPrf Weight Path
 *>  198.51.100.0/24  0.0.0.0                  0             0 i

Total number of prefixes 1, total number of paths 1

Line 10: Established for 7 seconds: 2 prefixes received, 1 sent. The description is truncated to fit.
Line 23: The upstream sends a default route and its own /25, standing in for "the internet".
Line 24: Our own aggregate: next hop 0.0.0.0 and weight 32768 mean "originated locally".
Line 38: Exactly one route goes to the upstream: ours. The export map works.

Why the blackhole matters (real output)

vyos@R1:~$ show ip route 198.51.100.200
Routing entry for 198.51.100.0/24
  Known via "static", distance 1, metric 0, best
  Last update 00:09:22 ago
  Flags: Recursion Selected RR Distance
  Status: Installed
  * unreachable (blackhole), weight 1

vyos@R1:~$ show ip route 198.51.100.10
Routing entry for 198.51.100.0/25
  Known via "connected", distance 0, metric 0, best
  Last update 00:10:09 ago
  Flags: Selected
  Status: Installed
  * directly connected, eth2, weight 1

Lines 1–7: An unused address in our /24. Without the blackhole, this would match the default route and bounce between R1 and the upstream until the TTL expired.
Lines 9–15: A real host is matched by the more specific connected /25, so the blackhole never gets in the way.

Check your understanding

What would happen if R1 had no export route-map on the upstream session?

Nothing; BGP only announces the network statement
R1 would also announce the IX routes to the upstream, offering transit to IX members
The session would refuse to come up
The upstream would stop sending a default route