Learning path

Build an internet edge

For: You run (or want to run) your own AS: an ISP, hosting provider or multihomed business

From BGP basics to a VyOS edge with transit and an IX, safe routing policy, communities and RTBH, registry and RPKI hygiene, then an edge-and-core network that scales.

1. OSPF FundamentalsBeginner · 70 min

   The link-state IGP that runs inside most networks: neighbour adjacencies, LSA flooding, SPF, costs, DR/BDR, areas and LSA types, a hands-on FRR lab, and how OSPF underpins BGP.

2. BGP FundamentalsIntermediate · 75 min

   How the Border Gateway Protocol glues the internet together: autonomous systems, sessions, path attributes, best-path selection, iBGP scaling and a hands-on eBGP lab with real FRR configuration.

3. Setting up VyOS with basic BGPIntermediate · 50 min

   Build a VyOS edge router from scratch: one upstream transit provider, one Internet Exchange route server, and the import and export policy that keeps both safe. Every command and output comes from a real VyOS lab.

4. Debugging BGP: every session state, reproducedIntermediate · 60 min

   Break a working BGP lab a dozen ways and learn to read each failure: Idle, Connect, Active and OpenSent, max-prefix, firewalls, wrong AS, TTL, hold timers, missing policy and unreachable next hops, all with real FRR output and packet captures.

5. BGP communities, prepending and RTBHIntermediate · 45 min

   Tag routes with large communities, steer inbound traffic with AS-path prepending (and see why providers' local preference limits it), and stop a DDoS at your provider's edge with remotely triggered blackholing. Built on VyOS with two transit providers, including the two RTBH mistakes the lab made first.

6. IRR, RPSL and AS-SETsIntermediate · 60 min

   How networks publish what they announce and how their neighbours turn it into filters: Internet Routing Registries, whois queries, RPSL objects and attributes, AS-SET expansion, bgpq4, and the pitfalls of unsigned routing data.

7. RPKI and Route Origin ValidationIntermediate · 70 min

   Cryptographically signed routing origins: the RPKI trust chain, creating safe ROAs, Valid/Invalid/NotFound, validators and RTR, a real FRR + StayRTR lab, and what ROV can't stop (forged origins, leaks), plus where ASPA comes in.

8. BGP on loopbacks vs interface addressesIntermediate · 45 min

   Why BGP sessions between loopbacks survive link failures and use parallel links, and what they need to work: an IGP or static routes, update-source, the eBGP connected check, and BFD. Every failure is reproduced on two real VyOS routers.

9. Edge and core: building out a VyOS networkIntermediate · 60 min

   Split one BGP router into edge routers that face the outside world and a core that carries traffic inside: loopbacks, OSPF for infrastructure, iBGP between loopbacks, next-hop-self, and what happens when a link fails. Built and broken on three real VyOS routers.

10. OSPF on VyOS: costs and OSPFv3Intermediate · 30 min

    OSPF the VyOS way: interface-based configuration, reading the interface and database output, steering traffic with costs (and the asymmetric routing that follows), and OSPFv3 for IPv6 over link-local addresses. Captured on the three-router edge/core lab.

11. Route reflectors on VyOSIntermediate · 30 min

    Replace an iBGP full mesh with route reflectors: see iBGP refuse to pass routes on, turn on reflection, read ORIGINATOR_ID and CLUSTER_LIST, confirm the reflector stays out of the forwarding path, and survive taking one reflector down.

12. IPv6 on VyOS: setup and routingBeginner · 55 min

    Number a site from an ISP's /48 on VyOS: WAN and blackhole routes, SLAAC with Router Advertisements, handing a /56 to a downstream router statically and with DHCPv6 prefix delegation, and the forward firewall IPv6 needs because there's no NAT. Every output comes from a real two-router VyOS lab.

13. IPv4 over an IPv6-only core (RFC 8950)Intermediate · 40 min

    Carry IPv4 routes over IPv6 BGP sessions with IPv6 next hops, so core routers need no IPv4 addresses at all. Built on VyOS: the missing router ID, what breaks without the extended next hop capability, native IPv4 on the wire, and why traceroute shows 192.0.0.8.

14. Operating VyOS: monitoring, backups and automationIntermediate · 50 min

    Everything after it works: remote syslog, SNMP counters, NetFlow, config archives, commit-confirm and Ansible, all on one VyOS router and an ops server, including three places where this VyOS build differs from older guides.