Running as a Daemon¶
Routinator can run as a service that periodically fetches RPKI data, verifies it
and makes the resulting data set available via the RPKI-RTR protocol and through
the built-in HTTP server. You can start the Routinator service using the
server
sub-command.
The HTTP Service¶
The CSV, JSON, OpenBGPD and RPSL formats that Routinator can produce in
interactive mode are available via HTTP if the application is running as a
service. You can also check the RPKI origin validation status of a specific BGP
announcement at the /validity
endpoint by supplying the ASN and prefix.
The HTTP server is not enabled by default for security reasons, nor does it have a default host or port. In order to start the HTTP server at 192.0.2.13 and 2001:0DB8::13 on port 8323, run this command:
routinator server --http 192.0.2.13:8323 --http [2001:0DB8::13]:8323
The application will stay attached to your terminal unless you provide the
--detach
option. After fetching and validating the data set, the
following paths are available:
- /csv
- Returns the current set of VRPs in csv output format
- /csvext
- Returns the current set of VRPs in csvext output format.
- /json
- Returns the current set of VRPs in json output format
- /openbgpd
- Returns the current set of VRPs in OpenBGPD output format
- /bird
- Returns the current set of VRPs in bird output format
- /bird2
- Returns the current set of VRPs in bird2 output format
- /rpsl
- Returns the current set of VRPs in RPSL output format
- /validity
- Returns the RPKI origin validation status of a specific BGP announcement by
supplying the ASN and prefix in the path, e.g.
/validity?asn=12654&prefix=93.175.147.0/24
Please note that this server is intended to run on your internal network and doesn't offer HTTPS natively. If this is a requirement, you can for example run Routinator behind an NGINX reverse proxy.
Lastly, the HTTP server provides paths that allow you to monitor Routinator itself and the data it processes, so it may be desirable to have HTTP running alongside the RTR server. For more information, please refer to the Monitoring section.
The RTR Service¶
Routinator supports RPKI-RTR as specified in RFC 8210 as well as the older version described in RFC 6810.
When launched as an RTR server, routers with support for route origin validation (ROV) can connect to Routinator to fetch the processed data. This includes hardware routers such as Juniper, Cisco and Nokia, as well as software solutions like BIRD, GoBGP and others. The processed data is also available in a number of useful output formats, such as CSV, JSON, RPSL and a format specifically for OpenBGPD.
Like the HTTP server, the RTR server is not started by default, nor does it have
a default host or port. Thus, in order to start the RTR server at 192.0.2.13 and
2001:0DB8::13 on port 3323, run Routinator using the server
command:
routinator server --rtr 192.0.2.13:3323 --rtr [2001:0DB8::13]:3323
Please note that port 3323 is not the IANA-assigned default port for the
protocol, which would be 323. But as this is a privileged port, you would need
to be running Routinator as root when otherwise there is no reason to do that.
The application will stay attached to your terminal unless you provide the
--detach
option.
By default, the repository will be updated and re-validated every 10 minutes.
You can change this via the --refresh
option and specify the interval
between re-validations in seconds. That is, if you rather have Routinator
validate every 15 minutes, the above command becomes:
routinator server --rtr 192.0.2.13:3323 --rtr [2001:0DB8::13]:3323 --refresh=900
Communication between Routinator and the router using the RPKI-RTR protocol is done via plain TCP. Below, there is an explanation how to secure the transport using either SSH or TLS.
Secure Transports¶
These instructions were contributed by wk on Github.
RFC 6810#section-7 defines a number of secure transports for RPKI-RTR that can be used to secure communication between a router and a RPKI relying party.
However, the RPKI Router Implementation Report documented in RFC 7128#section-5 suggests these secure transports have not been widely implemented. Implementations, however, do exist, and a secure transport could be valuable in situations where the RPKI relying party is provided as a public service, or across a non-trusted network.
SSH Transport¶
SSH transport for RPKI-RTR can be configured with the help of netcat and OpenSSH.
- Begin by installing the openssh-server and netcat packages.
Make sure Routinator is running as an RTR server on localhost:
routinator server --rtr 127.0.0.1:3323
- Create a username and a password for the router to log into the host with, such as
rpki
. - Configure OpenSSH to expose an
rpki-rtr
subsystem that acts as a proxy into Routinator by editing the/etc/ssh/sshd_config
file or equivalent to include the following line:
# Define an `rpki-rtr` subsystem which is actually `netcat` used to
# proxy STDIN/STDOUT to a running `routinator server --rtr 127.0.0.1:3323`
Subsystem rpki-rtr /bin/nc 127.0.0.1 3323
# Certain routers may use old KEX algos and Ciphers which are no longer enabled by default.
# These examples are required in IOS-XR 5.3 but no longer enabled by default in OpenSSH 7.3
Ciphers +3des-cbc
KexAlgorithms +diffie-hellman-group1-sha1
- Restart the OpenSSH server daemon.
- Set up the router running IOS-XR using this example configuration:
router bgp 65534
rpki server 192.168.0.100
username rpki
password rpki
transport ssh port 22
TLS Transport¶
TLS transport for RPKI-RTR can be configured with the help of stunnel.
- Begin by installing the stunnel package.
- Make sure Routinator is running as an RTR server on localhost:
routinator server --rtr 127.0.0.1:3323
- Acquire (via for example Let's Encrypt) or generate an SSL certificate. In the example below, an SSL certificate for the domain example.com generated by Let's Encrypt is used.
- Create an stunnel configuration file by editing
/etc/stunnel/rpki.conf
or equivalent:
[rpki]
; Use a letsencrypt certificate for example.com
cert = /etc/letsencrypt/live/example.com/fullchain.pem
key = /etc/letsencrypt/live/example.com/privkey.pem
; Listen for TLS rpki-rtr on port 323 and proxy to port 3323 on localhost
accept = 323
connect = 127.0.0.1:3323
- Restart stunnel to complete the process.