If you'd like to experiment with running your own AS in private address space, connecting to a friendly network of geeks over wireguard tunnels, check out DN42 <a href="https://dn42.dev/Home" rel="nofollow">https://dn42.dev/Home</a>.<p>It's a great way to explore routing technologies and safely experiment with your own AS, running the same protocols as the "real" Internet, just in private space.<p>If you do get set up, give me a shout (<a href="https://markround.com/dn42" rel="nofollow">https://markround.com/dn42</a>), I'd be happy to peer with you if you want to expand beyond the big "autopeer" networks :)
Not to nitpick, but the title should have AS capitalized. It’s confusing with the current capitalization.
Right! I was confused for a bit until I started reading it.<p>Otherwise, getting to know the power of FreeBSD is awesome. Thanks for creating the blog!
I think HN tends to undo all caps words unless it's an acronym HN specifically recognizes. Guessing BGP, GRE, and FreeBSD are understood but AS is not.
It’s too late now, but when submitting a post the poster has a window of time to edit the title. Useful for example when HN auto-edits to capitalisation get some words wrong. When you edit the title, those auto-edits are not applied to your edited title.
I was hoping with IPv6, getting an address space as an individual would go back to how it was in the early IPv4 days, but alas you need to be a multihomed individual with tons of usage instead of just a sophisticated netzien that wants to own their block.
Yes, same here. Very frustrating. It is almost as if the powers that be don't want lowly netizens controlling their own destiny.
I don't want an address, they should be cheap, meaningless (sans routing, the longer the common prefix, the closer geographically you should be) and not conflated with identifiers.<p>I just want a way to do public-key based discovery. I'm not sure if wireguard + DHT would do though as it'd also mean that it's easy to track your PK (and maybe you through your devices/services announced with PKs).<p>Maybe you can announce your IP in a neat encryption scheme that adds some privacy without increasing costs too much?
What is the point of owning public address space?<p>Anything in your private network (even if it goes over public internet) should be encrypted and locked up anyway. Something like Wireguard or Nebula only needs a few (maybe just one) publicly accessible address. Inside the overlay network, it's easy to keep IP addresses stable.<p>Anything public-facing likely needs a DNS record, updatable quickly when the IP of a publicly accessible interface changes (infrequently).<p>What am I missing?
The realistic point is to have your own abuse email contact, to evade the banhappy policies that most server hosts have even when you did nothing wrong. Usually they suspend your account if you don't reply within 24 hours, even if the complaint is obvious nonsense.
It's the only real way of running reliable IPv6 networks with multiple uplinks. Unless you want NATv6.
DNS updates are slow. BGP can react to a downed link in <1 sec.
I have both my own multihomed ASN and operate my own nameservers. The latter has usually been about as fast for failover overall in practice. BGP may look to converge near instantly from your 2-3 peer outbound perspective but the inbound convergence from the 100k networks on the rest of the internet is much slower and has a long tail very akin to trying to set your DNS TTL to 0 and having the rest of the internet decide to do it slower for cache/churn reasons anyways.<p>The bigger problem, and where BGP multihoming is most handy, is it's just so much easier to get a holistic in+out failover where nothing really changes vs in DNS where it's more about getting the future inbound stuff to change where it goes. E.g. it's a pain to break an active session because the address had to change, even if DNS can update where the new service is quickly.
The long tail of routers receiving your update doesn’t matter. Once the common transit networks get it, that’s where the rest would dump the traffic to reach you anyway. The only time slow propagation to the edges matters is the first time announcing a prefix after it has been fully withdrawn.<p>Using the wrong route to get the packet in your general direction still gets you the packet as long as it hits an ISP along the way that got the update.<p>We could fully drain traffic from a transit provider in <60s with a withdrawal with all of the major providers you get at the internet exchanges. If you weren’t seeing that your upstream ISPs may have penalized you for flapping too much and put in explicit delays.
Honestly it's not free but it's really not that expensive. With RIPE it's about 75€ per year for the ASN and being multihomed is not really a problem, there are multiple services that will let you announce through them for free or very cheap. You don't have volume minimums.<p>I do agree it should be simpler, but it is accessible to individuals today.
I feel you. Us nerds have been ignored by modern day home user contracts.
`-rxcsum -txcsum -rxcsum6 -txcsum6 -lro -tso`<p>Why disable all offloading? It's not explained anywhere.
I do a "light" version of this, but without running a public AS and using WireGuard for tunneling my public IPv4 subnet into my homelab (proxmox cluster).<p>Just running bird on my VPS to announce my routes to the upstream over a private link.
I looked into buying my own IP space from that IP auction site, an IPv4 C-class costs around $10,000. What stopped me was finding out I also to register with RIPE and pay the LIR annual fee, costing hundred Euros per month or so, even if I wasn't yet ready to use the IP space (I wanted to setup a basic Anycast IP without Cloudflare with help of VPS host who said they can help and had multiple locations around world).
While I strongly support IPv6 migration, the current IPv4 pricing is a rip-off. All the brokers and auction sites are fantasizing.<p>The market is tight, but nowhere near the point where it was 4-5 years ago. Big cloud providers already bought enormous amounts of IPv4 while many regional ISPs and colocation providers went out of business.<p>There is no real pressure to buy IPv4 except for brand-new companies to get their initial /24 or /23 to start. Everything else is optional.
If you do ever sign up with RIPE remember you can get a free /24 if it's the first one on your account. If you just buy one to start you've paid to lose that privilege.
Note that it is not a real C-class IP prefix unless it is from the 192.0.0.0/3 range, otherwise it is just a sparkling /24 IP prefix.
You only need an LIR annual fee (~$2000) if you want to be an LIR and manage other people's resources. Otherwise you find another LIR (some popular choices are the ones the OP used) to manage your resources on your behalf. The annual fee is then ~$60. The resources are allocated directly to you, even when managed by a third party.
If you have a ham radio licence (anywhere in the world) you can request a /24 if IPv4 space from AMPR for free.<p>It cannot be used commercially and should be in the ‘spirit’ of amateur radio. Unfortunately there’s also a bit of a backlog it seems (a couple of months) right now.
If you can register on ARIN the costs are only $260/year at the smallest tier and you can also apply for a /24 which you should be able to get.
Yeah for single person use, this only really makes sense with IPv6. I'm interested in doing this in the near future and I think the yearly price for all-in (IPv6 /48 allocation, AS allocation + necessary VPS connections) comes out to about $200. It goes up to $300-400 if you want a PI subnet instead of PA (PI follows you to another LIR, PA does not).
> MSS clamping is non-negotiable with tunnels. Every layer of encapsulation eats into the MTU.<p>Can this tunnel be avoided somehow? If I have to choose between owning my prefix and having 1500 MTU, I'd probably take the latter: MTU issues are so annoying to deal with, and MSS-clamping doesn't solve all of them.
Kind of but not really.<p>The whole point of BGP is to influence your routing tables. This fundamentally makes very little sense to do when you have a bunch of routers whose routing policy you don't control between you and whoever you're speaking BGP to. eBGP is just TCP and supports knobs to run over multiple hops (so up to 255), but at that point you can't really do anything with the routing information you exchange because the moment you hand the traffic off, the other party can do with it how it pleases. Also, very few people have enough public IP addresses for this, and on the Internet you obviously can't route RFC1918 space. Therefore, you need tunnels, so that you can be one hop away even if the tunneled traffic is traversing the Internet, and so that you can reach peers that let you announce whatever IP space you want.<p>The other thing you can do, of course, is to just do the same thing internal to your lab. You can absolutely stand up multiple ASN at home. I'd even argue that if you really want to learn BGP, this is a great way to do it, especially if you use two different platforms (say, FRR on FreeBSD peering with a cheap Mikrotik running RouterOS). That way you learn the underlying protocol and not a specific implementation, which is something that is very hard to undo in junior network engineers that have only ever been exposed to one way of doing things.<p>That's different from some of the goals outlined in the article, but if your goal is to learn this stuff rather than have provider-independent IP space (which even for home labs isn't very valuable to most people), doing it all yourself works fine.
You can use who you're physically connected to. If you have a physical or point–to–point connection to iFog and Lagrange Cloud, you don't need tunnels to reach them. Both these companies offer VPS services.<p>If your goal is to learn this stuff join dn42, the global networking lab, instead of wasting money with real allocations.
iFog and Lagrange Cloud, naturally.<p>I am always very curious why these operations exist. ISPs for the very specific niche of hobbyists who want to run ASNs.
Just a reminder, that the basic fees at RIPE are 2-3x the fees at ARIN which hurts individuals, SOHO and multihomed not-for-profit institutions.<p>fee schedules FYI<p>- ARIN 2026 PDF: <a href="https://www.arin.net/resources/fees/images/2026feeschedule.p" rel="nofollow">https://www.arin.net/resources/fees/images/2026feeschedule.p</a>...<p>- RIPE 2026 : <a href="https://www.ripe.net/membership/payment/" rel="nofollow">https://www.ripe.net/membership/payment/</a><p>Enthusiasts, trainees and small orgs are paying a lot more with RIPE.
If you want to be an LIR and have the right to manage other people's addresses on their behalf, as well as being a full member of the organisation with voting rights and so on. If you just need addresses, that's not you.<p>Your ARIN link is broken.
fixed arin link: <a href="https://www.arin.net/resources/fees/fee_schedule/" rel="nofollow">https://www.arin.net/resources/fees/fee_schedule/</a><p>It's basically $275/year to have an AS and some PA assignment with no intermediary LIR. In Europe, you have to pay €1800/year without an ASN included. Each resource is billed separately. If you go with a middleman (another LIR) you usually have to pay 200€+ (with taxes) for 2 resources (ASN and PI space)
Good to know. As someone on the ARIN side, I always found the fees reasonable.
how much does it cost?
[flagged]