Announcing Your /48 from a VPS with BIRD

Audience: isp6 members with a /48 who want to announce it themselves from a virtual server, often as a first BGP setup. You need a Linux VPS and the command line; no BGP experience is assumed. Every address and AS Number below is a documentation value (RFC 3849, RFC 5398): put your own in their place.

Last updated: October 2026

1. What you need

Your /48, assigned: it is on your isp6 dashboard. This guide uses 2001:db8:1234::/48.
A VPS with a BGP session. Not every provider offers one, and those that do usually want you to ask for it. The provider gives you the neighbour address and AS Number to connect to, here 2001:db8:ffff::1 and AS64496.
An origin AS. Either your own AS Number, or one the provider gives you for the session. A provider that gives you a private AS Number originates your prefix from its own public AS. Your First AS Number explains when your own is worth it. This guide uses AS64511 for your side of the session.
BIRD 2 on the VPS: sudo apt install bird2 on Debian and Ubuntu.

2. Authorise the origin

Networks that validate RPKI drop an announcement when a ROA covers the prefix but does not name its origin AS, so authorise your origin before you announce.

On your isp6 dashboard, open the /48 and add the origin on its RPKI tab: your own AS Number if you have one, or the public AS your provider originates from if you do not. Keep the maximum length at 48. isp6 publishes the ROA and a route6 object in the RIPE Database for that origin. Wait until the dashboard shows the origin as published before you announce.

3. Ask the provider for the session

Before it accepts the prefix, the provider checks that you may announce it, against the ROA and the route6 object that section 2 put in place. Some providers also confirm by email with the abuse contact the RIPE Database lists for the prefix. For an isp6 /48 that contact is isp6, so open a support ticket naming the provider when you ask for the session, and we can confirm the request when it arrives.

4. Configure BIRD

Give the VPS an address from your /48, so it can answer on it:

sudo ip link add dummy0 type dummy
sudo ip link set dummy0 up
sudo ip -6 addr add 2001:db8:1234::1/128 dev dummy0

These commands last until a reboot; make the interface permanent the way your distribution configures interfaces.

Then replace /etc/bird/bird.conf with:

# A 32-bit router ID, written like an IPv4 address. On an IPv6-only
# server, pick any value unique among the routers you peer with.
router id 192.0.2.1;

protocol device {
}

# The /48 as one route, held by BIRD.
protocol static isp6_48 {
  ipv6;
  route 2001:db8:1234::/48 unreachable;
}

# Install the same route in the kernel. Traffic for an address you have
# not assigned then gets an ICMPv6 "unreachable" instead of following the
# default route back to the provider, which would send it straight back.
protocol kernel {
  ipv6 {
    import none;
    export where proto = "isp6_48";
  };
}

protocol bgp upstream {
  local as 64511;                       # your AS Number, or the provider's for you
  neighbor 2001:db8:ffff::1 as 64496;   # the provider's neighbour and AS
  multihop 2;                           # only if the provider says so
  password "from-the-provider";         # only if the provider set one

  ipv6 {
    import none;                        # announce only: take no routes back
    export where proto = "isp6_48";     # send the /48 and nothing else
  };
}

The address on dummy0 is a /128, more specific than the /48, so the kernel delivers traffic for it locally and refuses the rest of the /48.

export where proto = "isp6_48" is the line that keeps you safe: BIRD sends your /48 and nothing else, whatever else ends up in its tables. BGP in BIRD 2 imports and exports nothing unless told to (RFC 8212), so both lines are required.

5. Bring it up and check

sudo systemctl restart bird
sudo birdc show protocols              # "upstream" should reach Established
sudo birdc show route export upstream  # should list 2001:db8:1234::/48, and only that

Then look from outside. bgp.tools and RIPEstat show which networks see the prefix, from which origin, and whether RPKI marks it valid. Once they see it, ping 2001:db8:1234::1 from another network should get an answer.

6. When it does not work

What you see	Look at
`upstream` stays in `Connect` or `Active`	the neighbour address and AS, `multihop`, the password, and whether the provider has turned the session on. A firewall on the VPS must allow TCP port 179 to and from the neighbour
`Established`, but no looking glass sees the prefix	the provider is probably still filtering it: its checks from section 3 have not passed. `show route export upstream` proves you are sending it
RPKI shows invalid	the ROA names a different AS from the one originating the prefix. With a private AS Number from the provider, the origin is the provider's public AS, not the private one in your configuration
Some networks see it and others do not	normal for a while after a change. If it persists, compare the origin on each looking glass with the ROA

7. Further reading

No /48 yet?

A /48 comes with an isp6 membership, assigned to you in the RIPE Database once you have joined, with its ROAs, route objects and reverse DNS managed from your dashboard.

See what membership includes →

This document is provided for informational purposes. Protocol specifications and cloud provider behaviour are subject to change. Consult the linked RFCs and vendor documentation for authoritative, up-to-date information before making architectural decisions.