howto/Getting-Started.md
... ...
@@ -1,73 +1,78 @@
1
-You want to join dn42, but you don't know where to start. This guide gives general guidelines about dn42 and routing in general, but it assumes that you are knowledgeable with routing.
1
+# Getting Started
2 2
3
-# Requirements
3
+This guide walks you through joining dn42. It provides general guidelines about dn42 and routing, but assumes you have a working knowledge of networking concepts.
4 4
5
-- you have at least one router running 24/7. Any Linux or BSD box can be turned into a router. If your home router runs OpenWRT, you might consider using it for dn42.
6
-- your router is able to establish network tunnels over the Internet (Wireguard, GRE, OpenVPN, IPSec, Tinc...). Beware, your network operator might filter this kind of traffic, e.g. in schools or universities.
7
-- you are generally knowledgeable with networking and routing (i.e. you've heard about BGP, IGP, forwarding, and you're willing to configure a BGP router such as FRR or Bird)
5
+## Requirements
8 6
9
-# Formalities
7
+- A router running 24/7. Any Linux or BSD box can serve as a router. If your home router runs OpenWRT, you can use it for dn42.
8
+- The ability to establish network tunnels over the Internet (WireGuard, GRE, OpenVPN, IPsec, Tinc, etc.). Note that some network operators filter tunnel traffic, particularly in schools or universities.
9
+- Familiarity with networking and routing concepts (BGP, IGP, forwarding) and willingness to configure a BGP daemon such as BIRD or FRR.
10 10
11
-Don't worry, it's not as tedious as registering with a RIR ;)
11
+## Formalities
12 12
13
-## Subscribe to the mailing list
13
+Don't worry, it's not as tedious as registering with a RIR.
14 14
15
-This is important, as it allows to stay up-to-date on best practices, new services, security issues...
15
+## Subscribe to the mailing list
16 16
17
-See [Contact](/contact#contact_mailing-list) to subscribe.
17
+Subscribing keeps you informed about best practices, new services, and security issues. See [Contact](/contact#contact_mailing-list) to subscribe.
18 18
19 19
## Fill in the registry
20 20
21 21
You must create several objects in the DN42 registry: <https://git.dn42.dev/dn42/registry>
22 22
23
-The registry is a git repository, objects are created by forking the main repository, making your changes and then submitting a pull request for review. There are detailed instructions in the registry [README](https://git.dn42.dev/dn42/registry/src/branch/master/README.md) how to do this. See also the the generic git documentation [git documentation](https://git-scm.com/book/en/v2/Git-Basics-Working-with-Remotes) and guides on [github](https://help.github.com/en/github/using-git) for how to use git to work with remote repositories.
23
+The registry is a git repository. To create objects, fork the main repository, make your changes, and submit a pull request for review. Detailed instructions are available in the [README](https://git.dn42.dev/dn42/registry/src/branch/master/README.md). See also the [git documentation](https://git-scm.com/book/en/v2/Git-Basics-Working-with-Remotes) and [GitHub guides](https://help.github.com/en/github/using-git) for working with remote repositories.
24
+
25
+When filling out registry objects, refer to the [schema](https://explorer.dn42.dev/#/schema) to speed up the review process.
24 26
25
-While filling out the objects in the DN42 registry make sure to refer to the [schema](https://explorer.dn42.dev/#/schema) to speed up the review process.
27
+When submitting your pull request, you must squash multiple changes into a single commit (instructions are in the [README](https://git.dn42.dev/dn42/registry/src/branch/master/README.md)). Remember to add authentication to your `mntner` object and [sign your commit](/howto/Registry-Authentication).
26 28
27
-When submitting your pull request, you must squash multiple changes to a single commit, again there are instructions in the [README](https://git.dn42.dev/dn42/registry/src/branch/master/README.md) for how to do this.
29
+### Validation scripts
28 30
29
-Remember to add authentication to your `mntner` object, and [sign your commit](/howto/Registry-Authentication)
31
+The registry includes scripts to help check your request:
30 32
31
-The registry includes a number of scripts to help check your request:
33
+| Script | Purpose |
34
+|--------|---------|
35
+| `fmt-my-stuff <FOO>-MNT` | Automatically fixes minor formatting errors |
36
+| `check-my-stuff <FOO>-MNT` | Validates your objects against the registry schema |
37
+| `check-pol origin/master <FOO>-MNT` | Checks for policy violations |
38
+| `squash-my-commits` | Automatically updates and squashes your local commits |
39
+| `sign-my-commit` | Signs your commit using a PGP key or SSH signing |
32 40
33
- - `fmt-my-stuff <FOO>-MNT`: automatically fixes minor formatting errors
34
- - `check-my-stuff <FOO>-MNT`: validates your objects against the registry schema
35
- - `check-pol origin/master <FOO>-MNT`: checks for policy violations
36
- - `squash-my-commits`: automatically update and squash your local commits
37
- - `sign-my-commit`: sign your commit using a pgp key or standard SSH signing
41
+Registry maintainers run these scripts against each request, so please run them yourself first to catch simple errors.
38 42
39
-The registry maintainers run the checking scripts against each request, so please run these yourself first to check for simple errors.
43
+Browse the registry and the [pull request queue](https://git.dn42.dev/dn42/registry/pulls) to see examples, understand the process, and see the types of questions maintainers ask.
40 44
41
-Do browse through the registry and look at the [pull request queue](https://git.dn42.dev/dn42/registry/pulls) to see examples, understand how the process works and see the types of questions asked by the registry maintainers.
45
+**Note:** Do not use the Gitea web interface to edit files. Doing so creates multiple commits and prevents the registry scripts from running properly.
42 46
43
-*You should not use the gitea web interface to edit files, doing so would create a large number of commits and prevents running of the registry scripts*
47
+## Creating registry objects
44 48
45
----
49
+This example assumes your name is `<FOO>`, part of an organisation called `<ORG-FOO>` (e.g., your hackerspace). Replace these placeholders with appropriate values throughout. Organisation objects are optional if you're registering as an individual.
46 50
47
-This example assumes that your name is `<FOO>`, part of an organisation called `<ORG-FOO>` (for instance, your hackerspace). *Organisation objects are not required if your are registering as an individual*. Obviously, these should be replaced by the appropriate values in all examples below.
51
+You will create several types of objects:
48 52
49
-We will create several types of objects:
50
- - **maintainer** objects, which are authenticated so that only you can edit your own objects
51
- - **person** objects, which describe people or organisations and provide contact information
52
- - and **resource** objects (AS number, IP subnet, DNS zone, etc).
53
+- **Maintainer objects** (`mntner`): Authenticated objects that ensure only you can edit your own records
54
+- **Person objects** (`person`): Describe individuals or organisations and provide contact information
55
+- **Resource objects**: AS numbers, IP subnets, DNS zones, etc.
53 56
54
-All objects are simple text files in the specific subfolders, but the files do have a particular format. The files should use spaces and not tabs, and the attribute values must start on the 20th column.
57
+All objects are plain text files in specific subfolders. Files must use spaces (not tabs), and attribute values must start at column 20.
55 58
56 59
### Create a maintainer object
57 60
58
-Create a `mntner` object in `data/mntner/` named `<FOO>-MNT`. It will be used to edit all the objects that are under your responsibility.
61
+Create a `mntner` object in `data/mntner/` named `<FOO>-MNT`. This object controls editing permissions for all objects under your responsibility.
62
+
63
+- Set `mnt-by` to `<FOO>-MNT` so you can edit your own maintainer object.
64
+- Add an `auth` attribute so changes to your objects can be verified.
65
+
66
+See [registry authentication](/howto/Registry-Authentication) for details on authentication methods and commit signing.
59 67
60
-- use `<FOO>-MNT` as `mnt-by`, otherwise, you won't be able to edit your maintainer object.
61
-- Add an 'auth' attribute so that changes to your objects can be verified.
68
+Common authentication methods:
62 69
63
-The `auth` attribute is used to verify changes to your object. There is a separate page on [registry authentication](/howto/Registry-Authentication) which details what to include in your mntner object, how to sign and verify your commits.
70
+- PGP key: `auth: pgp-fingerprint <fingerprint>`
71
+- SSH key: `auth: ssh-{rsa,ed25519} <key>`
64 72
65
-Common authentication methods are:
66
- - PGP Key: `auth: pgp-fingerprint <pgp-fingerprint>`
67
- - SSH Key: `auth: ssh-{rsa,ed25519} <key>`
73
+Example: `data/mntner/FOO-MNT`
68 74
69
-Example: data/mntner/FOO-MNT
70
-```conf
75
+```
71 76
mntner: FOO-MNT
72 77
admin-c: FOO-DN42
73 78
tech-c: FOO-DN42
... ...
@@ -76,24 +81,22 @@ auth: pgp-fingerprint 0123456789ABCDEF0123456789ABCDEF01234567
76 81
source: DN42
77 82
```
78 83
79
-### Create person objects
80
-
81
-Create a `person` object in `data/person/` for **yourself** (not your organisation/hackerspace/whatever).
84
+### Create a person object
82 85
83
-- use something like `<FOO>-DN42` as `nic-hdl`, it should end with `-DN42`.
84
-- the `person` field is more freeform, you may use your nickname or even real name here.
85
-- provide an email.
86
-- you may provide additional ways of contacting you, using one or more `contact` field. For instance `xmpp:luke@theforce.net`, `irc:luke42@hackint`, `twitter: TheGreatLuke`.
87
-- you may wish to add other fields, such as `pgp-fingerprint`, `remarks`, and so on.
88
-- don't forget to set `mnt-by` to `<FOO>-MNT`.
86
+Create a `person` object in `data/person/` for yourself (not your organisation).
89 87
90
-**Data Privacy**
88
+- Set `nic-hdl` to something like `<FOO>-DN42` (must end with `-DN42`).
89
+- The `person` field is freeform - use your nickname or real name.
90
+- Provide an email address.
91
+- Optionally add `contact` fields for other contact methods (e.g., `xmpp:luke@theforce.net`, `irc:luke42@hackint`).
92
+- Optionally add fields like `pgp-fingerprint` or `remarks`.
93
+- Set `mnt-by` to `<FOO>-MNT`.
91 94
92
-Contact attributes are optional but DN42 is a dynamic network and being able to contact users is really important if there are changes or problems. However, please also be aware that the DN42 registry is a public resource and you must assume that any details provided will be made public and cannot be fully removed. If this is a concern for you, please do not provide bogus contact details; simply provide anonymous details that are specific for use within DN42 or leave them out entirely.
95
+> **Privacy note:** Contact attributes are optional, but dn42 is a dynamic network and being able to reach users is important when issues arise. Be aware that the DN42 registry is public. Any details you provide will be visible and cannot be fully removed. If this concerns you, provide anonymous details specific to DN42 or omit them entirely. Please do not provide bogus contact information.
93 96
97
+Example: `data/person/FOO-DN42`
94 98
95
-Example: data/person/FOO-DN42
96
-```conf
99
+```
97 100
person: John Doe
98 101
e-mail: john.doe@example.com
99 102
nic-hdl: FOO-DN42
... ...
@@ -101,22 +104,22 @@ mnt-by: FOO-MNT
101 104
source: DN42
102 105
```
103 106
104
----
107
+### Create an organisation object (optional)
108
+
109
+Organisation objects are not required if you're joining as an individual.
105 110
106
-*(Optional)*
107
-**Organisations are not required if you are joining dn42 as an individual**
111
+If you're registering resources for an organisation (e.g., your hackerspace), create an `organisation` object:
108 112
109
-If you intend to register resources for an organisation (e.g. your hackerspace), you must also create an `organisation` object for your organisation:
113
+- Set `organisation` in the format `<ORG-FOO>`.
114
+- Set `org-name` to your organisation's name.
115
+- Set `e-mail` to a contact address or mailing list (people should be able to send email without subscribing).
116
+- Set `admin-c`, `tech-c`, and `abuse-c` to point to responsible `person` objects.
117
+- Optionally add a `www` field for your website.
118
+- Set `mnt-by` to `<FOO>-MNT`.
110 119
111
-- `organisation` is of the form `<ORG-FOO>`.
112
-- `org-name` should be the name of your organisation.
113
-- `e-mail` should be a contact address for your organisation, or maybe a mailing list (but people should be able to send email without subscribing).
114
-- `admin-c`, `tech-c`, and `abuse-c` may point to `person` objects responsible for the respective role in your organisation.
115
-- you may provide a website (`www` field).
116
-- don't forget to set `mnt-by` to `<FOO>-MNT`, since you're managing this object on behalf of your organisation.
120
+Example: `data/organisation/ORG-FOO`
117 121
118
-Example: data/organisation/ORG-EXAMPLE
119
-```conf
122
+```
120 123
organisation: ORG-FOO
121 124
org-name: Foo Organisation
122 125
admin-c: FOO-DN42
... ...
@@ -127,33 +130,27 @@ source: DN42
127 130
128 131
### Guidelines for resource objects
129 132
130
-From now on, you should use:
131
-
132
-- `admin-c: <FOO>-DN42` and `tech-c: <FOO>-DN42` for your own resources.
133
-- `admin-c: <FOO>-DN42`, `tech-c: <FOO>-DN42` and `org: <ORG-FOO>` for the resources of your organisation.
134
-- `mnt-by: <FOO>-MNT` for all objects, so that you can edit them later.
133
+For all resource objects (AS numbers, network prefixes, routes, DNS records), use:
135 134
136
-This applies to AS numbers, network prefixes, routes, DNS records...
135
+- `admin-c: <FOO>-DN42` and `tech-c: <FOO>-DN42` for personal resources
136
+- `admin-c: <FOO>-DN42`, `tech-c: <FOO>-DN42`: `org: <ORG-FOO>` for organisation resources
137
+- `mnt-by: <FOO>-MNT` for all objects
137 138
138 139
### Register an AS number
139 140
140
-To register an AS number, create an `as-name` object in `data/aut-num/`.
141
-`as-name` should be a name for your AS.
141
+Create an `aut-num` object in `data/aut-num/`. Set `as-name` to a name for your AS.
142 142
143
-Your AS number can be chosen arbitrarily in the dn42 ASN space, see the [as-block objects](https://git.dn42.dev/dn42/registry/src/master/data/as-block) in the registry.
143
+Choose your AS number from the dn42 ASN space (see [as-block objects](https://git.dn42.dev/dn42/registry/src/master/data/as-block)). **Allocate your AS number in the 4242420000–4242423999 range.**
144 144
145
-**You should allocate your AS number in the 4242420000-4242423999 range**
145
+Use [dn42regsrv](https://explorer.burble.com/free#/asn) to find free ASNs, or browse the [aut-num directory](https://explorer.burble.com/#/aut-num/).
146 146
147
-[dn42regsrv](https://explorer.burble.com/free#/asn) includes a page for finding free ASN. For a list of currently assigned AS numbers browse the registry data/aut-num/ directory or [online](https://explorer.burble.com/#/aut-num/).
147
+If using an ASN outside native dn42 ranges, verify it doesn't conflict with [Freifunk AS numbers](http://wiki.freifunk.net/AS-Nummern) or other networks (ChaosVPN, etc.).
148 148
149
-If you intend to use an ASN outside of the native dn42 ranges, please check that it doesn't clash with the [Freifunk AS-Numbers] (http://wiki.freifunk.net/AS-Nummern) or other networks (ChaosVPN, etc).
149
+Internet ASNs may be used, but you must clearly separate Internet and DN42 routes to prevent leaks. For Internet ASNs, set the `source` attribute to the originating registry and be prepared to prove ownership. If unsure, ask on the mailing list or IRC.
150 150
151
-Internet ASNs may be used, but you must take care to clearly separate Internet and DN42 routes and prevent routes leaking between the networks. For Internet ASNs, the `source` attribute must be the originating registry and you will be required to prove you are the owner of the ASN.
151
+Example: `data/aut-num/AS4242423999`
152 152
153
-If unsure, ask on the mailing list or IRC.
154
-
155
-Example: data/aut-num/AS4242423999
156
-```conf
153
+```
157 154
aut-num: AS4242423999
158 155
as-name: AS-FOO-DN42
159 156
admin-c: FOO-DN42
... ...
@@ -166,20 +163,20 @@ source: DN42
166 163
167 164
#### IPv6
168 165
169
-To register an IPv6 prefix, you create an `inet6num` object. dn42 uses the fd00::/8 ([ULA](https://tools.ietf.org/html/rfc4193)) range. A single /48 allocation is typical and will likely provide more than enough room for all devices you will ever connect. The smallest announceable prefix length is /64.
166
+Create an `inet6num` object. dn42 uses the fd00::/8 ([ULA](https://tools.ietf.org/html/rfc4193)) range. A single /48 allocation is typical and provides more than enough addresses for most use cases. The smallest announceable prefix is /64.
170 167
171
-dn42 is interconnected with other networks, like icvpn, which also use the same ULA range so a registration in the dn42 registry can't prevent IPv6 conflicts. A fully random prefix (see [RFC4193](https://tools.ietf.org/html/rfc4193)) is recommended; finding a conflict and needing to renumber your network is no fun.
168
+Since dn42 interconnects with other networks (like ICVPN) that also use ULA space, registry allocation cannot prevent IPv6 conflicts. Use a fully random prefix per [RFC 4193](https://tools.ietf.org/html/rfc4193). Renumbering after discovering a conflict is painful.
172 169
173
-A few websites can generate random ULA prefixes for you:
170
+Tools for generating random ULA prefixes:
174 171
175
-* [dn42regsrv](https://explorer.burble.com/free#/6)
176
-* [SimpleDNS](https://simpledns.com/private-ipv6)
177
-* [Ultratools](https://www.ultratools.com/tools/rangeGenerator)
172
+- [dn42regsrv](https://explorer.burble.com/free#/6)
173
+- [SimpleDNS](https://simpledns.com/private-ipv6)
174
+- [Ultratools](https://www.ultratools.com/tools/rangeGenerator)
175
+- [ulagen.py script](https://git.dn42.dev/netravnen/dn42-repo-utils/src/master/ulagen.py)
178 176
179
-or a small script is available: [ulagen.py](https://git.dn42.dev/netravnen/dn42-repo-utils/src/master/ulagen.py)
177
+Example: `data/inet6num/fd35:4992:6a6d::_48`
180 178
181
-example: data/inet6num/fd35:4992:6a6d::_48
182
-```conf
179
+```
183 180
inet6num: fd35:4992:6a6d:0000:0000:0000:0000:0000 - fd35:4992:6a6d:ffff:ffff:ffff:ffff:ffff
184 181
cidr: fd35:4992:6a6d::/48
185 182
netname: FOO-NETWORK
... ...
@@ -192,38 +189,38 @@ status: ASSIGNED
192 189
source: DN42
193 190
```
194 191
195
-#### IPv4 (Legacy)
192
+#### IPv4
193
+
194
+Create an `inetnum` object. Choose your prefix from an open netblock, following the allocation guidelines below.
196 195
197
-If you also want to register an IPv4 network prefix, simply create an `inetnum` object.
196
+Tools for finding free blocks:
198 197
199
-You may choose your network prefix in one of the currently open netblocks. You can get a list of unassigned subnets on the following site, please mind the allocation guideline below.
198
+- [dn42regsrv free blocks](https://explorer.burble.com/free#/4)
199
+- [Open Netblocks](https://dn42.us/peers/free)
200 200
201
-* [Free blocks in dn42regsrv](https://explorer.burble.com/free#/4)
202
-* [Open Netblocks](https://dn42.us/peers/free)
201
+If no free subnets of your desired size exist, you may split a larger block. Check `data/inetnum` to ensure your chosen prefix is unassigned, and verify the parent block has an 'open' policy (`grep "^policy" data/inetnum/*`).
203 202
204
-If there are no free subnets of the size you want, you may split a larger block as required.
203
+#### Allocation guidelines
205 204
206
-Check the registry (data/inetnum) to make sure no-one else has allocated the same prefix. There are some IP ranges that are not open for assignments or are reserved for specific uses, so you should also check that the parent block has an 'open' policy. A quick and simple way to see the block policies is to run `grep "^policy" data/inetnum/*`.
205
+| Size | Guidance |
206
+|-----:|:---------|
207
+| /29 | Minimum allocation |
208
+| /28 | Usually sufficient |
209
+| **/27** | **Default allocation** |
210
+| /26 | Usually sufficient |
211
+| /25 | Maximum without justification |
207 212
208
-| Size | Comment |
209
-|-----:|:-------------------------|
210
-| /29 | starter pack |
211
-| /28 | usually enough |
212
-| **/27** | **default allocation** |
213
-| /26 | usually enough |
214
-| /25 | still a lot of IPs! |
215
-| /24 | are you an organization? |
213
+The default allocation is /27 or smaller, with room to expand to /26 if needed. Do not allocate more than /25 without justification.
216 214
217
-The current guideline is to allocate a /27 or smaller by default, keeping space for up to a /26 if possible. Don't allocate more than a /25 worth of addresses and please **think before you allocate**.
215
+dn42 typically uses point-to-point addressing for VPN tunnels, so a single IP per host is usually sufficient. For 2–3 servers, a /28 is plenty. Prefixes smaller than /29 are not permitted.
218 216
219
-dn42 typically uses point-to-point addressing in VPN tunnels making transit network unnecessary, a single IP address per host should be sufficient. If you are going to have 2-3 servers, a /28 is plenty; same will go for most home-networks. You cannot, however, allocate prefixes smaller than /29. dn42 is not the public internet, but our IPv4-space is valuable too!
217
+For /24 or larger, ask on IRC or the mailing list and provide justification.
220 218
221
-If you need a /24 or larger, please ask in the IRC chan or on the mailing list and expect to provide justification. You should also ensure the range you've requested is in a suitable block.
219
+> **Note:** Reverse DNS works with any prefix length as long as your [recursive nameserver](/services/DNS) supports [RFC 2317](https://www.ietf.org/rfc/rfc2317.txt). Don't request a /24 solely for reverse DNS.
222 220
223
-**Note:** Reverse DNS works with _any_ prefix length, as long as your [recursive nameserver](/services/DNS) supports [RFC 2317](https://www.ietf.org/rfc/rfc2317.txt). Don't go for a /24 _just to have RDNS_.
221
+Example: `data/inetnum/172.20.150.0_27`
224 222
225
-example: data/inetnum/172.20.150.0_27
226
-```conf
223
+```
227 224
inetnum: 172.20.150.0 - 172.20.150.31
228 225
cidr: 172.20.150.0/27
229 226
netname: FOO-NETWORK
... ...
@@ -236,12 +233,15 @@ status: ASSIGNED
236 233
source: DN42
237 234
```
238 235
239
-#### Create route objects
236
+### Create route objects
237
+
238
+To announce your prefixes in dn42, create route objects for Route Origin Authorization (ROA) checks. Without these, most peers will filter your announcements. ROA prevents accidental prefix hijacking.
240 239
241
-If you plan to announce your prefixes in dn42, which you probably want in most cases, you will also need to create a `route6` object for ipv6 prefixes and a `route` object for ipv4 prefixes. This information is used for Route Origin Authorization (ROA) checks. If you skip this step, your network will probably get filtered by most major peers. Checking ROA will prevent (accidental) hijacking of other people's prefixes.
240
+Create a `route6` object for IPv6 prefixes:
242 241
243
-example: data/route6/fd35:4992:6a6d::_48
244
-```conf
242
+Example: `data/route6/fd35:4992:6a6d::_48`
243
+
244
+```
245 245
route6: fd35:4992:6a6d::/48
246 246
origin: AS4242423999
247 247
max-length: 48
... ...
@@ -249,24 +249,27 @@ mnt-by: FOO-MNT
249 249
source: DN42
250 250
```
251 251
252
-example data/route/172.20.150.0_27:
253
-```conf
252
+Create a `route` object for IPv4 prefixes:
253
+
254
+Example: `data/route/172.20.150.0_27`
255
+
256
+```
254 257
route: 172.20.150.0/27
255 258
origin: AS4242423999
256 259
max-length: 27
257 260
mnt-by: FOO-MNT
258 261
source: DN42
259 262
```
260
-**Note**: the "max-length" should be the same as the prefix length (i.e. 27 for default ipv4 allocation size and 48 for default ipv6 allocation size) except if you have special needs in announcing larger prefixes
261 263
262
-#### DNS and Domain Registration
264
+> **Note:** Set `max-length` to match your prefix length (27 for default IPv4, 48 for default IPv6) unless you have specific needs for announcing larger prefixes.
265
+
266
+### Register a domain (optional)
263 267
264
-*(Optional)*
265
-To register a domain name, create a `dns` object in the data/dns directory.
266
-Domain names and nserver attributes must be lowercase.
268
+Create a `dns` object in `data/dns/`. Domain names and `nserver` attributes must be lowercase.
267 269
268
-example: data/dns/foo.dn42
269
-```conf
270
+Example: `data/dns/foo.dn42`
271
+
272
+```
270 273
domain: foo.dn42
271 274
admin-c: FOO-DN42
272 275
tech-c: FOO-DN42
... ...
@@ -278,15 +281,15 @@ nserver: ns2.foo.dn42 fd35:4992:6a6d:53::2
278 281
source: DN42
279 282
```
280 283
281
-You can also add DNSSEC delegations using `ds-rdata` attributes to your domain:
284
+For DNSSEC, add `ds-rdata` attributes:
282 285
283
-```conf
286
+```
284 287
ds-rdata: 61857 13 2 bd35e3efe3325d2029fb652e01604a48b677cc2f44226eeabee54b456c67680c
285 288
```
286 289
287
-For reverse DNS, add `nserver` attributes to you inet{,6}num objects:
290
+For reverse DNS, add `nserver` attributes to your `inet6num` or `inetnum` objects:
288 291
289
-```conf
292
+```
290 293
inet6num: fd35:4992:6a6d:0000:0000:0000:0000:0000 - fd35:4992:6a6d:ffff:ffff:ffff:ffff:ffff
291 294
cidr: fd35:4992:6a6d::/48
292 295
netname: FOO-NETWORK
... ...
@@ -301,51 +304,58 @@ nserver: ns2.foo.dn42
301 304
source: DN42
302 305
```
303 306
304
-# Get some peers
307
+## Find peers
308
+
309
+In dn42, there's no strict distinction between peering and transit. Most participants provide upstream connectivity to all their peers. If you have slow Internet connectivity, you may want to avoid providing transit by filtering or prepending your ASN.
310
+
311
+For efficient routing, peer with others on the same continent. A latency under 50 ms is a good guideline. If using BIRD, you can use [BGP communities](/howto/BGP-communities) to mark link latency.
312
+
313
+Use the [Peerfinder](https://peerfinder.dn42.dev/) to find potential peers near you, then contact them via IRC or email. You can also request peers on the mailing list.
314
+
315
+## Establish tunnels
316
+
317
+Unless your peers are on the same local network, you'll need tunnels. Choose any protocol you prefer: WireGuard, OpenVPN, GRE, GRE + IPsec, IPIP, Tinc, etc.
318
+
319
+See [GRE + IPsec](/howto/GRE-plus-IPsec) and other documentation in this wiki.
305 320
306
-In dn42, there is no real distinction between peering and transit: in most cases, everybody serves as an upstream provider to all their peers. Note that if you have very slow connectivity to the Internet, you may want to avoid providing transit between your peers, which can be done by filtering or prepending your ASN. For the sake of sane routing, try to peer with people on the same continent to avoid inefficient routing, <50ms is a good rule of thumb. You can also look into Bird communities if you are using Bird to mark the latency for the [link](/howto/BGP-communities).
321
+## Run a routing daemon
307 322
308
-You can use the [Public node directory](https://peerfinder.dn42.dev/) to help you find potential peers close to you.
323
+You need a BGP daemon to exchange routes with peers. Common choices are BIRD and FRR, but you can use anything—OpenBGPD, XORP, or even [hardware routers](/howto/BGP-on-Extreme-Summit1i). See the [FAQ](/FAQ#frequently-asked-questions_what-bgp-daemon-should-i-use) for guidance.
309 324
310
-You can then contact them on IRC or by email. In case you're really at loss, you can also ask for peers on the mailing list.
325
+See [BIRD configuration examples](/howto/Bird2).
311 326
312
-## Establishing tunnels
327
+## Configuration examples
313 328
314
-Unless your dn42 peers are on the same network, you must establish tunnels. Choose anything you like: Wireguard, OpenVPN, GRE, GRE + IPSec, IPIP, Tinc, ...
329
+### General
315 330
316
-There is some documentation in this wiki, like [gre-plus-ipsec](/howto/GRE-plus-IPsec).
331
+- [Network configuration](/howto/networksettings)
317 332
318
-## Running a routing daemon
333
+### VPN/Tunnels
319 334
320
-You need a routing daemon to speak BGP with your peers. People usually run Bird or FRR, but you may use anything (OpenBGPD, XORP, somebody even used an old [hardware router](BGP-on-Extreme-Summit1i) ). See the relevant [FAQ entry](/FAQ#frequently-asked-questions_what-bgp-daemon-should-i-use).
335
+- [WireGuard](/howto/wireguard)
336
+- [OpenVPN](/howto/openvpn)
337
+- [Tinc](/howto/tinc)
338
+- [IPsec with public keys](/howto/IPsec-with-PublicKeys)
321 339
322
-You can find [configuration examples for Bird here](/howto/Bird2).
340
+### BGP daemons
323 341
324
-## Configuration Examples
342
+- [BIRD](/howto/Bird2)
343
+- [FRR](/howto/frr)
344
+- [OpenBGPD](/howto/OpenBGPD)
325 345
326
-* [Important Network configuration](/howto/networksettings)
346
+### Router-specific
327 347
328
-* VPN/Tunnel:
329
- * [Wireguard](/howto/wireguard)
330
- * [Openvpn](/howto/openvpn)
331
- * [Tinc](/howto/tinc)
332
- * [IPsec with public key authentication](/howto/IPsec-with-PublicKeys)
333
-* BGP:
334
- * [Bird](/howto/Bird2)
335
- * [FRR](/howto/frr)
336
- * [OpenBGPD](/howto/OpenBGPD)
337
-* Router specific:
338
- * [dn42 on OpenWRT](/howto/OpenWRT)
339
- * [EdgeOS Configuration](/howto/EdgeOS-Config-Example)
340
- * [EdgeOS GRE/IPsec Example](/howto/EdgeOS-GRE-IPsec-Example)
341
- * [BGP on Extreme Networks Summit 1i](/howto/BGP-on-Extreme-Summit1i)
348
+- [OpenWRT](/howto/OpenWRT)
349
+- [EdgeOS configuration](/howto/EdgeOS-Config-Example)
350
+- [EdgeOS GRE/IPsec](/howto/EdgeOS-GRE-IPsec-Example)
351
+- [Extreme Networks Summit 1i](/howto/BGP-on-Extreme-Summit1i)
342 352
343
-# Configure DNS
353
+## Configure DNS
344 354
345
-See [Services DNS](/services/DNS).
355
+See [DNS services](/services/DNS).
346 356
347
-# Use and provide services
357
+## Use and provide services
348 358
349
-See [internal](/internal/Internal-Services) for internal services.
359
+See [internal services](/internal/Internal-Services) for available services.
350 360
351
-Don't hesitate to provide interesting services, but *please*, document them on the wiki! Otherwise, nobody will use them because nobody can guess they even exist.
361
+If you provide a service, please document it on the wiki, otherwise nobody will know it exists!
... ...
\ No newline at end of file