Your First eBGP Session on a VPS with a Free /48 from IPYE

Disclosure up front: I run IPYE, a company that leases IP space. Most of this article is practical how-to; IPYE appears where a free /48, LOA, or ROA helps you try the work, with a short call to action at the end.

The first eBGP session on a rented VPS usually stalls on paperwork and small kernel details, not on BGP syntax. A free IPv6 /48 from IPYE removes most of the paperwork: setup is instant, the allocation is real and announceable from your own ASN, the LOA comes from the portal, and the ROA is created automatically. This walkthrough brings up FRR on a BGP-capable VPS using documentation values: your ASN 64496, the provider's ASN 64497, the provider's neighbour 2001:db8:0:1::1, and the prefix 2001:db8:100::/48. Substitute your real values when you go live.

Preconditions

Ask the host three things before you touch the config. Does the product support BGP sessions with customer ASNs, or only static routing of a bring-your-own prefix? Is the session single-hop to the gateway, or multihop to a route server on a loopback? Do they require an MD5 password, and do they want the LOA attached to the ticket? Keep SSH on the address the provider assigned, never on the /48, so a withdrawn announcement cannot lock you out.

Give the route a home

FRR's network statement only advertises a prefix that already exists in the routing table, unless you disable the import check. The clean fix is a blackhole route for the aggregate plus real addresses on a loopback or dummy interface:

ip link add dummy0 type dummy
ip link set dummy0 up
ip -6 addr add 2001:db8:100::1/128 dev dummy0
ip -6 route add blackhole 2001:db8:100::/48

The blackhole keeps unused parts of the /48 from looping back to the upstream, while the longer /128 still delivers traffic to the service address. Persist all of this with systemd-networkd or netplan; a reboot that loses the dummy interface leaves you announcing space the host cannot answer.

FRR configuration

Enable bgpd in /etc/frr/daemons, then:

router bgp 64496
 bgp router-id 192.0.2.1
 neighbor 2001:db8:0:1::1 remote-as 64497
 neighbor 2001:db8:0:1::1 description vps-uplink
 neighbor 2001:db8:0:1::1 timers 10 30
 !
 address-family ipv6 unicast
  network 2001:db8:100::/48
  neighbor 2001:db8:0:1::1 activate
  neighbor 2001:db8:0:1::1 prefix-list OUT-V6 out
  neighbor 2001:db8:0:1::1 prefix-list IN-V6 in
  neighbor 2001:db8:0:1::1 maximum-prefix 10
 exit-address-family
!
ipv6 prefix-list OUT-V6 seq 10 permit 2001:db8:100::/48
ipv6 prefix-list IN-V6 seq 10 permit ::/0
ipv6 prefix-list IN-V6 seq 99 deny any

Recent FRR releases enforce RFC 8212 by default (bgp ebgp-requires-policy), so an eBGP neighbour with no inbound or outbound policy sends and accepts nothing. Applying prefix-lists in both directions satisfies that check without disabling it. If the host only sends you a default route, the inbound list above is all you need; if they send a full table, see the memory notes before you raise maximum-prefix.

For a multihop route server, add neighbor 2001:db8:0:1::1 ebgp-multihop 2 and make sure a static route to the server's address exists. For MD5, add neighbor 2001:db8:0:1::1 password followed by the shared secret from your ticket, and keep that secret out of Git.

Paperwork in parallel

While the host reviews the ticket, download the LOA from the IPYE portal and attach it with your ASN and the peer addresses. Then check the ROA in a validator before you announce, for example with Routinator: routinator vrps --noupdate | grep 2001:db8:100. The VRP should show origin AS64496 and a maxLength that covers exactly what you plan to send.

Verification beyond Established

vtysh -c 'show bgp ipv6 unicast summary'
vtysh -c 'show bgp ipv6 unicast neighbors 2001:db8:0:1::1 advertised-routes'
vtysh -c 'show bgp ipv6 unicast 2001:db8:100::/48'

advertised-routes is the important one: it shows what actually left your box after policy. From a host on another network, run ping -6 2001:db8:100::1 and mtr -6 toward the loopback. Then look the prefix up in RIPEstat or a public route collector and confirm origin AS64496.

Common first-session failures

• Session stuck in Active: TCP 179 filtered, wrong neighbour address, or a missing multihop setting. tcpdump -ni eth0 port 179 shows whether SYNs leave and whether anything answers.
• Established, zero prefixes sent: the aggregate is missing from the RIB, or the outbound prefix-list does not match.
• Visible at the host, invisible elsewhere: the host has not yet updated its export filter, or the ROA does not match the origin.
• Session flaps after a reboot: FRR started before the dummy interface existed. Order the units so networking comes up first.

To roll back, run neighbor 2001:db8:0:1::1 shutdown under router bgp. The session stays configured but announces nothing.

Do this next

When the host confirms BGP support, claim a free /48 from IPYE and run through this checklist with your own ASN. Questions: ipye@turnel.com.

About IPYE

IPYE (https://ipye.com) leases IPv4, IPv6 and ASN space with instant setup. Your first IPv6 /48 is free for the first year, a real allocation you can announce on your own ASN, with a LOA from the portal and the ROA created automatically. ASN and region changes apply automatically. IPv4 /24 to /22 leases include LOA, ROA and per-/24 rDNS; WHOIS is editable on IPv6 /44 and larger. Locations: Los Angeles, New York, Ashburn, Salt Lake City, London, Amsterdam, Frankfurt. Claim your free /48: https://my.ipye.com/products/ipv6-rental. Questions: ipye@turnel.com.

Disclosure: I run IPYE