remove dn42

This reverts commit 682fb1b033.

bird/bird.conf

@@ -1,40 +1,53 @@
 include "/etc/bird/vars.conf";
+include "/etc/bird/whitelist/*.conf";
 include "/etc/bird/function/*.conf";
 include "/etc/bird/conf/*.conf";
 
 protocol device {
     scan time 10;
-}
-
-protocol kernel {
-    scan time 20;
-    ipv6 {
-        import none;
-        export filter {
-            if source = RTS_STATIC then reject;
-            if !is_bogon_prefix() then {
-                krt_prefsrc = LOCAL_V6_kernel;
-                accept;
-            }
-            reject;
-        };
-    };
 };
 
-protocol kernel {
+protocol kernel kernel_main4 {
     scan time 20;
     ipv4 {
         import none;
         export filter {
-            if source = RTS_STATIC then reject;
+            if bgp_large_community ~ [(UNET_ASN, 10,4)] then accept;
-            if !is_bogon_prefix() then {
-                krt_prefsrc = LOCAL_V4_kernel;
-                accept;
-            }
             reject;
         };
     };
 };
 
+
+protocol kernel kernel_t102v4 {
+    scan time 20;
+    kernel table 102;
+    ipv4 {
+        table t102v4;
+        import none;
+        export filter {
+            if bgp_large_community ~ [(UNET_ASN, 10,10204)] then accept;
+            reject;
+        };
+    };
+};
+
+
+protocol kernel kernel_t102v6 {
+    scan time 20;
+    kernel table 102;
+    ipv6 {
+        table t102v6;
+        import none;
+        export filter {
+            if bgp_large_community ~ [(UNET_ASN, 10,10206)] then accept;
+            reject;
+        };
+    };
+};
+
+include "/etc/bird/net/*.conf";
+include "/etc/bird/filter/*.conf";
 include "/etc/bird/template/*.conf";
-include "/etc/bird/peers/*.conf";
+include "/etc/bird/peers/inet/*.conf";
+include "/etc/bird/peers/unet/*.conf";

bird/conf/bfd.conf

@@ -0,0 +1,6 @@
+protocol bfd {
+    interface "wg_%" {
+        interval 50 ms;
+        multiplier 3;
+    };
+}

bird/conf/inet.conf

@@ -0,0 +1,29 @@
+protocol static route_int_export_v4 {
+    route 44.32.191.0/24 reject; 
+    ipv4 {
+        table inet4;
+        import filter {
+            bgp_large_community.add((LOCAL_ASN,3,0));
+            bgp_large_community.add((LOCAL_ASN,1,0));
+            bgp_large_community.add((LOCAL_ASN,200,0));
+            accept;
+        };
+        export none;
+    };
+}
+
+protocol static route_int_export_v6 {
+    route 2406:840:e602::/48 reject; 
+    route 2406:840:e604::/48 reject; 
+    route 2406:840:e606::/48 reject;
+    ipv6 {
+        table inet6;
+        import filter {
+            bgp_large_community.add((LOCAL_ASN,3,0));
+            bgp_large_community.add((LOCAL_ASN,1,0));
+            bgp_large_community.add((LOCAL_ASN,200,0));
+            accept;
+        };
+        export none;
+    };
+}

bird/conf/mynet.conf

@@ -1,11 +0,0 @@
-function is_self_net() {
-  return net ~ [
-    44.32.191.0/24
-    ];
-}
-
-function is_self_net_v6() {
-  return net ~ [
-    2406:840:e600::/44{44,48}
-    ];
-}

bird/conf/static.conf

@@ -1,26 +1,9 @@
-protocol static route_int_export_v4 {
+protocol static static_inet6 {
-    route 44.32.191.0/24 reject; 
+    route 2406:840:e601:1000::/56 via 2406:840:e601:16::18; 
-    ipv4 {
-        table inet4;
-        import filter {
-            bgp_large_community.add((LOCAL_ASN,3,0));
-            bgp_large_community.add((LOCAL_ASN,1,0));
-            bgp_large_community.add((LOCAL_ASN,200,0));
-            accept;
-        };
-        export none;
-    };
-}
-
-protocol static route_int_export_v6 {
-    route 2406:840:e600::/48 reject; 
-
     ipv6 {
         table inet6;
         import filter {
-            bgp_large_community.add((LOCAL_ASN,3,0));
             bgp_large_community.add((LOCAL_ASN,1,0));
-            bgp_large_community.add((LOCAL_ASN,200,0));
             accept;
         };
         export none;

bird/conf/unet.conf

@@ -0,0 +1,31 @@
+protocol static route_unet_export_v4 {
+    route 10.188.6.0/23 reject; 
+    route 10.188.5.124/30 reject;
+    route 44.32.191.16/28 reject;
+    route 44.32.191.7/32 reject;
+    ipv4 {
+        table unet4;
+        import filter {
+            bgp_large_community.add((UNET_ASN,3,0));# 不允许导出到内核
+            bgp_large_community.add((UNET_ASN,1,0));# 不允许传输到ibgp
+            bgp_large_community.add((UNET_ASN,200,0));# 传输到Ebgp
+            accept;
+        };
+        export none;
+    };
+}
+
+protocol static route_unet_export_v6 {
+    route 2406:840:e603::/48 reject; 
+    route 2406:840:e60e::/56 reject;
+    ipv6 {
+        table unet6;
+        import filter {
+            bgp_large_community.add((UNET_ASN,3,0));# 不允许导出到内核
+            bgp_large_community.add((UNET_ASN,1,0));# 不允许传输到ibgp
+            bgp_large_community.add((UNET_ASN,200,0));# 传输到Ebgp
+            accept;
+        };
+        export none;
+    };
+}

bird/filter/inet_downstream.conf

@@ -0,0 +1,17 @@
+# 下游过滤器
+# 政策：发全表，只收下游和关联下游的
+
+# 下游-发表控制器
+function function_inet6_downstream_export() {
+    if is_bogon_prefix() || (bgp_path.len > 20) then return false;
+    if ! (bgp_large_community ~ [(LOCAL_ASN, 200, 0),(LOCAL_ASN, 10100, 0..9000)]) then return false;
+    return true;
+}
+
+
+# 下游-收表控制器
+# 注意，配置下游时候，一定要注意手打一个 300 0 ，不然发不出去
+function function_inet6_downstream_import() {
+    if is_bogon_prefix() || (bgp_path.len > 20) then return false;
+    return true;
+}

bird/filter/inet_ibgp.conf

@@ -0,0 +1,35 @@
+function function_inet_ibgp_import() {
+    bgp_large_community.delete((LOCAL_ASN,3,0)); 
+    if is_self_net() then return false;
+    if is_bogon_prefix() then return false;
+    if bgp_large_community ~ [(LOCAL_ASN, 1,*)] then return false;
+    return true;
+}
+
+function function_inet_ibgp_export() {
+    bgp_large_community.delete((LOCAL_ASN,3,0)); 
+    if is_self_net() then return false;
+    if is_bogon_prefix() then return false;
+    if bgp_large_community ~ [(LOCAL_ASN, 1,*)] then return false;
+    return true;
+}
+
+function function_inet4_ibgp_import() {
+    if !function_inet_ibgp_import() then return false;
+    return true;
+}
+
+function function_inet4_ibgp_export() {
+    if !function_inet_ibgp_export() then return false;
+    return true;
+}
+
+function function_inet6_ibgp_import() {
+    if !function_inet_ibgp_import() then return false;
+    return true;
+}
+
+function function_inet6_ibgp_export() {
+    if !function_inet_ibgp_export() then return false;
+    return true;
+}

bird/filter/inet_import.conf

@@ -0,0 +1,10 @@
+# 对上游接收过滤器
+# 政策：全网照单接受
+
+function function_inet_bgp_import_from_upstream() {
+    if is_self_net() then return false;
+    if is_bogon_prefix() || (bgp_path.len > 20) then return false;
+    # 允许转发给下游
+    bgp_large_community.add((LOCAL_ASN,1000,0));
+    return true;
+}

bird/filter/inet_upstream0.conf

@@ -0,0 +1,34 @@
+# 普通上游（发布控制器）
+# 政策：只发自己的
+
+function function_inet_bgp_export_to_upstream0() {
+    if !is_self_net() then return false;
+    if is_bogon_prefix() then return false;
+    if source != RTS_STATIC then return false;
+    # 100禁止性过滤
+    if bgp_large_community ~ [(LOCAL_ASN, 100, 100)] then return false;
+    if bgp_large_community ~ [(LOCAL_ASN, 100, 200)] then return false;
+    if bgp_large_community ~ [(LOCAL_ASN, 200, 201)] then return false;
+
+    # 前置过滤：允许自己的段子-所有上游和普通上游
+    if bgp_large_community ~ [(LOCAL_ASN, 200, 0)] then return true;
+    if bgp_large_community ~ [(LOCAL_ASN, 200, 1)] then return true;
+    if bgp_large_community ~ [(LOCAL_ASN, 200, 2)] then return false;
+    return false;
+}
+
+
+function function_inet_control_bgp_upstream0(int peer_asn){
+    # 1.禁止带有 201 0 (禁止一切外发)的发出去
+    if bgp_large_community ~ [(LOCAL_ASN, 201, 0)] then return false;
+    # 2.禁止带有 201 peer asn (禁止向某一外发)的发出去
+    if bgp_large_community ~ [(LOCAL_ASN, 201, peer_asn)] then return false;
+
+    # 3.不带202,0(允许全体外发)，但是带有202,peer asn（允许单一外发）的，放
+    if (bgp_large_community !~ [(LOCAL_ASN, 202, 0)]) then {
+        if bgp_large_community ~ [(LOCAL_ASN, 202, peer_asn)] then return true;
+    }
+    # 4.带有202,0（允许一切外发）的，放
+    if bgp_large_community ~ [(LOCAL_ASN, 202, 0)] then return true;
+    return false;
+}

bird/filter/inet_upstream1.conf

@@ -0,0 +1,46 @@
+# 能带下游的上游（发布控制器）
+# 政策：发自己的+下游的
+
+function function_inet_bgp_export_to_upstream1() {
+    if source !~ [RTS_STATIC, RTS_BGP] then return false;
+    if is_bogon_prefix() then return false;
+    # 100禁止性过滤
+    if bgp_large_community ~ [(LOCAL_ASN, 100, 100)] then return false;
+    if bgp_large_community ~ [(LOCAL_ASN, 100, 200)] then return false;
+    if bgp_large_community ~ [(LOCAL_ASN, 200, 202)] then return false;
+    if source =RTS_STATIC then {
+        # 静态路由，允许 200，[0 2]
+        if bgp_large_community ~ [(LOCAL_ASN, 200, 0)] then return true;
+        if bgp_large_community ~ [(LOCAL_ASN, 200, 2)] then return true;
+        if bgp_large_community ~ [(LOCAL_ASN, 200, 1)] then return false;
+    }
+    if source = RTS_BGP then {
+        if bgp_large_community ~ [(LOCAL_ASN, 10100, 4)] then return true;
+    }
+    return false;
+}
+
+
+function function_inet_control_bgp_upstream1(int peer_asn){
+    # 1.禁止带有 201 0 (禁止一切外发)  301 0（禁止下游段子转发）的发出去
+    if bgp_large_community ~ [(LOCAL_ASN, 201, 0)] then return false;
+    if bgp_large_community ~ [(LOCAL_ASN, 301, 0)] then return false;
+    # 2.禁止带有 201 peer asn (禁止向某一外发) 301 peer asn（禁止向某一外发下游）的发出去
+    if bgp_large_community ~ [(LOCAL_ASN, 201, peer_asn)] then return false;
+    if bgp_large_community ~ [(LOCAL_ASN, 301, peer_asn)] then return false;
+
+
+    # 3.不带202,0(允许全体外发)，但是带有202,peer asn 放
+    if (bgp_large_community !~ [(LOCAL_ASN, 202, 0)]) then {
+        if bgp_large_community ~ [(LOCAL_ASN, 202, peer_asn)] then return true;
+    }
+    # 不带302 0，但是有302 peer asn的，放
+    if (bgp_large_community !~ [(LOCAL_ASN, 302, 0)]) then {
+        if bgp_large_community ~ [(LOCAL_ASN, 302, peer_asn)] then return true;
+    }
+
+    # 4.带有202,0（允许一切外发）和302 0的，放
+    if bgp_large_community ~ [(LOCAL_ASN, 202, 0)] then return true;
+    if bgp_large_community ~ [(LOCAL_ASN, 302, 0)] then return true;
+    return false;
+}

bird/filter/unet_filter.conf

@@ -0,0 +1,42 @@
+function function_unet_import() {
+    if !unet_is_valid_network() then return false;
+    if is_unet_self_net() then return false;
+    bgp_large_community.add((UNET_ASN,200,0));
+    return true;
+}
+
+function function_unet_export() {
+    if !unet_is_valid_network() then reject; 
+    if source !~ [RTS_STATIC, RTS_BGP] then reject;
+     if bgp_large_community !~ [(UNET_ASN, 200,0)] then reject;      
+    accept;
+}
+
+function function_unet_only_import() {
+    if !unet_is_valid_network_v4() then return false;
+    if is_unet_self_net() then return false;
+    bgp_large_community.add((UNET_ASN,200,0));
+    return true;
+}
+
+function function_unet_only_export() {
+    if !unet_is_valid_network_v4() then return false;
+    if source !~ [RTS_STATIC, RTS_BGP] then return false;
+    if bgp_large_community !~ [(UNET_ASN, 200,0)] then return false;      
+    return true;
+}
+
+
+function function_unet_ibgp_import() {
+    if bgp_large_community ~ [(UNET_ASN, 1,*)] then return false;
+    if !unet_is_valid_network() then return false;
+    if is_unet_self_net() then return false;
+    return true;
+}
+
+function function_unet_ibgp_export() {
+    if bgp_large_community ~ [(UNET_ASN, 1,*)] then return false;
+    if !unet_is_valid_network() then return false;
+    if is_unet_self_net() then return false;
+    return true;
+}

bird/function/inet.conf

@@ -0,0 +1,7 @@
+function is_self_net() {
+    case net.type {
+        NET_IP4: return net ~ is_inet_self_IPv4;
+        NET_IP6: return net ~ is_inet_self_IPv6;
+        else: print "is_inet_prefix: unexpected net.type ", net.type, " ", net; return false;
+    }
+}

bird/function/tables.conf

@@ -1,22 +1,8 @@
+ipv4 table t102v4;
+ipv6 table t102v6;
 ipv4 table inet4;
 ipv6 table inet6;
-
+ipv4 table unet4;
-protocol pipe inet6_sync {
+ipv6 table unet6;
-  table inet6;
+ipv4 table ospf4;
-  peer table master6;
+ipv6 table ospf6;
-  import none;
-  export filter {
-    if bgp_large_community ~ [(LOCAL_ASN, 3,*)] then reject;
-    accept;
-    };
-}
-
-protocol pipe inet4_sync {
-  table inet4;
-  peer table master4;
-  import none;
-  export filter {
-    if bgp_large_community ~ [(LOCAL_ASN, 3,*)] then reject;
-    accept;
-    };
-}

bird/function/unet.conf

@@ -0,0 +1,32 @@
+function unet_is_valid_network_v4() {
+  return net ~ [
+    10.0.0.0/8+
+  ];
+}
+
+function unet_is_valid_network_v4_allnet(){
+  if unet_is_valid_network_v4() then return true;
+  if is_self_net() then return true;
+  return false;
+}
+
+function unet_is_voalid_net_v6(){
+  if is_self_net() then return true;
+  return false;
+}
+
+function is_unet_self_net() {
+    case net.type {
+        NET_IP4: return net ~ is_unet_self_IPv4;
+        NET_IP6: return net ~ is_unet_self_IPv6;
+        else: print "is_unet_prefix: unexpected net.type ", net.type, " ", net; return false;
+    }
+}
+
+
+function unet_is_valid_network() {
+    case net.type {
+        NET_IP4: return unet_is_valid_network_v4_allnet();
+        NET_IP6: return unet_is_voalid_net_v6();
+    }
+}

bird/net/inet.conf

@@ -0,0 +1,29 @@
+protocol pipe inet4_sync {
+  table inet4;
+  peer table t102v4;
+  export filter {
+    if bgp_large_community ~ [(LOCAL_ASN, 3,*)] then reject;
+    if is_bogon_prefix() then reject;
+    bgp_community.empty;
+    bgp_large_community.empty;
+    bgp_large_community.add((UNET_ASN,10,10204));
+    krt_prefsrc = LOCAL_V4_kernel;
+    accept;
+    };
+  import none;
+}
+
+protocol pipe inet6_sync {
+  table inet6;
+  peer table t102v6;
+  export filter {
+    if bgp_large_community ~ [(LOCAL_ASN, 3,*)] then reject;
+    if is_bogon_prefix() then reject;
+    bgp_community.empty;
+    bgp_large_community.empty;
+    bgp_large_community.add((UNET_ASN,10,10206));
+    krt_prefsrc = LOCAL_V6_kernel;
+    accept;
+    };
+    import none;
+}

bird/net/ospf.conf

@@ -0,0 +1,21 @@
+protocol pipe ospf4_sync {
+  table ospf4;
+  peer table unet4;
+  export filter {
+    if bgp_large_community ~ [(UNET_ASN, 3,*)] then reject;
+    accept;
+    };
+  import none;
+}
+
+protocol pipe ospf6_sync {
+  table ospf6;
+  peer table unet6;
+  export filter {
+    if bgp_large_community ~ [(UNET_ASN, 3,*)] then reject;
+    accept;
+    };
+  import none;
+}
+
+include "/etc/bird/peers/ospf/*.conf";

bird/net/unet.conf

@@ -0,0 +1,40 @@
+# 公网处理 => inet4/6
+protocol pipe unet4_inet4_sync {
+  table unet4;
+  peer table inet4;
+  export filter {
+    if bgp_large_community ~ [(UNET_ASN, 3,*)] then reject;
+    if is_bogon_prefix() then {
+          if net!~[10.188.0.0/16+] then reject;
+    }
+    accept;
+    };
+  import none;
+}
+
+protocol pipe unet6_inet6_sync {
+  table unet6;
+  peer table inet6;
+  export filter {
+    if bgp_large_community ~ [(UNET_ASN, 3,*)] then reject;
+    if is_bogon_prefix() then reject;
+    accept;
+    };
+    import none;
+}
+
+# 剩下的进入master  (只有V4)
+protocol pipe unet4_sync {
+  table unet4;
+  peer table master4;
+  export filter {
+    if bgp_large_community ~ [(UNET_ASN, 3,*)] then reject;
+    if !unet_is_valid_network_v4() then reject;
+    bgp_community.empty;
+    bgp_large_community.empty;
+    bgp_large_community.add((UNET_ASN,10,4));
+    krt_prefsrc = UNET_V4_kernel;
+    accept;
+    };
+  import none;
+}

bird/peers/bgp.conf

@@ -1,4 +0,0 @@
-protocol bgp inet_bgp_as153376 from tpl_bgp_up {
-    source address fe80:15:3376:3::2:2;
-    neighbor fe80:15:3376:3::3:2%pccw1 as 153376;
-}

bird/peers/inet/ebgp.conf

@@ -0,0 +1,9 @@
+protocol bgp bgp_int_44324_v4 from tpl_inet4_up {
+    source address 10.188.6.1;
+    neighbor 10.188.6.2 as 44324;
+}
+
+protocol bgp bgp_int_44324_v6 from tpl_inet6_up {
+    source address fe80:1::2;
+    neighbor fe80:1::1%wg_40005 as 44324;
+}

bird/peers/inet/ibgp.conf

@@ -0,0 +1,9 @@
+protocol bgp ibgp_int_zj1_v6 from tpl_inet6_ibgp {
+    source address fe80:1::2;
+    neighbor fe80:1::1%wg_40005 as LOCAL_ASN;
+}
+
+protocol bgp ibgp_int_zj1_v4 from tpl_inet4_ibgp {
+    source address 10.188.1.1;
+    neighbor 10.188.1.2 as LOCAL_ASN;
+}

bird/peers/ospf/ospf_ipv4.conf

@@ -0,0 +1,35 @@
+protocol ospf v3 ospf_ipv4 {
+    ipv4 {
+        table ospf4;
+        import filter {
+            bgp_large_community.add((UNET_ASN,1,0));
+            accept;
+        };
+        export filter { 
+            if bgp_large_community !~ [(UNET_ASN, 301,0)] then reject;
+            accept;
+        };
+        import limit 1000 action block;
+    };
+    area 0 {
+        interface "pccw1" {
+            cost 5;
+            password "114514";
+        };
+
+    };
+}
+
+
+protocol static route_ospf_export_v4 {
+    route 10.188.3.0/24 reject;
+    ipv4 {
+        table ospf4;
+        import filter {
+            bgp_large_community.add((UNET_ASN,301,0));# 允许导出至OSPF
+            bgp_large_community.add((UNET_ASN,3,0));# 不允许导出到内核
+            accept;
+        };
+        export none;
+    };
+}

bird/peers/ospf/ospf_ipv6.conf

@@ -0,0 +1,36 @@
+protocol ospf v3 ospf_ipv6 {
+    ipv6 {
+        table ospf6;
+        import filter {
+            bgp_large_community.add((UNET_ASN,1,0));
+            accept;
+        };
+        export filter { 
+            if bgp_large_community !~ [(UNET_ASN, 301,0)] then reject;
+            accept;
+        };
+        import limit 1000 action block;
+    };
+    area 0 {
+        interface "pccw1" {
+            cost 5;
+        };
+    };
+}
+
+protocol static route_ospf_export_v6 {
+    route 2406:840:e601:1::/64 reject;
+    route 2406:840:e601:3::/64 reject;
+    route 2406:840:e601:4::/63 reject;
+    route 2406:840:e601:2000::/51 reject;
+
+    ipv6 {
+        table ospf6;
+        import filter {
+            bgp_large_community.add((UNET_ASN,301,0));# 允许导出至OSPF
+            bgp_large_community.add((UNET_ASN,3,0));# 不允许导出到内核
+            accept;
+        };
+        export none;
+    };
+}

bird/peers/unet/ebgp.conf

@@ -0,0 +1,9 @@
+protocol bgp bgp_unet_hk2 from unet_bgp_up0 {
+    source address fe80:15:3376:3::2:2;
+    neighbor fe80:15:3376:3::3:2%pccw1 as 4218818801;
+}
+
+protocol bgp bgp_unet_hk3 from unet_bgp_up1 {
+    source address fe80:15:3376:3::2:2;
+    neighbor fe80:15:3376:3::3:2%pccw1 as 4218818802;
+}

bird/peers/unet/ibgp.conf

@@ -0,0 +1,4 @@
+protocol bgp ibgp_unet_hk1 from unet_ibgp {
+    source address fe80:15:3376:3::2:2;
+    neighbor fe80:15:3376:3::3:2%pccw1 as UNET_ASN;
+}

bird/template/inet.conf

@@ -1,77 +1,34 @@
-template bgp tpl_bgp_up {
+template bgp tpl_inet_up {
     graceful restart;
     local as LOCAL_ASN;
     ipv4 {
         table inet4;
-        import filter {
+        import filter {if !function_inet_bgp_import_from_upstream() then reject; accept; };
-            if is_self_net() then reject; 
+        export filter {if !function_inet_bgp_export_to_upstream0() then reject; accept; };
-            if is_bogon_prefix() || (bgp_path.len > 100) then reject; 
-            accept;
-        };
-        export filter {
-            if !is_self_net() then reject; 
-            if is_bogon_prefix() || (bgp_path.len > 100) then reject;
-            if source != RTS_STATIC then reject;
-            if bgp_large_community !~ [(LOCAL_ASN, 200,0)] then reject;      
-            bgp_large_community.empty;  
-            accept;
-        };
     };
     ipv6 {
         table inet6;
-        import filter {
+        import filter {if !function_inet_bgp_import_from_upstream() then reject; accept; };
-            if is_self_net_v6() then reject; 
+        export filter {if !function_inet_bgp_export_to_upstream0() then reject; accept; };
-            if is_bogon_prefix() || (bgp_path.len > 100) then reject; 
-            accept;
-        };
-        export filter {
-            if !is_self_net_v6() then reject; 
-            if is_bogon_prefix() || (bgp_path.len > 100) then reject;
-            if source != RTS_STATIC then reject;
-            if bgp_large_community !~ [(LOCAL_ASN, 200,0)] then reject;      
-            bgp_large_community.empty;  
-            accept;
-        };
     };
 }
 
-template bgp tpl_ibgp {
+template bgp tpl_inet4_up {
     graceful restart;
     local as LOCAL_ASN;
-    med metric;
-    direct;
     ipv4 {
         table inet4;
-        next hop self;
+        import filter {if !function_inet_bgp_import_from_upstream() then reject; accept; };
-        gateway direct;
+        export filter {if !function_inet_bgp_export_to_upstream0() then reject; accept; };
-        import filter {
+    };
-            if is_self_net() then reject; 
+}
-            if is_bogon_prefix() then reject; 
+
-            if bgp_large_community ~ [(LOCAL_ASN, 1,*)] then reject;
+template bgp tpl_inet6_up {
-            accept;
+    graceful restart;
-        };
+    local as LOCAL_ASN;
-        export filter {
+    ipv6 {
-            if is_self_net() then reject; 
+        table inet6;
-            if is_bogon_prefix() then reject; 
+        import filter {if !function_inet_bgp_import_from_upstream() then reject; accept; };
-            if bgp_large_community ~ [(LOCAL_ASN, 1,*)] then reject;
+        export filter {if !function_inet_bgp_export_to_upstream0() then reject; accept; };
-            accept;
-        };
-    };
-    ipv6 {
-        table inet6;
-        next hop self;
-        gateway direct;
-        import filter { 
-            if is_self_net_v6() then reject;
-            if is_bogon_prefix() then reject;
-            if bgp_large_community ~ [(LOCAL_ASN, 1,*)] then reject;
-            accept;
-        };
-        export filter { 
-            if is_self_net_v6() then reject;
-            if is_bogon_prefix() then reject;
-            if bgp_large_community ~ [(LOCAL_ASN, 1,*)] then reject;
-            accept;
-            };
     };
 }

bird/template/inet_ibgp.conf

@@ -0,0 +1,37 @@
+template bgp tpl_inet_ibgp {
+    graceful restart;
+    local as LOCAL_ASN;
+    med metric;
+    direct;
+    ipv4 {
+        table inet4;
+        next hop self;
+        gateway direct;
+        import filter {if !function_inet4_ibgp_import() then reject; accept; };
+        export filter {if !function_inet4_ibgp_export() then reject; accept; };
+    };
+    ipv6 {
+        table inet6;
+        next hop self;
+        gateway direct;
+        import filter {if !function_inet6_ibgp_import() then reject; accept; };
+        export filter {if !function_inet6_ibgp_export() then reject; accept; };
+    };
+}
+
+
+template bgp tpl_inet_ibgp_local_mp {
+    graceful restart;
+    local as LOCAL_ASN;
+    med metric;
+    ipv4 {
+        table inet4;
+        import filter { if !function_inet4_ibgp_import() then reject; accept; };
+        export filter { if !function_inet4_ibgp_export() then reject; accept; };
+    };
+    ipv6 {
+        table inet6;
+        import filter { if !function_inet6_ibgp_import() then reject; accept; };
+        export filter { if !function_inet6_ibgp_export() then reject; accept; };
+    };
+}

bird/template/unet.conf

@@ -0,0 +1,48 @@
+template bgp unet_bgp_up0 {
+    graceful restart;
+    local as UNET_ASN;
+    ipv4 {
+        table unet4;
+        import filter {if !function_unet_import() then reject; accept; };
+        export filter {if !function_unet_export() then reject; accept; };
+        import limit 9000 action block; 
+    };
+    ipv6 {
+        table unet6;
+        import filter {if !function_unet_import() then reject; accept; };
+        export filter {if !function_unet_export() then reject; accept; };
+        import limit 9000 action block; 
+    };
+}
+
+template bgp unet_bgp_up1 {
+    graceful restart;
+    local as UNET_ASN;
+    ipv4 {
+        table unet4;
+        import filter {if !function_unet_only_import() then reject; accept; };
+        export filter {if !function_unet_only_export() then reject; accept; };
+        import limit 9000 action block; 
+    };
+}
+
+template bgp unet_ibgp {
+    graceful restart;
+    local as UNET_ASN;
+    med metric;
+    direct;
+    ipv4 {
+        table unet4;
+        next hop self;
+        gateway direct;
+        import filter {if !function_unet_ibgp_import() then reject; accept; };
+        export filter {if !function_unet_ibgp_export() then reject; accept; };
+    };
+    ipv6 {
+        table unet6;
+        next hop self;
+        gateway direct;
+        import filter {if !function_unet_ibgp_import() then reject; accept; };
+        export filter {if !function_unet_ibgp_export() then reject; accept; };
+    };
+}

bird/vars.conf

@@ -1,5 +1,11 @@
 define LOCAL_ASN = 153376;
-define LOCAL_V4_kernel = 10.188.2.3;
+define LOCAL_V4_kernel = 44.32.191.7;
-define LOCAL_V6_kernel = 2406:840:e601:1::1;
+define LOCAL_V6_kernel = 2406:840:e603::1;
 
-router id 154.37.212.38;
+define DN42_ASN = 4242423376;
+define DN42_V4_kernel = 172.20.21.7;
+
+define UNET_ASN = 4218818801;
+define UNET_V4_kernel = 10.188.6.2;
+
+router id 10.188.6.2;

bird/whitelist/downmyip.sh

@@ -0,0 +1,93 @@
+#!/bin/bash
+# downmyip - 自动从 /etc/bird/vars.conf 读取ASN并下载ROA配置
+
+# 配置文件路径
+VARS_CONF="/etc/bird/vars.conf"
+BASE_URL="https://ntwkapi.noc.zhuantou.com.cn/brnet/roa/api.php?as="
+
+# 颜色输出
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+NC='\033[0m'
+
+get_asn() {
+    grep "^define $1_ASN" "$VARS_CONF" | awk -F'[=; ]' '{print $5}'
+}
+
+# 函数：下载配置
+download_roa() {
+    local asn="$1"
+    local filename="/etc/bird/whitelist/$2"
+    
+    if [ -z "$asn" ]; then
+        echo -e "${YELLOW}⏭️  $filename 未配置ASN，跳过下载${NC}"
+        return
+    fi
+
+    echo -e "${YELLOW}📥 正在下载 $filename (ASN: $asn)${NC}"
+    if wget -q -O "$filename" "${BASE_URL}${asn}"; then
+        echo -e "${GREEN}✅ $filename 下载成功${NC}"
+    else
+        echo -e "${RED}❌ $filename 下载失败${NC}"
+    fi
+}
+
+# 函数：创建软链接
+create_symlink() {
+    local script_path=$(realpath "$0")
+    local link_path="/usr/local/bin/downmyip"
+
+    if [ -L "$link_path" ] || [ -f "$link_path" ]; then
+        echo -e "${YELLOW}🔗 软链接已存在${NC}"
+        return
+    fi
+
+    echo -e "${YELLOW}🔗 创建全局命令：downmyip${NC}"
+    if ln -s "$script_path" "$link_path"; then
+        echo -e "${GREEN}✅ 软链接创建完成！${NC}"
+    else
+        echo -e "${RED}❌ 请用sudo运行脚本以创建软链接${NC}"
+    fi
+}
+
+# ===================== 主逻辑 =====================
+clear
+echo -e "${YELLOW}===== downmyip - 自动下载ROA配置 =====${NC}"
+
+# 1. 检查vars.conf是否存在
+if [ ! -f "$VARS_CONF" ]; then
+    echo -e "${RED}❌ 配置文件不存在：$VARS_CONF${NC}"
+    exit 1
+fi
+
+# 2. 读取三个ASN
+INET_ASN=$(get_asn "LOCAL")
+DN42_ASN=$(get_asn "DN42")
+UNET_ASN=$(get_asn "UNET")
+
+echo -e "${GREEN}📄 从vars.conf读取ASN：${NC}"
+[ -n "$INET_ASN" ] && echo "公网ASN：$INET_ASN" || echo "公网ASN：未配置"
+[ -n "$DN42_ASN" ] && echo "DN42 ASN：$DN42_ASN" || echo "DN42 ASN：未配置"
+[ -n "$UNET_ASN" ] && echo "内网ASN：$UNET_ASN" || echo "内网ASN：未配置"
+echo
+
+# 3. 依次下载（不存在则跳过）
+download_roa "$INET_ASN" "inet.conf"
+download_roa "$DN42_ASN" "dn42.conf"
+download_roa "$UNET_ASN" "unet.conf"
+echo
+
+# 4. 重载BIRD配置
+echo -e "${YELLOW}🔄 执行：birdc c${NC}"
+if command -v birdc &>/dev/null; then
+    birdc c
+    echo -e "${GREEN}✅ BIRD重载完成${NC}"
+else
+    echo -e "${RED}❌ 未找到birdc命令${NC}"
+fi
+
+# 5. 创建全局软链接
+create_symlink
+
+echo -e "\n${GREEN}===== 全部执行完毕 =====${NC}"

ip-policy-rules

@@ -0,0 +1,73 @@
+#!/sbin/openrc-run
+description="Custom IP Policy Route for Alpine"
+
+depend() {
+    need net networking  
+    after net-online
+    trigger on restart networking  
+}
+
+trigger() {
+    case "$1" in
+        restart)
+            ebegin "Triggered by network restart, reloading IP policy rules"
+            restart
+            eend $?
+            ;;
+        *)
+            ebegin "Unsupported trigger: $1"
+            eend 1
+            ;;
+    esac
+}
+
+#空格来分隔不同的前缀
+ALL_TUNNEL_SUBNETS="44.32.191.0/24"
+BASE_PRIORITY=200
+TUNNEL_SUBNET_V6="2000::/3"
+
+add_rules() {
+    local current_prio=${BASE_PRIORITY}
+    for subnet in ${ALL_TUNNEL_SUBNETS}; do
+        ip rule add from ${subnet} lookup 102 priority ${current_prio} 2>/dev/null
+        ip rule add to ${subnet} lookup 102 priority $((current_prio + 1)) 2>/dev/null
+        current_prio=$((current_prio + 2))
+    done
+    ip -6 rule add from ${TUNNEL_SUBNET_V6} to ${TUNNEL_SUBNET_V6} lookup 102 priority ${BASE_PRIORITY} 2>/dev/null
+}
+
+del_rules() {
+    local current_prio=${BASE_PRIORITY}
+    for subnet in ${ALL_TUNNEL_SUBNETS}; do
+        ip rule del from ${subnet} lookup 102 priority ${current_prio} 2>/dev/null
+        ip rule del to ${subnet} lookup 102 priority $((current_prio + 1)) 2>/dev/null
+        current_prio=$((current_prio + 2))
+    done
+    ip -6 rule del from ${TUNNEL_SUBNET_V6} to ${TUNNEL_SUBNET_V6} lookup 102 priority ${BASE_PRIORITY} 2>/dev/null
+}
+
+start() {
+    ebegin "Loading static IP policy rules (tunnel + downstream)"
+    add_rules
+    eend $? "Failed to load IP policy rules"
+}
+
+stop() {
+    ebegin "Removing static IP policy rules (tunnel + downstream)"
+    del_rules
+    eend $? "Failed to remove IP policy rules"
+}
+
+restart() {
+    stop
+    sleep 1
+    start
+}
+
+reload() {
+    ebegin "Refreshing static IP policy rules"
+    del_rules
+    sleep 0.5
+    add_rules
+    eend $? "Failed to refresh IP policy rules"
+}

readme.md

@@ -0,0 +1,24 @@
+# 这里是BRNET配置文件
+
+## 目录格式
+
+    -- bird
+    -- bird/conf/       # 存放需要使用BGP协议宣告的静态规则库   （用户配置）
+    -- bird/first/      # 定义内部IP范围                       （用户配置）
+    -- bird/function/   # 定义表、网络IP范围等
+    -- bird/net/        # 定义网络同步规则
+    -- bird/peers/      # 存放对等体的配置信息                 （用户配置）
+    -- bird/template/   # 定义BGP模板
+    -- bird/bird.conf   # bird核心配置
+    -- bird/envvars     # 环境变量
+    -- bird/var.conf    # 配置节点基本信息                     （用户配置）
+
+## BGP社区
+最近我们要对BGP社区进行大改，请注意相关细节的变更。
+我们定义了以下BGP社区，请按照规则使用<br>
+1.不允许导出到内核：(ASN,3,0)  （对公网和UNET均生效）<br>
+2.不允许传输到IBGP：(ASN,1,0)  （对公网和UNET均生效）<br>
+3.允许传输到EBGP：(ASN,200,0)  （对公网和UNET均生效）<br>
+3.允许传输到EBGP（流经IX）：(ASN,200,1)  （公网生效）<br>
+4.允许导出到OSPF：(UNET_ASN,301,0)  （仅对UNET生效，依赖UNET）<br>
+请注意，进入我网和经过我网的路由条目，都会《社区消消乐》，即：我会把相关BGP社区全删了。

route-sync

@@ -0,0 +1,72 @@
+#!/bin/bash
+set -euo pipefail
+MAIN_TABLE="main"
+RT_TABLES_FILE="/etc/iproute2/rt_tables"
+
+check_root() {
+    if [ $EUID -ne 0 ]; then
+        echo "错误：操作路由表需要root权限，请使用sudo运行脚本！"
+        exit 1
+    fi
+}
+get_custom_tables() {
+    grep -vE '^#|^$' "${RT_TABLES_FILE}" | awk '{print $1}' | \
+    grep -E '^[0-9]+$' | grep -v "^${MAIN_TABLE}$" | sort -n | uniq | tr '\n' ' ' | sed 's/ $//'
+}
+
+sync_ipv4_routes() {
+    local custom_tables="$1"
+    local ipv4_routes
+    ipv4_routes=$(ip -4 route show table "${MAIN_TABLE}" proto kernel scope link)
+    local ipv4_count=$(echo "${ipv4_routes}" | grep -c .)
+
+    if [ ${ipv4_count} -gt 0 ]; then
+        echo "${ipv4_routes}" | while read -r route; do
+            [ -z "${route}" ] && continue
+            for table in ${custom_tables}; do
+                ip -4 route replace ${route} table ${table} >/dev/null 2>&1
+            done
+            #echo "${route} -->  ${custom_tables}"
+        done
+        echo "IPv4同步完成,共${ipv4_count}条"
+    else
+        echo "IPv4无直连路由"
+    fi
+}
+
+sync_ipv6_routes() {
+
+    local custom_tables="$1"
+    local ipv6_routes
+    ipv6_routes=$(ip -6 route show table "${MAIN_TABLE}" proto kernel metric 256)
+    local ipv6_count=$(echo "${ipv6_routes}" | grep -c .)
+
+    if [ ${ipv6_count} -gt 0 ]; then
+        echo "${ipv6_routes}" | while read -r route; do
+            [ -z "${route}" ] && continue
+            for table in ${custom_tables}; do
+                ip -6 route replace ${route} table ${table} >/dev/null 2>&1
+            done
+            #echo "${route} -->  ${custom_tables}"
+        done
+        echo "IPv6同步完成,共${ipv6_count}条"
+    else
+        echo "IPv6无直连路由可同步"
+    fi
+}
+
+main() {
+    check_root
+    local CUSTOM_TABLES=$(get_custom_tables)
+    if [ -z "${CUSTOM_TABLES}" ]; then
+        echo "提示：${RT_TABLES_FILE}中无自定义路由表（已排除254主表），退出执行"
+        exit 0
+    fi
+    echo "获取到路由表：${CUSTOM_TABLES}"
+    sync_ipv4_routes "${CUSTOM_TABLES}"
+    sync_ipv6_routes "${CUSTOM_TABLES}"
+
+    echo "所有路由同步完成！"
+}
+
+main

update.sh

@@ -0,0 +1,30 @@
+#!/bin/bash
+
+cd 
+git clone https://git.nia.ink/brnet/bird_config.git
+
+rm /etc/bird/bird.conf
+mv ./bird_config/bird/bird.conf /etc/bird/
+
+rm /etc/bird/conf/dn42.conf
+
+rm /etc/bird/filter/*.conf
+mv ./bird_config/bird/filter/*.conf /etc/bird/filter/
+
+rm /etc/bird/function/*.conf
+mv ./bird_config/bird/function/*.conf /etc/bird/function/
+
+rm /etc/bird/net/dn42.conf
+rm /etc/bird/net/unet.conf
+mv ./bird_config/bird/net/unet.conf /etc/bird/net/
+
+rm /etc/bird/template/*.conf
+mv ./bird_config/bird/template/*.conf /etc/bird/template/
+
+
+birdc c
+cd 
+rm -rf bird_config
+
+cd 
+rm update.sh