RPKI Validation

Implementing RPKI (Resource Public Key Infrastructure) to protect against BGP hijacking in my autonomous system network. The implementation covers both signing and validation components.

Signing

The signing process is straightforward for my prefix. I utilize my LIR's control panel to create ROAs (Route Origin Authorizations), with verification available at rpki.as215855.net confirming valid signing status.

Validation

The validation side requires router-level implementation. I deploy Routinator as an RPKI relay on a dedicated European VM, connected via Tailscale to edge routers.

Configuration involves:

1. Setting up an RPKI protocol connection pointing to the Routinator instance
2. Creating a validation function that checks incoming prefixes against the ROA feed
3. Applying this function to import filters in BIRD 2 templates

The setup filters invalid RPKI routes automatically. Testing with Cloudflare's invalid.rpki.cloudflare.com domain confirms proper filtering—the test prefix appropriately returns "Network not found" when queried.

I note occasional synchronization issues requiring manual reloads to ensure Routinator updates propagate correctly through BIRD.