Configuring BGP Looking glass based on OpenBSD 6.1

We have long used the OpenBSD + OpenBGPD + bgplg bundle to provide a public bgp looking glass server. It was decided to upgrade OpenBSD to a fresh version.

During the setup process, several nuances were revealed that were not fully disclosed in the official documentation. The result is this instruction for setting up a BGP looking glass service based on a freshly installed OpenBSD 6.1

0. Install OpenBSD

1. Put the SSL key in /etc/ssl/private/server.key and the certificate chain in /etc/ssl/server.crt

2. Configure /etc/httpd.conf

ext_addr="0.0.0.0"
ext_addr6="::"
prefork 2
domain="lg.example.net"
server $domain {
        listen on $ext_addr port 80
        listen on $ext_addr6 port 80
        block return 301 "https://$domain$REQUEST_URI"
}
server $domain {
        listen on $ext_addr tls port 443
        listen on $ext_addr6 tls port 443
        tls {
                certificate "/etc/ssl/server.crt"
                key "/etc/ssl/private/server.key"
        }
        location "/cgi-bin/*" {
                fastcgi
                root ""
        }
        location "/" {
                block return 302 "/cgi-bin/bgplg"
        }
}

3. Configure /etc/bgpd.conf

AS XXX
fib-update no
listen on 0.0.0.0
route-collector yes
router-id A.B.C.D
socket "/var/www/run/bgpd.rsock" restricted
neighbor D.E.F.G {
 remote-as XXX
 descr "r1"
 announce none
}
neighbor D:E:F::G {
 remote-as XXX
 descr "r1v6"
 announce none
}

4. We set the rights, we configure chroot. With the last command, you enable ping and traceroute from your service, however, you set the SUID flag on executable files.

chmod 0555 /var/www/cgi-bin/bgplg
chmod 0555 /var/www/bin/bgpctl
mkdir /var/www/etc
cp /etc/resolv.conf /var/www/etc
chmod 4555 /var/www/bin/ping* /var/www/bin/traceroute*

5. If you turned on ping and traceroute in the previous step, then check / etc / fstab for the nosuid flag for / var. Remember to remount / var or reboot.

6. Configure pf.conf

ext_if = "vio0"
table  { 192.168.0.0/24 2001:67c:aaaa::/64 }
table  { 192.168.2.0/24 2001:67c:bbbb::/64 }
set block-policy drop
set skip on lo
#block return   # block stateless traffic
#pass           # establish keep-state
match in all scrub (no-df random-id max-mss 1440)
block all
pass out quick
pass in on egress proto tcp from  to (egress) port { 22 }
pass in on egress proto tcp from  to (egress) port { 179 }
pass in on egress proto tcp from any to (egress) port { 80 443 }
pass in on egress proto icmp from any to (egress)
pass in on egress proto icmp6 from any to (egress)

7. Run the demons

rcctl enable httpd
rcctl enable slowcgi
rcctl enable bgpd
rcctl start httpd
rcctl start slowcgi
rcctl start bgpd
pfctl -f /etc/pf.conf

8. Voila!