Your First eBGP Session on a VPS with a Free /48 from IPYE

Disclosure up front: I run IPYE, a company that leases IP space. Most of this article is practical how-to; IPYE appears where a free /48, LOA, or ROA helps you try the work, with a short call to action at the end.

The first eBGP session on a rented VPS usually stalls on authorisation, not on syntax. A free IPv6 /48 from IPYE gives you instant setup, a real allocation for your own ASN, a LOA from the portal, and a ROA created automatically. This walkthrough brings FRR up toward a BGP-capable host using documentation ASN 64496, neighbour 2001:db8:0:1::1 (AS64497), and prefix 2001:db8:100::/48 until you substitute your free /48.

Preconditions that save a wasted weekend

Ask whether the VPS product supports BGP with customer ASNs or only a static BYO route. Confirm TCP 179 is allowed, which address they peer to, and whether MD5 or GTSM is required. Keep SSH on the provider-assigned address so withdrawing your free /48 cannot lock you out. Use a public ASN for Internet announcements; keep documentation ASN 64496 inside private labs.

Address the box before BGP

Install a GUA from your prefix on loopback for services, for example 2001:db8:100::1/128. The BGP TCP session may use the provider link address 2001:db8:0:1::2. Do not re-advertise the provider PA /64. Assign explicit /128s or a dedicated service /64 rather than making the kernel absorb the entire /48 without a design. Persist addresses with netplan or networkd so a reboot does not leave BGP advertising space the host cannot answer.

FRR eBGP template

Enable bgpd and use a default-deny export policy:

router bgp 64496 bgp router-id 192.0.2.1 no bgp ebgp-requires-policy neighbor 2001:db8:0:1::1 remote-as 64497 neighbor 2001:db8:0:1::1 description vps-uplink ! address-family ipv6 unicast neighbor 2001:db8:0:1::1 activate network 2001:db8:100::/48 neighbor 2001:db8:0:1::1 prefix-list OUT-V6 out neighbor 2001:db8:0:1::1 maximum-prefix 100 90 exit-address-family ! ipv6 prefix-list OUT-V6 seq 10 permit 2001:db8:100::/48 

If the host requires MD5 or GTSM, configure those before the first OPEN. Prefer conservative timers until the path proves stable. Soft-reconfiguration inbound helps when you iterate policy on small routers.

LOA and ROA mid-flight

When the host asks for paperwork, download the LOA from the IPYE portal and attach it to the ticket with ASN and peer IPs. After announce, confirm the automatically created ROA matches origin 64496 in a relying-party view before steering user traffic to the GUA. Dashboard ASN changes apply automatically—still reload BGP and re-check VRPs afterward.

Verification beyond Established

vtysh -c 'show bgp ipv6 unicast summary' vtysh -c 'show bgp ipv6 unicast 2001:db8:100::/48' 

From an external host, ping6 and curl -6 your GUA. Inspect RIPEstat or RouteViews for origin 64496. Session up but invisible globally usually means IRR lag, ROA propagation delay, or an unfinished provider export policy.

Failure catalogue and rollback

Firewalled 179, ROA mismatch, more-specifics beyond maxLength, missing LOA, and announcing before ROA visibility cause most first-session pain. Rollback with neighbor shutdown or removing the network statement. Record ticket ID and LOA filename in the change note. Practice NOTIFICATION failures in a namespace lab once so production logs are familiar.

Persistence, captures, and launch gates

Persist loopback GUAs with netplan or networkd before enabling bgpd, and order systemd so addresses exist first. Keep a git CI check that fails if any outbound prefix-list permits ::/0. During the first Established transition, save a tcpdump -n port 179 pcap as a baseline for future Active-state incidents.

Gate production DNS on three greens: session Established, ROA valid for origin 64496, and an external ping6 to the GUA from a third-party host. If collectors still miss the route, open an upstream ticket with IRR and ROA evidence rather than flapping the neighbour. Freeze non-essential changes for a day after first sighting so stability itself is tested.

Record ticket ID, LOA filename from the portal, and peer IPs in one vault note named for the ASN. Practice a deliberate auth mismatch in a namespace lab once so NOTIFICATION logs are familiar before they appear in production.

FRR package pinning and rescue

Pin the FRR minor version with your package manager holds so unattended upgrades do not restart bgpd during dinner. When you must upgrade, drain traffic if you are dual-homed, upgrade, then restore. Keep a rescue user with keys on the PA address only.

Write a one-page "session birth certificate" after first success: peer IP, ASN, timers, auth type, prefix-list names, LOA ticket, ROA check URL, collector screenshot. Future you will open that page before touching timers. If the host ever renumbers the BGP peer IP, treat it as a new session with a new certificate rather than editing in place under fire.

Add a Prometheus exporter or simple cron that alerts when session state leaves Established for more than sixty seconds. Pair it with an external AAAA check so you distinguish local daemon death from upstream filter loss. Review alert noise monthly and retune thresholds rather than ignoring pages.

Birth certificate for the session

After the first clean announce, write a one-page birth certificate: peer IP, ASN, timers, auth, OUT-V6 name, LOA ticket, ROA check, collector screenshot time. Store it with the vault entry for ASN 64496. Future timer tweaks start from that page, not from folklore.

Pin FRR so unattended upgrades do not restart bgpd mid-evening. Order systemd so loopback GUAs exist before the daemon advertises them. Alert when Established drops for more than a minute and pair that with an external AAAA probe. Review alert noise monthly. Practice an auth mismatch once in namespaces so NOTIFICATION text is familiar.

Do this next

Bring up the session after you claim a free /48 from IPYE, then confirm collectors see origin 64496. Questions: ipye@turnel.com.

About IPYE

IPYE (https://ipye.com) leases IPv4, IPv6 and ASN space with instant setup. Your first IPv6 /48 is free for the first year, a real allocation you can announce on your own ASN, with a LOA from the portal and the ROA created automatically. ASN and region changes apply automatically. IPv4 /24 to /22 leases include LOA, ROA and per-/24 rDNS; WHOIS is editable on IPv6 /44 and larger. Locations: Los Angeles, New York, Ashburn, Salt Lake City, London, Amsterdam, Frankfurt. Claim your free /48: https://my.ipye.com/products/ipv6-rental. Questions: ipye@turnel.com.

Disclosure: I run IPYE