Dear viewer, these subtitles were generated by a machine via the service YouTube and therefore are (very) buggy. If you are capable, please help us to create good quality subtitles: https://c3subtitles.de/talk/2587 Thanks!
[Music]
hello and welcome everybody to the NX
stage haum who's a university student
who's studying cyber technology is going
to talk about how to found an internet
exchange he founded laig from his hacker
space litat in Copenhagen welcome with
me
half thank you um I would like to tell
you about how we created a internet
Exchange in my local hacker space um um
so first why I'm making this talk um
well as a newcomer to the networking
worlds uh Network routing and similar I
found it really difficult to find good
information on uh IP operations I had I
could read some things from some Network
operator Network operator meetups and
some of the commercial internet
exchanges but that was not it was very
high level so everything was a bit
difficult to understand uh on what is it
exactly and also uh when you when you
need to get an as number and and other
IP resources delegated there is some
Administration and it differs from
region to region um our region in Europe
and
um is ripe um and there is some policies
in this that they have
so what is the labite instant exchange
well it is a community run instant
exchange um in in labat uh in our nice
little hacker space uh in Copenhagen um
we uh I we use it uh as a place to learn
Network routing it is very difficult
topic to get started in um you
can um
you you can uh that there are some
projects that that can help you like DN
42 um but if you want to to do routing
where you you talk with the real world
and not uh in Via vpns well then you
need to pay a lot of money to uh get
into a data center or find uh some
project where it is available for you uh
also closely nearby that you can
actually um well start doing Network
routing and bring a small server perhaps
so yes uh you can learn some pgp this is
where I learned my pgp at least uh in a
hacker space um you can play with our
route server um it has its own nice a
number um you can get started in uh
getting IP alloc IP resources like Ace
numbers and uh um IP addresses you can
play with BP security this again one of
the things where it's really difficult
to actually get a grasp on unless you
start playing with it that are some
really ni nice talks around the world
about rpki and um and filtering
strategies but if you also want to
actually try it um it is kind of
difficult um to get outside your own
home lab and it's also uh very soon we
will change it to 9k MTU the default in
the world is uh 1500 uh mtvu and uh that
is uh there's a a expired of craft for
how to change it um so um as soon as I
get all the way through that um and I
notify our members that will change uh
we will also get that it has some it has
a few uh um advantages compared to
1500 so well um what do you what does
your hacker space need to have an
internet exchange um you need a friendly
Uplink um maybe you have multiple that
would be very cool um that's is because
if they are they do not in like you it's
very hard to um update your policies um
uh well their own policies sorry that
allows your ex clients to to be
announced to the walls um so having a
member that works in a u in your Uplink
really helps uh but maybe be good
friends and give them a beer um some
some people you know um you also need of
course some server housing um you need a
rack we have we have used rack uh that
they are available multiple places uh we
also have a used Layer Two switch that's
the the one marked with my batt drawing
um and uh yeah you need at least three
ping clients um this is the magic number
uh of getting anything done uh when you
talk about an ax or about an ax um R
requires it P be re requires it and IP
the IP database requires you uh to even
be registered or uh considered having an
entry in each of their
databases um of course this is also a
heer space so you need to have some you
need to have more than one person
because when not person stops coming to
the hacker space uh it will die um and
that's a usual thing with uh Community
run projects so of course you need to
have some documentation and and have
some people who like to run
this um so what is an internet exchange
the very simple version is that is a
VLAN on a layer 2 switch and then we
have a few of um connector networks um
where and that is opat us with their own
as number and
prefixes um so this was the uh difficult
part uh if you don't if you don't know
uh much about networking uh this was
this
was a bit of a large step to have but if
you know what I talked about this is
what you needed um all the these five
slides um but let me explain the inet a
bit because um it took me years to
understand the internet and I still
learning a lot uh so um to to newcomers
um let's explain some things um well how
do you do internet routing um I assume
you know some n working like IP
addresses at least um but you get uh
your IP uh prefix allocated you find the
host of exility you install your machine
and then you set up your external btp r
demon that can come in proprietary and
open source Solutions you can find you
will need to find some peers um to
connect with and peer with them and
we'll find a Transit
that uh allows you to connect to the
rest of the internet because you uh if
you're located in Copenhagen how I do
how how do you have a connection to um
Berlin for example um you well you need
a direct fiber to some place so some
companies like U do this as their
business and yes profit I
guess so let's set a scenario well you
are a eyeball ISP in Copenhagen well an
eyeball ISP is uh you have customers
with eyeballs that consume content that
could be watching their favorite movies
for example
um and well you need to get content from
the content providers the people having
the
movies and you need some IP address IP
addresses for customers uh and and
servers um to be able to reach uh be
reach uh from the
internet and you also need uh of course
some server housing and some fibers
around uh but I won't go into that
um well um this is a I think the nicest
uh image I found yet on um this is an
example of networking uh of some peers
uh and um uh Transit
providers uh don't bother with the with
the names of them um
but uh you can have for example a number
one in the total left side uh and they
have they have some prefixes and you can
be they can be announced uh up to the
Uplink via a the next one in the line um
which then in turns announce it further
this is called a Transit because you
don't have a direct connection to
everybody else
um but it also goes the same way with uh
now the uh the network provider can then
connect to um well the network provider
can then connect to a to everybody else
or get traffic from everybody
else
so a autonomous system I um that's was
thing called as1 as2 as3 here well an an
a system um is a um well the best
description I found yet was in uh in in
a internet standard where um it says a
connector group of one or more IP
prefixes one by one or more Network
operators which has a single and clearly
defined routing policy uh I'll get a bit
more into the details of that but uh one
or more n operators and you have some
prefixes and yeah
um so a an autonomous system uh is uh
identified by a unique um uh 16 or 32 a
um a autonomous system number also
called
ASN and
yes we use it to say uh I'm hello I'm as
2111 53 that's my personal as um but if
you look that up you can find out what
my routing policies are and also um uh
who should what addresses do I
have
so well a routing policy uh this is the
simplified version is
that um we we have some objects called
interet routing registry objects uh we
have found we have them in uh in our in
our local uh Regional internet registry
database like ripe in our case um at
least in
kopenhagen and well this could be this
could for example say that these IP
freixes should be dis to me and I would
accept prefixes dis to and from my
business customers a something something
and a something something
else
um the yeah this is uh pretty much it
that well there's a there's other
details you can go into um but very
simplified that you have you say I would
like to I accept that um the people or
the organizations behind me can be
announced through me um also I have
included uh when I found a lot of good
read I've included in the U in the
bottom um then you can find my slides on
the program PL program page um so we
also have peering and Transit as I
mentioned so peering is that uh well we
um we agreed that we only send traffic
distance distance to each other so I
have you have prefixes here you have pre
I have prefixes here um and you have
some content and I want some content
so you can uh well we have a direct
connection to each other and we appear
this is uh most usually uh free but
there is a small asteris that of course
it costs some things to pull a fiber in
the data center uh many data centers uh
take a monthly fee for having a cross
connect cross connect as we call it and
of course you also need to buy your own
Optics and things like that um so we
also Transit well this is the people who
like to transport traffic from you to
other networks and also the other way um
but it cost uh something per megabyte uh
oh sorry megabit I wrote um and of
course we would like to avoid this uh as
much as we can um but again we can't be
connected to every Network in the world
so this creates a little of a dilemma on
uh where should we actually connect
well um who should rep with uh does it
really make sense to connect with this
small provider while they really want to
do we actually want to pay for for our
part of it um well we have the internet
exchange um
where uh I will get back to that
question in a small second um so the in
exchange is that we would like to keep
local traffic local um this is the main
reason
um because when you have uh Transit
providers you
sometimes um get the issue of having uh
the trone effects um I included a image
here where it says this is a map of uh
United States some of it
and we have three cities here we have
Los Angeles San Francisco and New York
well the traffic goes from Los Angeles
to San Francisco I I hope you can see
the arrows also but
it does not go directly it goes all the
way to some good amount of kilometers to
San Francisco this creates latency um
this is just unnecessary and it may be
just because your Transit provider
doesn't have a direct connection between
these two cities or maybe they made a
routing mistake that
happens um so we get lower lower latency
if we are directly connected to each
other well an internet exchange also
makes it more easy to connect to other
networks
um so yeah as always said the uh
requiring cost of data
centers um well the simplified topology
of an Internet exchange looks kind of
like this so we have this uh mystery uh
meet me room as we call it and we have
some providers and there also is there's
a cloud service out down here that will
be probably a content provider
um so they we all have one Connection in
to our meet me room um instead of having
connections to each other all the way um
yeah this is mostly how it looks um but
um there's some other uh other things
about internet changes
so um I would like to explain a bit on
uh on the C some of the Char
characteristics so first we can have our
bilateral peering uh it's called also
many to many where I connect to each and
everybody uh I would like to um peer
with um but instead I use I go to
multilateral or uh well I have one
Connection in um to a route server and
that makes sure I can connect to um the
other ones as everybody else does this
so we have like this Central Point um
you can of course have a um loow
balancing and similar things so it's not
it's not a single point of failure um
but the very Sim simple version of this
is that we have one machine in here
um well uh is Route server is for
aggregating our control plane traffic um
um so we don't send our traffic over the
uh route server itself but we make sure
like the routes can be uh can be
distributed by the the uh rout
server um so the advantages of this is
that um well now we have lower maincy uh
maintenance we don't need to necessarily
have a lot of uh entries uh with each
and every ping
client we can connect immediately to
newcomers so if we have what this yeah
again this small uh small Network that
would like to connect with me and I
don't necessarily want to pay the cost
um well um we can directly connect to
each other uh connect immediately with
each other uh as soon
as the uh as soon as they jump on the
rout server given that I'm I'm also
present um and then traffic D flows so
we don't have to go through the
transit well we can also have some
debugging tools uh um and and actually
see more of what is going on
so yeah the image shows
um how how you could do it oh overview
of how it
happens well our R server looks like
this um yes is a very small machine it's
also a very small hacker space um so
it's like a fin client uh it use six
watt of power and we chose this because
we had it in our hands already um it is
not that powerful it can well I can run
deban so yeah it's fine I guess um we
use um the config passer called a route
server to well configure our route
server um and this is where we keep uh
the list of our clients and um then we
generates the uh config uh that bur our
internet routing demon um uh
uses um and bird is the is the program
actually um getting the the routes in
and distributing routes to our peers as
well uh um as well as uh as clients can
also use bird like it's just a it's a
general purpose rting demon it's totally
fine but you can use it as R server but
you can also use it as a uh client um
and I use it as client as well
um
so um server hosting well it looks oh
um for our case we have our project
called lebolo it's our collocation
facility um it is intended for small
small embedded devices such as R pies
and
ap2s um this yeah was this is due to
power restrictions and we would like
to keep keep it low um keep the cost low
um as well as we don't this is Hobby
projects we don't necessarily need beefy
servers and they also re reibly
available and not that expensive to have
um again this the same picture I used um
but is this is a ra it looks awful but
um we have this Cisco sk300 U it's use
it because it was already there again
it's free uh and um you can also do Mac
Port f building that's uh one of the
requirements of and was of of our peing
requirements um this is AO to avoid
Loops in in the routing um yeah um you
can definitely make it more pretty than
we have um you can probably also clean
it up a bit more so um
yeah
well so our ping policy well every
internet exchange has a ping policy it's
a
just like you as a as a network provider
you also have some policy that you say I
only want the traffic that you actually
mean should go to me I don't want my
neighbor's traffic uh necessarily um or
I do want my neighbors traffic but you
have to pay
so
um well the we this is based on the on
the local inst exchange ping
policy um and well it looks very very
much like it and uh well we allow the
infinite infinite frames uh IP 4 ip6 and
up um that's The Usual Suspects then we
do not like uh proxy up and obf and
other kinds um of these uh we only want
uh to know BP stuff we don't do not want
uh well we want routing and we want uh
data uh traffic we don't want a lot of
for let's for example say DCP uh but we
also don't we only
allow one uh one kind
of
um uh one one kind of uh routing
protocol bgp U you could use all U other
ones but the internet in General Uses
bgp so it makes things much more easy um
again the max MAC address filtering and
well you also
uh um we also do not like
that um that if you connect via VPN we
need like the full MCU
um so yeah is we don't we don't you have
to be physically present um this is a
this is not a a virtual internet
exchange these also exist to play around
with network routing is it they they're
fine I have no nothing against them but
um for our case we wanted to have
machines physically located um virtual
internet exchanges have the issue of now
now you are depending on transits to
somewhere and that Transit can take a
long time um still a nice place to learn
if you are
interested
so uh an internet exchange client can
also have their own policies well here
is very uh High overview of how they
listed of how they some categories well
open is that we just like peing with
everybody um this is when you have on to
the route server we have
selective where uh you well talk with us
first uh and we are usually open to this
um we we may have our own internal
protocols that denies us this um and
this is where you do direct pre contion
and set up a a um um set up a separate
entry for each and
everyone so you can also have restricted
that uh they could this could for
example be a transit or a very large
Network where they have some
security um policies maybe or similar
that restricts them
um and that means means that you have to
contact them and maybe you need to be
large in a large enough in
to uh be considered um I have seen this
issues the issue personally
um with some large providers not
necessarily wanting to appear even
though a a network provider didn't uh
did want to appear um it didn't make
sense to buy
Transit so well how do we get internet
resources allocated
um uh well I uh I have this um image of
a of a cake I call it
um um
well owns all the internet addesses in
the walls you don't necessarily own the
ones you just get them allocated well
then we also have our regional internet
registry there are five of these in the
walls um spread out through um through
our our wall um and this is ripe in our
case again then we have the local
internet registry this is a
um from one what I could understand a
ripe specific thing um so as an end user
this is you you don't talk directly with
ripe um but your local internet registry
talks uh would R for you um if you're
however uh want to be part but want to
be member of the ri NCC it is a member
organization you can pay the the fee um
but for a h project it doesn't make
sense um it is for Network operators uh
or people who would like toay pay some
money every year it's not cheap but it's
also not that
expensive
um and um well um so as a network
operator that could be a arall ISP again
or a content provider well you want your
addresses to be globally routable and
this is where I say uh I have this
content and you have your customers who
want this content well somehow the
traffic should uh should go through the
internet and I should also be able to
send traffic to you uh and then you can
handle it from there so if thing is
requested to me I need an IP address as
a source IP address to send it back to
um and this is where the routing takes
over so um if you have an IP that is
well you actually don't necessarily need
to have globally routed
um IP
addresses you
um well that's not that the reason you
don't necessarily need it is that you
just need to you just need to have a
unique identifier for your um internet
exchange members for their for their own
routers U and you do not want it to be
mixed up with anybody else in the world
this is why you request some IP IP
addresses um it's not for hosting
servers so um I also yes yes I didn't
explain the cake so a has the um has the
all the addresses well uh RI gets a
little uh gets a little piece of the
cake and then your local internet
registry gets a little piece of that uh
that cake and then you get a tiny tiny
tiny tiny little piece of
the uh local internet regy cake uh cake
piece
um there's a lot of addresses in the
world so uh this is only
illustrative um
and you uh
yeah it's fine it's like you can use it
sl24 for a lot of things then you use
/48 uh uh prefix for a lot of things um
so we also have the ripe database um
well the object you need to create is
the is an organization object um if you
already have one for your hacker space
this is one thing I I I did wrong was
that we labat also already has an
organization since we do some bigp
routing and announce our members um so
if already has that you should just use
your existing existing or object but if
you don't have well you should should
you should create an object you also
have need maintainance this is uh um
this is a a list of a list of people
that are uh that that get access to
change your routing policy uh and then a
person is just a person um so you also
need a uh well at least it's optional
but
um a a normal uh a normal client a
normal a network operator uh needs as
assets and this is where actually your
routing policy lies
um so you don't actually need it for an
internet exchange but it's it's
recommended if someone filters for for
these kind of things um this is an aset
is what we look into do are you are you
allowed to announce XYZ
prefix um or a sorry XY Z as number not
prefix um that's called a route object
if you want to uh tie a prefix and a a
number together
so um I also things like this I couldn't
find any of this it was just a thing I
learned uh really was of course well you
need to give the in give the name of
your internet exchange um um and you
also do like they will ask you do you
want a rouer when you as soon as you say
you want an internet exchange hopefully
they will and then you say uh yes um but
then you also need to have some uh uh
then you there's also some
requirements
um well uh for R server yes you need an
as number uh your peers need to directly
connect to them uh connect to the route
server and this cannot be a private
reserved um one of the special purpose
uh a numbers um one thing is that you
should request a 16bit as number they
are available if you ask directly for
them and have a good reason for what we
are running out so usually by default
you will be assigned a 32bit a number it
does not matter in most cases if you
just take your Linux machine and put it
up however um if someone brings a really
old machine well you do want a 16bit a
number um
and this they were just not set up for
32 bits so it won't work um a bonus is
that a Danish number plate actually also
fits on a um 16 bit Ace number um so I
have really been considering buying
buying one that and put it up on our
rack
um yeah stupid stupid things um well and
yes then you will also be asked do like
need prefixes and then you say yes
please um so ripe do not give ip4
addresses out to globally to to to be
globally routed and anymore that's long
long long waiting list uh we are have
been exhausted the IP space for a long
time and uh which is why you say yes
this is not to be routed uh this is
specifically to be announced waiting our
preing lane this is our this is the
action message I was uh I was sent and
then said yes so you should just like
give these poters already and then like
pretty good to go uh also what size do
you want um of uh addresses
and there's also a bit more well you
have to confirm that your your hosting
facility actually has uh or your Colo
facility actually has connectivity like
I guess it makes sense I just didn't
think of that so I had to scramble and
and ask three people on like where is
this uh and a few days later I could get
hold of it so a lot of all of delays you
can actually uh you can actually uh
avoid to
yes get get hold of your contract at
first so you have it really ready
um again the magic number was uh three
customers um so if you have more than
that you're good but if you have less uh
well um then you need one one more
because then then you need more because
if you just have two people well you can
just PE with each other it doesn't make
sense to set up all these and do all the
administration um
and they don't need to be connected
directly at that time you set it up but
they need to agree and say yes I will
definitely Jo as soon as I can um so
well we also need to give the uh postal
address uh and an address apparently
that is able to receive mail and then a
contact person and their organization
and a phone number um yes I was just
casing writing emails so I didn't really
think of these but they are like pretty
good
pointers
um well how do you find a local in regy
and um well you ask your local network
visard um I have I have a few um not
that many but uh they know the magic of
the internet um and uh yeah this is also
where I got pointed through the free
Transit project in um when I got my own
as number so it's it's a nice project
uh you from open Factory that um some
there are some really nice people behind
it um there's also people uh behind it
that is on this Camp um and I hear that
was also be an internet exchange by some
of them uh run on the camp um soon hope
hopefully so yes I have a bias that uh I
have uh I personally know some of them
um but if you want to find a uh right
local internet registry service well you
hop into your search engine and you
search for that term um and some are
some people are happily taking your
money to um facilitate this it doesn't
really cost that much to get started um
for me it was € 25 um personally it's
fine uh if if it's another project well
then you need to
um well if is another is a commercial
actor then you probably need to have to
pay a bit more well similar projects uh
are uh well all the community run
Internet exchanges in the world that
that are commercial actors many but
actually a lot of the internet changes
are just some networking people meeting
over a beer and said yes we need this
and they they made this so there's
also some hosting uh facilities uh K clu
in Amsterdam that's Cas space Community
rack um then we also have a bp. what the
[ __ ] in was hacker space and Rec Lear
uh in Berlin is Al also exist well also
can uh provide some bgp things this is
are not internet exchanges but these are
places that do Network routing um and I
may also have some people that can point
in the right
directions I have probably missed uh a
lot of nice projects but
um but this is ones I I found um I would
like to to say thank you to my
collaborators uh so this was actually a
school project uh uh well I managed to
get ects points for it anyway um so
Olivia and Daniel uh have been we have
created this together and then we also
have Yi from Street Transit projects who
really helped with all the ripe things
uh which I it was a whole new land for
me um and then we also have eson my
local network uh wizard um for sharing a
lot of
lot of knowledge and a lot of PS um here
are some oh sorry uh here are some good
resources um I found well PDP um and bdp
tools I use them every day
um almost every day um and then I will
very I will encourage you to go to your
local network operator Meetup uh like in
Denmark it's called DK KN and in Germany
it's called D um lots of nice people you
can get lot some nice um um well you can
meet a lot of nice people and uh usually
if you say I will I buy you a beer then
they will explain the whole thing to you
on whatever subject you
want um we also have that's also the
ripe academy uh this really helped me in
understanding IP physic and bgp security
they have they they're actually pretty
nice um you can also get a certificate
if you want uh that cost some money
though
but you can take the cses for free so as
a bit more we have the network startup
Research Center that's also help me uh
we have NL knock uh with their ping a b
bgp filter guide and NL knock ring for
uh search do you how how does Network
actually how does the internet reach you
and then we have urix with the Bops uh
and their wish list on what to buy and
the $1 th000 internet exchange uh um
presentation um on how how how shitty
Hardware can you buy um it turns out we
can buy really shitty Hardware from my
experience so if you want to find us
well we actually actually have a a um
self organization um called bgp enabled
hacker spaces um at the at CH 4 here at
17
today
um well you can also meet me at bck uh
Village and also at hack uh in next year
or you can meet in meet us in labat we
were very glad you gladly talk to you
just come by um and we also have a
website and the we have a PDP entry of
course and if you want to write an email
frow at me
um if if someone is interested in
sponsoring this uh like I paid
everything out of my own money
uh it was doable but I'm a student so
money is limited um
and we much like stickers uh um that is
a huge shortage and um perhaps a second
Uplink
um on
Hardware uh so the next thing we want to
look at is
uh uh well I should definitely set look
at um getting up a looking
class so we can actually see how some so
participant can see how it works uh well
how how they're routing happens um it's
a small internet change so routing uh so
AB is not that large right now um and
it's not a problem right now but it can
become a problem uh there's a lot of our
broadcasts uh when you have internet
exchanges we need more doation and we
also need I like very very much likes to
set up a pki relay I've set up
personally but not at the
ax um we have al already fils in of our
own Uplink so it's not that much a
problem so thank you for listening um
this was my
talk and hopefully there is a few
questions exactly we have some time for
Q&A so if there are any questions please
put your hands up and then I'm going to
repeat them for the audience
online
yes
um just a
second thank you so much even better um
the piers you're peering with yeah are
they located in the same building or are
they having a fiber directly to you or a
wavelength on a fiber or how do you
connect to your Pier physically well let
me spool up it tin a bit
um so uh oh sorry the actually not there
if you uh look up in the imaginary north
of the image um that is all the machines
uh they all connected by they phys yes
they're physically present uh um so
everybody has a apu2 or resp P or small
machines that are physically present
yes so your peers are only in the same
building okay so you're not peering with
other networks uh uh no that that will
be very nice uh but it's also a small
project um
so
so next
question okay um do you know of any um
DIY internet access providers or hosting
providers in in uh in uh Denmark that
you could maybe peer with or connect
with
um Network providers um well most are
actually
happy to peer with you given that you
are present at a place they are present
um so that is the issue so if you go to
one of the larger uh data centers in
Denmark most definitely yes many have an
open peing policy and you can just go
right ah H requires a bit of money to
get into a data center though so so
that's why sponsoring is so important am
I right yes you need some
sponsoring any other questions we have
time for one more if there are any
if not you can probably find him in the
borck village and you can ask him some
more especially if it's like private
questions because you want to do the
same project thank you everyone for
listening big
Applause