Connect
Self-service, no ticket queue.
Nobody on our side has to touch anything. The prerequisites are your own ASN, a router that speaks BGP over IPv6, and a public address to terminate the connection on.
Requirements
What you need
| An ASN | Public, assigned to you, with a PeeringDB record or reachable RIR contacts. Private ASNs are rejected. |
| IPv6 | The peering LAN is IPv6 only (2a0b:4e07:42::/64). You need at least one IPv6 prefix to announce. A WireGuard connection may be terminated on an IPv4 address; plain VXLAN and GRE need the same address family on both ends. |
| A router | VyOS, MikroTik RouterOS, Linux (systemd-networkd), FRR, BIRD, Cisco IOS-XE, Junos. Anything that does BGP and one of the three encapsulations will work; we render ready bundles for the platforms listed. |
| Path MTU | 1450 bytes on your WAN path for the 1300-byte LAN, or 1430 with an IPv4 endpoint — a 1500-byte internet path leaves 50 bytes spare. If your path is smaller you keep a full-size port and get a warning on your dashboard: every port on the LAN is the same size, because a smaller one would lose what other members send you with nothing to report it. |
| ICMP source | The peering LAN block (2a0b:4e07:42::/48) is deliberately not announced to the internet. Source your ICMPv6 errors from a routed loopback rather than from your LAN address, or strict filtering at the far end will break path MTU discovery. Our bundles set this where the platform allows it. |
| Filtering | Your prefixes need route6 objects reachable from your AS-SET, a covering ROA, or both. A prefix with neither is dropped by the route servers. |
| A MAC address | The one you will put on the peering LAN. It is the only source MAC we accept from you. A second one is granted on request. |
Process
From sign-in to session
01
Sign in with PeeringDB
We read the networks your PeeringDB account is allowed to manage. Only those ASNs can be registered. If your network is not in PeeringDB, write to us and we verify you through the contacts in your RIR objects instead.
02
Pick a site and an encapsulation
FSN or HEL, and one of the three we support. WireGuard is preselected.
03
Give us your side
Your public endpoint, the MAC you will put on the LAN, a NOC address, and your WireGuard public key. Generate the key pair in the browser if you like: the private half never leaves your machine.
04
Accept the policy
The version, the time, your address and your PeeringDB identity are recorded. Your connection is allocated on submit.
05
Paste the bundle
Your LAN address, connection parameters and both route-server sessions, rendered for your platform. Bring it up and watch the checks go green: handshake, MTU probe, neighbour discovery, then RS1 and RS2.
If the portal cannot help you
Networks without a PeeringDB record, a second connection for an ASN already connected, or a second MAC on an existing one: write to [email protected] with your ASN and the site you want. We use the same tooling by hand.
Encapsulation
Three ways in
| Type | Notes | Encrypted |
|---|---|---|
| WireGuard | Recommended. Encrypted, NAT-friendly, VXLAN inside. | yes |
| VXLAN | Plain, unencrypted. Static public address required. | no |
| GRE | Ethernet over GRE for gear without the other two. | no |
The unencrypted options exist for routers that cannot do WireGuard at line rate. They carry your frames across the public internet in the clear, and both are accepted only from the exact endpoint address you register.
MTU
Where the 1300 bytes come from
The LAN carries 1300 bytes for everyone. A peering LAN is one L2 domain with no router between members, so when a frame is too big for the far port nothing sends back ICMPv6 Packet Too Big — the sender never learns. A LAN where ports differ therefore fails silently, and uniformity is worth more than size. 1300 is what the most expensive access method can carry over a 1500-byte internet path, with 50 bytes to spare. During onboarding we send a do-not-fragment probe along your path. A member whose path fails it is marked mtu-limited and keeps a full-size port: we never give anyone a port smaller than the bridge around it.
inner frame (1300 + 14 eth) 1314
+ VXLAN 8 + UDP 8 + IPv6 40 1370
+ WireGuard 32 1402
+ UDP 8 + outer IPv6 40 1450 needed on your WAN path
1430 with an IPv4 endpoint
1500 what the internet gives you