Notes on networking, BGP, VyOS, monitoring and automation by Wieger Bontekoe.https://bontekoe.technology/https://bontekoe.technology/bgp-roles-and-otc-route-leak-prevention-on-vyos/https://bontekoe.technology/bgp-roles-and-otc-route-leak-prevention-on-vyos/RFC 9234 adds roles to BGP sessions and an Only-to-Customer attribute to routes. Together they stop the most common kind of route leak automatically. What it does, and how to enable it on VyOS.Fri, 23 Oct 2026 00:00:00 GMTbgpvyosnetworkinghttps://bontekoe.technology/zabbix-grafana-dashboards-that-actually-help/https://bontekoe.technology/zabbix-grafana-dashboards-that-actually-help/I took a hard look at my own Zabbix and Grafana dashboards and asked one question: does this help during an incident? Five concrete fixes, with before and after.Fri, 23 Oct 2026 00:00:00 GMTmonitoringzabbixgrafanahttps://bontekoe.technology/designing-a-bgp-large-community-scheme/https://bontekoe.technology/designing-a-bgp-large-community-scheme/Communities are the cheapest form of documentation your network has. A practical large community scheme for a small AS: tagging where routes come from, and letting peers and customers steer how you announce them.Sat, 18 Oct 2025 00:00:00 GMTbgpvyosnetworkinghttps://bontekoe.technology/netbox-config-templates-for-vyos/https://bontekoe.technology/netbox-config-templates-for-vyos/Peering Manager generates my BGP sessions; NetBox knows everything else about the router. With NetBox config templates you can render the base VyOS configuration straight from your source of truth.Sat, 14 Jun 2025 00:00:00 GMTvyosnetboxautomationhttps://bontekoe.technology/rpki-route-origin-validation-on-vyos/https://bontekoe.technology/rpki-route-origin-validation-on-vyos/Dropping RPKI-invalid routes on VyOS is a handful of commands. Here is how I set up Routinator as a validator, connect VyOS to it over RTR and filter invalids on every eBGP session.Sat, 15 Feb 2025 00:00:00 GMTvyosbgprpkinetworkinghttps://bontekoe.technology/using-peering-manager-for-automated-configuration-on-vyos/https://bontekoe.technology/using-peering-manager-for-automated-configuration-on-vyos/Peering Manager is an open-source BGP session management solution including Peeringdb synchronization for automating session management. Peering Manager is able to automatically generate the BGP configuration for various vendors, however VyOS was not yet documented. I created the template below as…Thu, 26 Sep 2024 13:33:25 GMTvyosbgpautomationhttps://bontekoe.technology/zabbix-and-globalping-free-global-monitoring/https://bontekoe.technology/zabbix-and-globalping-free-global-monitoring/Many companies use services to monitor their website or network from various locations around the world. While these services are nice, it also costs quite a bit of money depending on the interval and measurements. Since we were already using Zabbix for other purposes, I did some research to use it…Sat, 07 Sep 2024 08:59:57 GMTmonitoringzabbixhttps://bontekoe.technology/vyos-100gbit-bgp-part-2/https://bontekoe.technology/vyos-100gbit-bgp-part-2/In the previous blog I did a test between two Vyos hosts, indirectly connected to each other with two switches. It was amazing how easily Vyos could achieve these speeds with just a few minor tweaks. However, this only tests a small part of the entire stack. In this blog I add two new 100G hosts, I…Thu, 01 Aug 2024 14:48:47 GMTvyosbgpnetworkinghttps://bontekoe.technology/vyos-100gbit-part-1/https://bontekoe.technology/vyos-100gbit-part-1/I have been using VyOS as a routing platform for various networks and projects for a long time with great success. With speeds between 1-40Gbit, I have been able to rely on VyOS to date. However, this is the first time that these speeds are insufficient and we have to increase the capacity to…Thu, 30 May 2024 12:03:51 GMTnetworkingvyoshttps://bontekoe.technology/vyos-0gbit-throughput-optimizations/https://bontekoe.technology/vyos-0gbit-throughput-optimizations/Disable offloading, enable ntuple Configure MAX RPS flow counts for queues TCP Tweaks: Setting the MaxReadReq to 2048 Disable all offloading on the interfaces.Sun, 07 Apr 2024 15:22:50 GMTvyosnetworkinghttps://bontekoe.technology/adblocking-lua-generator-for-the-powerdns-recursor/https://bontekoe.technology/adblocking-lua-generator-for-the-powerdns-recursor/Download all wanted block lists and place them as TXT in the same directory as the following script. You can find lots of them on firebog.net. Move the output file to: /etc/powerdns/blocklist.lua Create a new script /etc/powerdns/adblock.lua Add this to the configuration (recursor.conf): Inspired…Mon, 08 Jan 2024 10:35:01 GMTdnslinuxhttps://bontekoe.technology/unifi-controller-8-synology-nas/https://bontekoe.technology/unifi-controller-8-synology-nas/Installing the Unifi Network Application via Docker is super easy and saves the purchase of a new cloud key or controller. Create a new docker network with the macvlan driver, in my case bond2 is the interface i want to link it to: Create a file on one of your volumes called docker-compose.yml and…Sun, 31 Dec 2023 03:59:36 GMTlinuxdockerhttps://bontekoe.technology/correcting-timezone-in-docker-container/https://bontekoe.technology/correcting-timezone-in-docker-container/Mon, 06 Nov 2023 16:44:02 GMTdockerlinuxhttps://bontekoe.technology/powerdns-cheat-sheet/https://bontekoe.technology/powerdns-cheat-sheet/Create a new zone Add a DNS record Add a first record Check for errors Sync zone to slave servers Edit zone manually (for changing TTLs and such)Fri, 07 Jul 2023 11:38:44 GMTdnslinuxcheat-sheethttps://bontekoe.technology/network-monitoring-traps-vs-polling/https://bontekoe.technology/network-monitoring-traps-vs-polling/As a network administrator, I have been (partly) responsible for the monitoring of network infrastructures or even entire companies for many customers. For some companies I have even completely redesigned it. Many companies currently use tools such as Nagios, Solarwinds or a similar package. These…Sat, 01 Jul 2023 05:59:00 GMTlinuxmonitoringhttps://bontekoe.technology/sign-git-commits-with-ssh-keys/https://bontekoe.technology/sign-git-commits-with-ssh-keys/OpenSSH 8.0 or newer is required and Git 2.34.0. If no key exists yet, it can be created; Today, the RSA is the most widely used public-key algorithm for SSH key. But compared to Ed25519, it's slower and even considered not safe if it's generated with the key smaller than 2048-bit length. If you are…Sun, 23 Apr 2023 06:45:36 GMTlinuxhttps://bontekoe.technology/tcpdump-cheat-sheet/https://bontekoe.technology/tcpdump-cheat-sheet/tcpdump is a data-network packet analyzer computer program that runs under a command line interface. It allows the user to display TCP/IP and other packets being transmitted or received over a network to which the computer is attached. Flags:Wed, 29 Mar 2023 04:58:57 GMTtcpdumplinuxcheat-sheethttps://bontekoe.technology/enable-ntp-server-in-windows-2019/https://bontekoe.technology/enable-ntp-server-in-windows-2019/The Windows Time service uses the Network Time Protocol (NTP) to help synchronize time across a network. It's as easy as 3 commands using powershell:Tue, 09 Mar 2021 07:11:00 GMTwindowshttps://bontekoe.technology/bgp-route-leak-causes-a-significant-shift-in-european-internet-traffic-to-chinese-backbone-network/https://bontekoe.technology/bgp-route-leak-causes-a-significant-shift-in-european-internet-traffic-to-chinese-backbone-network/Last Thursday, June 6, 2019 at 12:00 a.m. Dutch time, a two-hour outage began at various customers. Both business customers for fiber optic internet as well as private internet connections. At first, the extent of the disruption was not yet completely clear. After several reports from customers I…Wed, 01 Jul 2020 06:03:00 GMTbgpnetworkinghttps://bontekoe.technology/cgn-carrier-grade-nat/https://bontekoe.technology/cgn-carrier-grade-nat/Every network engineer with some experience knows RFC1918 address space from the top of their head. So no need to explain that almost every office, home user and some datacenter networks are using IP’s from this RFC. So far, so good. But, what if you have a large network with more then 10 physical…Fri, 01 May 2020 06:16:00 GMTnetworking