DN42 peering config generator

What this tool checks

A DN42 peering is two things: a tunnel between your router and your peer's, usually WireGuard, and a BGP session over it. This tool takes the details you have agreed with your peer and writes both, for the two most common setups: Linux with wg-quick and BIRD 2, and MikroTik RouterOS 7.

You enter:

• your AS number and your peer's (with or without AS)
• your peer's link-local IPv6 address (required) and, optionally, your own; if you leave yours empty it becomes fe80:: plus the last four digits of your AS number
• optionally the peer's tunnel IPv4 and your DN42 IPv4, for IPv4 addresses on the tunnel
• optionally the peer's endpoint as host:port and their WireGuard public key
• the session type: one multiprotocol BGP session over IPv6 that also carries IPv4 routes (extended next hop, RFC 8950), or separate IPv4 and IPv6 sessions

It follows common DN42 conventions: the interface is named dn42- plus the last four digits of the peer's AS number, and your listen port is 2 plus those same four digits, so a peer ending in 0000 gets port 20000. BGP runs between link-local addresses on the tunnel interface.

What it doesn't do: it generates no keys and stores nothing, so the WireGuard private key is a placeholder you fill in. It does not contact your peer, check the registry or test the tunnel. The BIRD config assumes the dnpeers template from the DN42 wiki's BIRD 2 guide; the RouterOS config assumes a BGP instance and template called dn42 and route filters dn42-in and dn42-out. Set those up first.

Reading the results

The output has three tabs, each with a copy button.

WireGuard (wg-quick) is a file for /etc/wireguard/dn42-XXXX.conf. It sets Table = off so wg-quick adds no routes (BGP does that), adds the link-local address and, if given, the IPv4 /32 pair, and turns off IPv6 autoconfiguration on the interface. AllowedIPs covers DN42 and its connected networks: 172.20.0.0/14, 172.31.0.0/16, 10.0.0.0/8, fd00::/8 and fe80::/10. With an endpoint, PersistentKeepalive = 25 is added; without one, your side waits for the peer to connect.

BIRD 2 is a protocol bgp block using dnpeers. With extended next hop it enables extended next hop on in the IPv4 channel; with separate sessions the IPv6 session carries no IPv4, and a second, IPv4 session is added if you gave both IPv4 addresses.

RouterOS 7 is a list of commands: the WireGuard interface (MTU 1420) and peer, the addresses, and a /routing bgp connection with afi=ip,ipv6 for extended next hop or afi=ipv6 plus an IPv4 connection for separate sessions.

Findings:

• The listen port and interface name used.
• IPv4 routes ride on the IPv6 session: extended next hop is on and no IPv4 tunnel addresses are needed.
• The peer address is not link-local: you may need a route to it over the tunnel and multihop BGP.
• An AS number is outside 4242420000-4242423999: check for a typo, unless the peer is from a connected network.

Common problems and fixes

The tunnel is up but BGP stays in Connect or Active

Check the link-local addresses on both sides match what each of you configured, and that the BIRD protocol names the interface (interface "dn42-XXXX";, as the generated config does); link-local addresses mean nothing without one. Make sure your firewall allows TCP port 179 on the tunnel interface.

No handshake on WireGuard

One side needs an Endpoint. Confirm the UDP listen port is open and that each side has the other's public key. Exchange ports explicitly: the convention means each of you listens on a port based on the other side's AS number.

IPv4 routes are received but not installed

With extended next hop, IPv4 routes have an IPv6 next hop. Both sides must enable it; if your peer can't, choose separate sessions and give both IPv4 addresses.

Routes are rejected as ROA-invalid

Your peer filters by ROA. Make sure your route and route6 objects exist; check with the DN42 registry search.

FAQ