RPKI Validator

Use our validator

There are two ways to use it. Open the validator website, or connect your router to our RPKI-to-Router (RTR) server so that it can check every route it learns.

RTR connection details

Website: https://rpki.stacklayer.host/
IPv4 address: 222.167.221.69
Port: 3323
Transport: TCP, no encryption or authentication
Protocol: RPKI-to-Router (RTR, RFC 8210)
Software: Routinator, by NLnet Labs

RTR over plain TCP is how most routers talk to a validator. It carries public data only, so there is nothing secret in it. Allow TCP 3323 to 222.167.221.69 from your router, and for best results use two validators from different operators, not just ours.

Powered by Routinator, free open-source RPKI software from NLnet Labs.

What RPKI is

The internet finds its way with BGP, and BGP was built on trust. Any network can announce any address block, and by default other networks believe it. That is how accidents and hijacks reroute or black-hole traffic for whole countries.

RPKI

Resource Public Key Infrastructure is a signed record system. The registries that hand out addresses (RIPE NCC, ARIN, APNIC, LACNIC and AFRINIC) let the holder of an address block say, with a digital signature, which network may announce it.

ROA

A Route Origin Authorisation is one of those signed statements. It says that this prefix, up to this length, may be originated by this AS number. It is published openly so anyone can check it.

ROV

Route Origin Validation is what a network does with that data. Its router compares every route it hears against the ROAs. The result is valid, invalid or not found, and most networks refuse the invalid ones.

Why you should have valid ROAs

If you own addresses or run an AS, this is among the cheapest protection you can add. It takes a few minutes in your registry's portal.

Stops mistakes and hijacksIf someone announces your prefix from the wrong AS, networks that validate will drop it and your traffic keeps flowing to you.
More networks accept youA growing number of networks, including large transit providers and exchanges, drop RPKI-invalid routes. A route with no ROA still works today, but one with a wrong ROA does not.
Cleaner peeringPeers and upstreams, including us, expect the prefixes you announce to have correct ROAs and route objects. It makes sessions quicker to approve and easier to support.
Takes minutes, costs nothingROAs are free and your registry hosts them for you. You can change or remove one at any time.

How to publish a ROA

Sign in to your registry
Use the portal of the registry that gave you the addresses, such as MyRIPE (RIPE NCC), ARIN Online, MyAPNIC, MyLACNIC or AFRINIC. Your provider's own tools can do it too if they hold your addresses.
Create the ROA
Enter the prefix, the AS number that will announce it, and a maximum length. Keep the maximum length equal to the prefix length unless you really announce longer ones.
Wait, then check
It usually shows up in validators within an hour. Check the route in a validator and make sure it comes back valid.

Do this before you announce a new prefix, and update the ROA before you move a prefix to a different AS. If you announce something that has a ROA for another AS, validating networks will reject it.

ROAs and IRR route objects

They are two different record systems that work together. Publish both.

IRR route objects

The Internet Routing Registry holds route and route6 objects. Many upstreams and exchanges still build their prefix filters from them, so a missing or wrong object can mean your announcements are filtered. They are not signed, which is why they are not enough on their own.

RPKI ROAs

ROAs are cryptographically signed and are what validators check. They protect against wrong-origin announcements, but they do not list every route you intend to announce, and they do not replace prefix filters.

What to do

Publish a ROA and a matching IRR route object for every prefix you announce, with the same origin AS. Keep both up to date when anything changes, and keep your AS-SET accurate if you have customers.

Connect your router

Open the one that matches your router. Replace the AS number and policy names with your own, and test on a lab or a single session first. These are examples, not a full configuration, and syntax changes between versions.

Always keep a second validator configured as well. If your router loses every validator it will stop checking, and what happens then depends on your platform.

MikroTik RouterOS 7

# RouterOS 7 only. RouterOS 6 cannot do RPKI.
/routing/rpki
add group=stacklayer address=222.167.221.69 port=3323

# put these rules at the start of the chain your BGP sessions use as their input filter
/routing/filter/rule
add chain=BGP-IN rule="rpki-verify stacklayer"
add chain=BGP-IN rule="if (rpki invalid) { reject }"

# check it
/routing/rpki/print

Juniper Junos

set routing-options validation group STACKLAYER session 222.167.221.69 port 3323
set routing-options validation group STACKLAYER session 222.167.221.69 refresh-time 120

set policy-options policy-statement RPKI-REJECT term invalid from protocol bgp
set policy-options policy-statement RPKI-REJECT term invalid from validation-database invalid
set policy-options policy-statement RPKI-REJECT term invalid then reject

# make RPKI-REJECT the first policy on each BGP group (keep your own policies after it)
set protocols bgp group TRANSIT import [ RPKI-REJECT YOUR-OWN-IMPORT-POLICY ]

# check it
show validation session
show validation database

BIRD 2

roa4 table r4;
roa6 table r6;

protocol rpki stacklayer {
  roa4 { table r4; };
  roa6 { table r6; };
  remote 222.167.221.69 port 3323;
  retry keep 90;
  refresh keep 900;
  expire keep 172800;
}

# in the import filter of each BGP session, before anything else:
filter RPKI_IN {
  if net.type = NET_IP4 && roa_check(r4, net, bgp_path.last) = ROA_INVALID then reject;
  if net.type = NET_IP6 && roa_check(r6, net, bgp_path.last) = ROA_INVALID then reject;
  accept;
}

# check it
# birdc show protocols all stacklayer

Cisco IOS XE

router bgp 64496
 bgp rpki server tcp 222.167.221.69 port 3323 refresh 600
!
route-map RPKI-IN deny 10
 match rpki invalid
route-map RPKI-IN permit 20
! make this route-map the first inbound policy on your neighbors

! check it
! show ip bgp rpki servers

Cisco IOS XR

router bgp 64496
 rpki server 222.167.221.69
  transport tcp port 3323
  refresh-time 600
!
route-policy RPKI-IN
  if validation-state is invalid then
    drop
  endif
  pass
end-policy

! check it
! show bgp rpki server summary

FRRouting

rpki
 rpki cache 222.167.221.69 3323 preference 1
exit
!
route-map RPKI-IN deny 10
 match rpki invalid
route-map RPKI-IN permit 20

! check it
! show rpki cache-connection

VyOS

set protocols rpki cache 222.167.221.69 port 3323
set protocols rpki cache 222.167.221.69 preference 1

set policy route-map RPKI-IN rule 10 action deny
set policy route-map RPKI-IN rule 10 match rpki invalid
set policy route-map RPKI-IN rule 20 action permit

# check it
show rpki cache-connection

The small print

This is a public service, offered as a courtesy to the internet community. Please read the terms and the acceptable use policy before you rely on it.

Best effortNo uptime promise, no support commitment and no service credits. It may be slow, out of date or offline, and we may change or stop it without notice.
Do not depend on it aloneUse at least two validators from different operators, and decide what your network does if validation is not available.
Fair useUse it for your own network operations. Do not hammer it, scan it or attack it. Abuse gets an address blocked.

Read the RPKI Validator Terms and the RPKI Validator Acceptable Use Policy. Our Peering Policy explains what we expect from the networks we peer with.

Questions about RPKI

Talk to support

Do I have to pay to use it?

No. It is free to use and needs no account or sign-up.

Is it a guarantee?

No. It is provided on a best-effort basis, with no uptime commitment. Read the terms below, and use more than one validator.

What is the difference between "invalid" and "not found"?

"Not found" means there is no ROA covering the route, so nothing says it is wrong. "Invalid" means a ROA exists but the route does not match it, either the wrong origin AS or a prefix that is too specific. Invalid routes are the ones networks drop.

Why does my route say invalid?

Usually the ROA was made for a different AS number, the maximum length is shorter than the prefix you announce, or the ROA was not updated after a move. Fix the ROA in your registry, and recheck after about an hour.

Will you reject my routes if they are invalid?

We validate routes on AS218805, and we ask everyone we peer with to publish correct ROAs and route objects. See the Peering Policy for what we expect.

Can I use it for a commercial network?

Yes, for your own operations. You may not resell it or present it as your own service. The acceptable use policy has the details.

Who do I contact about a problem?

Open a ticket from the client area, or email the abuse address in the policy if the problem is misuse. Without a customer account, we cannot promise a reply.