RPKI

Two halves of RPKI.

Validating other people's routes and signing your own are separate jobs with separate setups. You can do either one here without the other.

01

Validate: point routers at our cache

A free public RPKI-to-Router cache, RFC 8210, on anycast. It carries validated payloads refreshed every ten minutes from the public repositories, so your routers do not have to run a validator of their own.

Value
Hostrtr.yunzheng.space
Addresses177.177.83.88 · 2602:f3ff:83::88
PortsTCP 323 and 8282
ProtocolRFC 8210 version 0 and version 1
CostFree, no account
bird 2
protocol rpki orbit {
  remote "rtr.yunzheng.space" port 323;
  roa4 { table r4; };
  roa6 { table r6; };
}

The hostname is the stable way in — it resolves to the addresses above and survives us moving them. Some older router firmware resolves a hostname poorly or not at all; those can use 177.177.83.88 and 2602:f3ff:83::88 directly.

Use a second cache from another operator alongside this one. A single cache is a single point of failure for your routing policy, and every serious deployment runs at least two.
02

Sign: let us host your CA

If your address space is delegated to you by a RIR, we can run the certificate authority for it. You keep the delegation; we run the software, publish the repository from every anycast node, and keep it backed up.

  1. Create the CA in the console under RPKI. We generate a key and give you the parent-exchange details.
  2. In your RIR portal, set up a delegated CA with those details. RIPE, APNIC and ARIN all call this something slightly different; the console links the right page for yours.
  3. Once the parent accepts, add ROAs — an origin AS, a prefix and a maximum length.
Set the maximum length to the longest prefix you actually announce, not to /24 out of habit. A max length longer than what you announce leaves room for somebody to announce a more specific route inside your space and have it validate.
03

Check what you published

Our RPKI tool takes a prefix and an AS number and tells you what the validated data says about them — valid, invalid or not found, and which payload decided it.

04

Questions

Do I need an account to use the RTR cache?

No. It is open to any router, at no cost. The hosted CA is the part that needs an account.

What happens to my ROAs if I stop using Orbit?

The delegation is yours and can be moved back or elsewhere. Move it before you close the account — a CA whose publication point stops being served will have its objects expire.

Next

Related

Getting started

How an Orbit account is organised, what lives where in the console, and the shortest path from signing in to serving a name from our network.

DNS hosting

Add a zone, point your registrar at our name servers, and manage records. Includes weighted answers, health-checked records, ALIAS at the apex and zone-file import.

Connect a hostname

Delegate the whole domain, delegate one hostname, or add a CNAME and leave your DNS where it is. What each one costs you and when to pick it.

← All documentation