mikrotik-irrupdater

What the scripts are for

Mikrotik irrupdater is a collection of scripts that update IRR routing filters on a Mikrotik router running RouterOS 7 or newer. The goal is to run strict IRR filters on customer and peer BGP sessions when your router is a Mikrotik. The scripts wrap around BGPQ4 to generate prefix lists, then build filter configuration that the included Python code pushes to the router through the Mikrotik API. The prerequisites are a Mikrotik router on ROS 7, which the authors tested against 7.7 through 7.16.1, an API configured and reachable on the router, the Mikrotik RouterOS API Python package, a router running BGP, and BGPQ4 installed on the host, which on Debian or Ubuntu means apt get install bgpq4. The collection is meant to be self contained. The authors note that an earlier release required IRRPT and other pieces, but this version puts everything in one place after feedback that the old setup was too complex. You install it into /usr/share/mikrotik-irrupdater/ on your host. If you want to run the Python on its own, the script accepts a simple format of chain and rule entries, for example a chain named as35008 fcix import ipv4 with a rule that accepts a specific destination prefix and a final reject rule, and the included scripts build that format from the prefix list that BGPQ4 produces.

Configuring routers, peers, and sessions

You configure the tool with three files under config. The routers.conf file holds the username and password needed to reach each router's API. The peers.conf file lists your peers as comma separated lines of ASN and AS SET, and you update it whenever you add a peer that needs filters. The sessions.conf file combines the ASN, a slug such as the exchange name, and the router hostname or IP it runs on, and you update it whenever you set up a new peer at an internet exchange, a private network interconnect, or a new router. Sessions.conf also accepts a fourth field of ipv4 or ipv6 if you only want to push one address family, and an optional fifth field with a human readable peer name. When you give a peer name, it replaces the as number in the chain and filter file names, so instead of as35008 fcix import ipv4 you get Kerfuffle fcix import ipv4. The slug is used as the entity name in the generated filters. For example, Facebook at SFMIX becomes as32934 sfmix import ipv4 and as32934 sfmix import ipv6. The generated filters then call a next filter named with the slug plus import, such as sfmix import, where you set local preference, MED, communities, and your internal traffic engineering policy.

Automating the build and push

Once the configuration files are set, you schedule two scripts with cron and the system keeps your filters current. The buildprefixes.sh script runs on a schedule and uses bgpq4 to build the prefix lists and the actual filters that will be pushed to the router. How long it takes depends on the number of peers and how many prefixes they announce. It pulls the prefixes for your peers from config/peers.conf. The pushfilters.sh script runs on a schedule, or right after buildprefixes.sh, and calls the Python code to push the filters to your routers. It loops through everything listed in config/sessions.conf automatically, so you do not invoke each router by hand. The README also points to a Juniper version of the scripts called junos irrupdater for shops that run Juniper gear. The authors presented this work at several internet forums, including EPF and Teraco Virtual Tech Days, and they link a slide deck and a recorded talk. They invite feature requests, additions, and questions from users who want to make the tool better. The overall workflow stays simple: bgpq4 produces prefixes, the scripts turn them into RouterOS filter rules, and the Python client applies them through the API on a repeating schedule.

Editorial conclusion

Mikrotik irrupdater is a Python and shell script collection licensed under GPL version 3.0. It wraps BGPQ4 and the Mikrotik API to push strict IRR prefix filters to RouterOS 7 routers on a cron schedule.